SANS_SEC_501_PWS.docx

PERFORMANCE WORK STATEMENT (PWS)

The contractor shall provide all required essentials to online live courses for the COARNG Cyber Protection Team to conduct a SANS SEC 501 for 21 participants and SANS SEC 401 for 4 participants.

The North American Industry Classification System (NAICS) code assigned to this procurement is 611699.

Purpose The new Cyber Protection Team (CPT) based in Colorado has industry specific training requirements to enable them to be mission ready and deployable to engage in cyber missions. This requirement is calling for SANS SEC 401 & 501 training.

Period of Performance SEC 401 1 year voucher for class and testing from date of purchase SEC 501 1 year voucher for class and testing from date of purchase SEC 575 1 year voucher for class and testing from date of purchase

Place of Performance Online Live training

Government Furnished Equipment N/A

Quality Assurance (QA) The Government shall evaluate the contractor’s performance in accordance with the Quality Assurance Surveillance Plan (QASP) to ensure that the contractor has performed in accordance with the performance standards.

Requirements The following services and supporting materials are required to satisfy mission-critical requirements: The contractor shall: provide Online Live Training for SANS SEC 501 for 20 participants, SANS SEC 401 for 4 participants and SANS SEC 575 for 2 participants. Additionally, the vendor will provide 1 test voucher and 1 Netwars annual subscription for each SANS 501 and 401 seat and one voucher for each Sans 575.

More specifically, training should accomplish baseline requirements for each course:

CMRA Requirements Contractor Manpower Reporting (CMR). The contractor shall report ALL contractor labor hours (including subcontractor labor hours) required for performance of services provided under this contract for PROFESSIONAL ADMINISTRATIVE SUPPORT SERVICES (PASS) collection site. The contractor is required to completely fill in all required data fields using the following web ad-dress: http://www.ecmra.mil/.

Reporting inputs will be for the labor executed during the period of performance during each Government fiscal year (FY), which runs October 1 through September 30. While inputs may be reported any time during the FY, all data shall be reported no later than October 31 of each calendar year.

Contractors may direct questions to the help desk at http://www.ecmra.mil/.

Course Syllabus SEC501.1: Defensive Network Architecture Overview Section 1 will focus on security in the design and configuration of various enterprise infrastructures. From a security perspective, proper design and configuration protects both the components being configured, as well as the rest of the organization that depends on that gear to defend other components from attacks. In other words, a good house needs a good foundation!

We'll discuss published security benchmarks, vendor guidance for securing various products, and regulatory requirements and how they impact defending infrastructure against specific attacks. To illustrate these points, we'll be looking in detail at securing and defending a router infrastructure against a number of device- and network-based attacks.

In addition, we'll cover securing Windows and Active Directory against specific attacks. Securing Private and Public Cloud Infrastructure against common attacks will also be discussed, and Active Defense approaches will be covered in some detail.

Exercises

· Attack and Defense of Router Architectures

· Secure Configuration and Audit of Network Architectures

· Defenses against Attacks Mounted on Authentication Interfaces

· Defending and Attacking Critical Protocols

· Logging as a Critical Component of Defense

· Man-in-the-Middle Attacks and Defenses

· Active Defense:

· Honeypots/Honeyports

· Honey Documents from Both the Attacker and Defender Perspective CPE/CMU Credits: 8 Topics

· Security Benchmarks, Standards, and the Role of Audit in Defending Infrastructure

· Defense Using Authentication and Authorization, and Defending Those Services

· The Use of Logging and Security Information and Event Management (SIEM) in Defending an Organization from Attack

· Attacking and Defending Critical Protocols

· Several Man-in-the-Middle Attack Methods, and Defenses against Each

· Infrastructure Defense Using IPS, Next-Generation Firewalls, and Web Application Firewalls

· Defense of Critical Servers and Services

· Active Defense

· Defense of Private and Public Cloud Architectures SEC501.2: Penetration Testing Overview Security is all about understanding, mitigating, and controlling the risk to an organization's critical assets. An organization must understand the changing threat landscape and have the capacity to compare it against its own vulnerabilities that could be exploited to compromise the environment. On day two, students will learn about the variety of tests that can be run against an organization and how to perform effective penetration tests to better understand the security posture for network services, operating systems, and applications. In addition, we'll talk about social engineering and reconnaissance activities to better emulate increasingly prevalent threats to users.

