SANS SEC511

مهدی میرسلطانی

• متوسط
• مسیر آبی
• ۵ درس

دربارۀ این دوره

مخاطبان

• تحلیلگران امنیتی
• کارکنان تازه‌وارد SOC
• مدیران امنیت اطلاعات و متخصصان پاسخ به حوادث

پیش‌نیازها

• آشنایی با اصول امنیت اطلاعات و مفاهیم کلی تهدیدهای سایبری
• دانش پایه، در خصوص ساختار شبکه‌ها، پروتکل‌ها و مفاهیمی مانند TCP / IP
• شناخت محیط‌‌های کاری لینوکس، ویندوز و برخی دستورات پایه‌ای آن‌ها

• Current State Assessment, Security Operations Centers, and Security Architecture
  • Traditional Security Architecture
    • Perimeter-focused
    • Addressed Layer ¾
    • Centralized Information Systems
    • Prevention-Oriented
    • Device-driven
    • Traditional Attack Techniques
  • Introducing Security Onion 2.X
    • Alerts Menu
    • Pivoting to the Hunt Menu
    • The PCAP Menu
  • Modern Security Architecture Principles
    • Detection-oriented
    • Post-Exploitation-focused
    • Decentralized Information Systems/Data
    • Risk-informed
    • Layer 7 Aware
    • Security Operations Centers
    • Network Security Monitoring
    • Continuous Security Monitoring
    • Modern Attack Techniques
    • Adversarial Dominance
    • MITRE ATT&CK®
  • Security Architecture – Key Techniques/Practices and Defensible Network Security Architecture Principles Applied
    • Threat Vector Analysis
    • Data Exfiltration Analysis
    • Detection Dominant Design
    • Intrusion Kill Chain
    • Visibility Analysis
    • Lateral Movement Analysis
    • Data Ingress/Egress Mapping
    • Internal Segmentation
    • Zero Trust Architecture (Kindervag)
    • Data Visualization
    • Network Security Monitoring
    • Continuous Security Monitoring
• Network Security Architecture
  • SOCs/Security Architecture – Key Infrastructure Devices
    • Traditional and Next- Generation Firewalls, and NIPS
    • Web Application Firewall
    • Malware Detonation Devices
    • HTTP Proxies, Web Content Filtering, and SSL/TLS Decryption
    • SIEMs, NIDS, Packet Captures, and DLP
    • Honeypots/Honeynets
    • Network Infrastructure – Routers, Switches, DHCP, DNS
    • Threat Intelligence
  • Segmented Internal Networks
    • Routers
    • Internal SI Firewalls
    • VLANs
    • Detecting the Pivot
    • DNS architecture
    • Encrypted DNS including DNS over HTTPS (DoH) and DNS over TLS (DoT)
• Network Security Monitoring
  • Evolution of NSM
  • The NSM Toolbox
  • NIDS Design
  • Analysis Methodology
  • Understanding Data Sources
    • Full Packet Capture
    • Extracted Data
    • String Data
    • Flow Data
    • Transaction Data
    • Statistical Data
    • Alert Data
    • Tagged Data
    • Correlated Data
  • Practical NSM Issues
  • Cornerstone NSM
    • Service-Side and Client-Side Exploits
    • Identifying High-Entropy Strings
    • Tracking EXE Transfers
    • Identifying Command and Control (C2) Traffic
    • Tracking User Agents
    • C2 via HTTPS
    • Tracking Encryption Certificates
    • Detecting Malware via JA3
  • Detecting Cobalt Strike
    • Criminal Usage of Cobalt Strike
    • Malleable C2
    • Cobalt Strikes x.509 Certificates
• Endpoint Security Architecture
  • Endpoint Security Architecture
    • Endpoint Protection Platforms
    • Endpoint Detection Response
    • Authentication Protection/Detection
    • Configuration Management/Monitoring
  • Endpoint Protection
    • TPM: Device Health Attestation
    • Host-based Firewall, Host-based IDS/IPS
    • Application Control, Application Virtualization
    • Virtualization Based Security
    • Microsoft Defender: Application Guard
    • Windows Defender: Credential Guard
    • Defender for Endpoint: Attack Surface Reduction
    • EMET and Defender Exploit Guard
  • Endpoint Detection Windows – Sysmon
    • FileDelete, ProcessTampering, and other recent additions
    • IMPHASH
    • DeepBlueHash
  • Authentication Protection and Detection
    • Privileged Account Monitoring
    • Dynamic Lock
    • PIN-Only Authentication
    • Hash/Ticket/Token Attacks
• Automation and Continuous Security Monitoring
  • Industry Best Practices
    • Continuous Monitoring and the 20 CIS Critical Security Controls
    • Australian Signals Directorate (ASD) Strategies to Mitigate Targeted Cyber Intrusions
  • Winning CSM Techniques
    • Long Tail Analysis
    • Australian Signals Directorate (ASD) Strategies to Mitigate Cyber Security Incidents
    • The ASD Essential Eight
  • Maintaining Situational Awareness
  • Host, Port, and Service Discovery Host, Port, and Service Discovery
  • Vulnerability Scanning
  • Monitoring Patching
  • Monitoring Applications
  • Monitoring Service Logs
    • Detecting Malware via DNS logs
    • Detecting DNS Tunneling via Iodine and dnscat2
    • Domain_stats and Registration Data Access Protocol (RDAP)
  • Monitoring Change to Devices and Appliances
  • Leveraging Proxy and Firewall Data
  • Configuring Centralized Windows Event Log Collection
  • Monitoring Critical Windows Events
    • Hands-on: Detecting Malware via Windows Event Logs
  • Scripting and Automation
    • Importance of Automation
    • PowerShell
    • DeepBlueCLI

گواهینامه‌ی دوره