SEC560: Enterprise Penetration Testing
Online
Upcoming Courses
Profile
Tim began his security career in 2008 with a role at AgStar Financial Services (now Compeer Financial), and since then has worked for FishNet Security (now Optiv) and Counter Hack, before founding Red Siege. A SANS instructor since 2012, Tim is currently the program director for the SANS Master of Science in Information Security Engineering (MSISE) curriculum, as well as a principal instructor and course author. In the classroom, you'll find him teaching SEC560: Network Penetration Testing and Ethical Hacking, of which he is also lead author, and SEC660: Advanced Penetration Testing, Exploit Writing, and Ethical Hacking.
Through the course of his career, Tim's had the opportunity to hack some of the best and biggest companies on earth and get a sneak peek inside cutting-edge technology before it's publicly released. He has performed penetration tests on a wide range of organizations and technologies in industries including control systems, higher education, financial services, and manufacturing, and brings years of practical experience and stories from himself and his team to his SANS students.
Tim says an eagerness to learn, and an openness to see things differently are keys for success in his classroom. "I really enjoy seeing students break through their current way of thinking and see technology and data differently," he says.
And those lessons can have a lasting impact. "Years ago I had a high school student in a one-day class who came up to me years later and showed me he was doing penetration testing at a major company," says Tim. "It was amazing to see him develop himself and see his transformation."
Tim is an experienced international speaker and the creator of Kerberoasting, a widely-used technique to extract kerberos tickets in order to offline attack the password of enterprise service accounts. He has an MBA from the University of Texas, holds the GWAPT, GPEN, GMOB, GCED, and GCIH certifications, and previously held the CCNA certification.
In his free time, you'll find Tim watching sports, appreciating a good beer, and running.
ADDITIONAL CONTRIBUTIONS BY TIM MEDIN:
WEBCASTS
Dirty Defense, Done Dirt Cheap: Make your life easier by making mine harder
Hacking Common AD Misconfigurations
Assumption of a breach: How a new notion can help protect your enterprise
Enterprise Discovery: I Still Haven’t Found What I’m Looking For
PRESENTATIONS
Assumed Breach: The Better Pen Test
KringleCon - Hacking Dumberly Not Harderer
Hacking Dumberly Redux - More Dumberer
Successful Hacking with Domain Admin
ARTICLES
Recon Methods Part 1 - OSINT Host Discovery
Recon Methods Part 2 – OSINT Host Discovery Continued
User Enumeration Part 2 – Microsoft Office 365
You can read Tim's blog posts here.
PODCASTS
Daily Cyber #212 - Understanding Penetration Testing
Assumed Breach: The Better Pen Test
Paul's Security Weekly #535 - Breaking Kerberos with Active Directory