Finding basic vulnerabilities is easy but not necessarily effective if these are not the vulnerabilities attackers exploit to break into a system. Advanced penetration testing involves understanding the variety of systems and applications on a network and how they can be compromised by an attacker. Students will learn about scoping and planning their test projects, performing external and internal network penetration testing, web application testing, and pivoting through the environment like real-world attackers.

Penetration testing is critical to identify an organization's exposure points, but students will also learn how to prioritize and fix these vulnerabilities to increase the organization's overall security.

Exercises

· Scanning and Enumeration Fundamentals

· More Scanning and Enumeration Options

· Vulnerability Scanning with OpenVAS

· Exploitation + Metasploit Basics

· Basic Web App Scans and Attacks

· Metasploit and Pivoting CPE/CMU Credits: 6 Topics

· Introduction to Penetration Testing Concepts

· Penetration Testing Scoping and Rules of Engagement

· Online Reconnaissance and Offensive Counterintelligence

· Social Engineering

· Network Mapping and Scanning Techniques

· Enterprise Vulnerability Scanning

· Network Exploitation Tools and Techniques

· Web Application Exploitation Tools and Techniques

· Post-Exploitation and Pivoting

· OS and Application Exploit Mitigations

· Reporting and Debriefing SEC501.3: Network Detection and Packet Analysis Overview "Prevention is ideal, but detection is a must" is a critical motto for network security professionals. While organizations always want to prevent as many attacks as possible, some adversaries will still sneak into the network. In cases where an attack is not successfully prevented, network security professionals need to analyze network traffic to discover attacks in progress, ideally stopping them before significant damage is done. Packet analysis and intrusion detection are at the core of such timely detection. Organizations need to not only detect attacks but also to react in a way that ensures those attacks can be prevented in the future.

Because of the changing landscape of attacks, detecting them is an ongoing challenge. Today's attacks are more stealthy and difficult to find than ever before. Only by understanding the core principles of traffic analysis can you become a skilled analyst capable of differentiating between normal and attack traffic. New attacks are surfacing all the time, so security professionals must be able to write intrusion detection rules that detect the latest attacks before they compromise a network environment.

Traffic analysis and intrusion detection used to be treated as a separate discipline within many organizations. Today, prevention, detection, and response must be closely knit, so that once an attack is detected, defensive measures can be adapted and proactive forensics implemented, and the organization can to continue to operate. This course section will start with a brief introduction to network security monitoring, followed by a refresher on network protocols with an emphasis on fields to look for as security professionals. We'll use tools like TCPdump and Wireshark to analyze packet traces and look for indicators of attacks. We'll use a variety of detection and analysis tools, craft packets with Scapy to test detection, and touch on network forensics and the Security Onion monitoring distribution. Students will also explore Snort as a network Intrusion Detection System, and examine rule signatures in-depth.

Exercises

· Analyzing PCAPs with TCPdump

· Attack Analysis with Wireshark

· Crafting Packets to Test Network Monitoring

· Network Forensics with Security Onion: Detecting Malicious Activity

· Extracting PCAP Content for Forensics

· Snort Basics

· Wireshark Network Compromise Analysis CPE/CMU Credits: 6 Topics

· Network Security Monitoring

· IP, TCP, and UDP Refresher

· Advanced Packet Analysis

· Introduction to Network Forensics with Security Onion

· Identifying Malicious Content and Streams

· Extracting and Repairing Content from PCAP files

· Traffic Visualization Tools

· Intrusion Detection and Intrusion Prevention

· Snort In-Depth

· Writing Snort Signatures

· Handling Encrypted Network Traffic SEC501.4: Digital Forensics and Incident Response Overview "Bad guy elimination" is the core mission for Digital Forensics and Incident Response (DFIR) professionals. Incidents happen, and organizations rely on these professional responders to find, scope, contain, and remediate evil from their networks. Investigators employ DFIR practices to determine what happened. DFIR teams conduct investigations to find evidence of compromise, remediate the environment, and provide data to generate local threat intelligence for operations teams in order to continuously improve detection. While traditionally seen as a finite process, incident response is now viewed as ongoing, with DFIR professionals searching for evidence of an attacker that has existed in the environment without detection by applying new threat intelligence to existing evidence - the crux of the concept of "threat hunting."

In this section, you will learn the core concepts of both "Digital Forensics" and "Incident Response." We'll explore some of the hundreds of artifacts that can give forensic investigators specific insight about what occurred during an incident. You will also learn how incident response currently operates, after years of evolving, in order to address the dynamic procedures used by attackers to conduct their operations. We'll look at how to integrate DFIR practices into a continuous security operations program.

We'll cover the general guidelines for a cyclical, six-step incident response process. Each step will be examined in detail, including practical examples of how to apply it. Lastly, you'll learn the artifacts that can best be used to determine the extent of suspicious activity within a given environment and how to migrate techniques to a large data set for enterprise-level analysis.

Exercises

· Data Recovery with FTK Imager and Photorec

· Ransomware Timeline Analysis

· Ransomware Network Analysis CPE/CMU Credits: 6 Topics

· DFIR Core Concepts: Digital Forensics

· Definitions and Use Cases/Mission Areas

· Performing Forensically Sound Analysis

· Forensic Artifacts in the Windows Environment

· Digital Forensics Tools

· DFIR Core Concepts: Incident Response

· Definitions and Use Cases

· Generating and Using Threat Intelligence for Incident Response

· DFIR Sub-disciplines: Endpoint, Network, Threat Intelligence, Reverse Engineering

· Incident Response Tools

· Modern DFIR: A Live and Continuous Process

· Definitions and Use Cases

· Six-Step Process Guidelines: Preparation, Identification/Scoping, Containment/Intelligence Development, Eradication/Remediation, Recovery, Follow-up/Lessons Learned

· Widening the Net: Scaling the DFIR Process and Scoping a Compromise

· Definitions and Use Cases

· Generation and Consumption of Threat Intelligence

· Examples of Artifacts to Support Scoping

· Scoping as a Continuous Component of Modern Incidence Response

· Scoping and Scaling Tools SEC501.5: Malware Analysis Overview Malicious software is responsible for many incidents in almost every type of organization. Types of Malware vary widely, from Ransomware and Rootkits to Crypto Currency Miners and Worms. We will define each of the most popular types of malware and walk through multiple examples. The four primary phases of malware analysis will be covered: Fully Automated Analysis, Static Properties Analysis, Interactive Behavior Analysis, and Manual Code Reversing. You will complete various in-depth labs requiring you to fully dissect a live Ransomware specimen from static analysis through code analysis. You will get hands-on experience with tricking the malware through behavioral analysis techniques, as well as decrypting files encrypted by Ransomware by extracting the keys through reverse engineering. All steps are well defined and tested to ensure that the process to achieve these goals is actionable and digestible.

Exercises

· Static Properties Analysis of Ransomware

· Using Linux Tools such as File, Strings, clamscan, pescan, and VirusTotal

· Using Windows Tools such as PeStudio and strings2

· Interactive Behavior Analysis of Ransomware - Part I

· Use Process Monitor to Monitor File System, Network, Process Activity, and Registry Access

· Use Process Hacker to Examine Process Behavior and Memory

· Interactive Behavior Analysis of Ransomware - Part II

· Perform Advanced Behavioral Analysis against the Ransomware Specimen

· Trick the Ransomware into Thinking It Is Able to Reach Online Resources

· Utilize the Burp Proxy Tool to Modify Data to and from the Ransomware

· Convince the Ransomware that Payment Was Made to Recover All Files

· Manual Code Reversing of Ransomware

· Perform Code Analysis of the Ransomware

· Perform Deobfuscation for Further Analysis and Crypto Key Recovery

· Utilize PowerShell to Interact with the .NET Framework and Decrypt Files CPE/CMU Credits: 6 Topics

· Introduction to Malware Analysis

· The Many Types of Malware

· ATM/Cash Machine Malware

· Building a Lab Environment for Malware Analysis

· Malware Locations and Footprints

· Fully Automated Malware

· Cuckoo Sandbox

· Static Properties Analysis

· Interactive Behavior Analysis

· Manual Code Reversing

· Tools such as IDA, PeStudio, ILSpy, Process Hacker, Process Monitor, NoFuserEx, etc.

SEC501.6: Enterprise Defender Capstone Overview The concluding section of the course will serve as a real-world challenge for students by requiring them to work in teams, use the skills they have learned throughout the course, think outside the box, and solve a range of problems from simple to complex. A web server scoring system and Capture-the-Flag engine will be provided to score students as they submit flags to score points. More difficult challenges will be worth more points. In this defensive exercise, challenges include packet analysis, routing protocols, scanning, malware analysis, and other challenges related to the course material.

CPE/CMU Credits: 6

SEC401.1: Network Security Essentials

Overview A key way that attackers gain access to a company's resources is through a network connected to the Internet. A company wants to try to prevent as many attacks as possible, but in cases where it cannot prevent an attack, it must detect it in a timely manner. Therefore, an understanding and ability to create and identify the goals of building a defensible network architecture are critical. It is just as important to know and understand the architecture of the system, types of designs, communication flow and how to protect against attacks using devices such as routers and firewalls. These essentials, and more, will be covered during 401.1, in order to provide a firm foundation for the consecutive days of training.

By the end of the 401.1, you will understand Defensible Network Architecture, Virtualization and Cloud Security (Lab Virtual Machine Setup), Network Device Security, Networking and Protocols (Lab - tcpdump), Securing Wireless Networks (Lab - Aircrack-ng), Securing Web Communications (Lab -Wireshark). In any organization whether large or small all data is not created equal. Some data is routine and incidental while other information can be very sensitive, the loss of which could cause irreparable harm to an organization.

Understanding attacks, the vulnerability behind those attacks and how to prioritize the information and steps to secure the systems will be essential. Common attacks occur with web applications, authentication and other forms of communication. It is imperative to gain familiarity with protocols and techniques used to monitor, stop and even perform attacks against systems.

CPE/CMU Credits: 8 Topics SEC401.1 Network Security Essentials - Module Outline

· Defensible Network Architecture

· Virtualization and Cloud Security

· Lab Virtual Machine Setup

· Network Device Security

· Networking and Protocols

· Lab - tcpdump

· Securing Wireless Networks

· Lab - Aircrack-ng

· Securing Web Communications

· Lab -Wireshark Module 1: Defensible Network Architecture Involves the fundamentals of network architecture, including network architecture, attacks against network devices, network topologies and network design.

· Network Architecture: Understand and identify the goals of building a defensible network architecture

· Understanding the Architecture of the System

· Conceptual Design

· Logical Design

· Physical Design

· Understand Communication Flow

· Know Where Your Valuable Data is

· Attacks Against Network Device: Understand and identify the common types of attacks against networks

· Networks Under Attack

· Threat Enumeration

· Threat Agents

· Attacks Against Routers

· Attacks against switches

· Network Topologies: Understand and know the different types of topologies and the inherent security risks they create

· Physical and Logical Topologies

· Ethernet

· Network Design

· Approaches to Network Design

· Network Design: Understanding and knowing how to design a secure network that incorporates both prevention and detection

· Approaches to Network Design

· Network Architecture Design

· Network Design Objectives

· Network Sections Module 2: Virtualization and Cloud Security Involves understanding and learning what virtualization is and how it works, the most common form of virtualization and how virtual machines interact with multiple operating systems.

· Virtualization

· Setting Up Virtualization

· Virtualization Security

· Virtualized Architectures

· Cloud Overview

· Cloud Security

· Lab 1.1: Virtual Machine Setup: The purpose of this lab is to learn how to set up Windows and Linux virtual machines in a lab-based environment and understanding the fundamentals of the operating systems and how to run basic commands. Completing the lab, you will learn:

· Copy and extract the SANS-supplied Windows 10 virtual machine and the Kali Linux virtual machine to your hard drive

· Start the virtual machines with VMware Workstation, Player, or Fusion if on a Mac

· Configure your Windows 10 licensing

· Verify network connectivity between the two virtual machines Module 3: Network and Device Security Involves understanding the different devices that are deployed on a network and how they function.

· Network Devices

· Routing

· How Routing Works

· Device Security Module 4: Networking and Protocols Involves understanding the properties and functions of network protocols and the network protocol stacks

· Network Protocols

· Layer 3

· Internet Protocol (IP)

· Internet Control Message Protocol (ICMP)

· Layer 4

· Transmission Control Protocol (TCP)

· User Datagram Protocol (UDP)

· tcpdump

· Lab1.2: tcpdump: The purpose of this lab is to learn how to use Kali and run a sniffer and understand how to decode packets. You will learn,

· Introduction to tcpdump and basic commands

· Running tcpdump and sniffing network traffic

· Analyzing hex and ASCII data

· Connecting to a non-listening TCP port Module 5: Securing Wireless Networks Involves the aspect of deploying and utilizing wireless networks. Student will understand wireless technologies.

· Wireless overview

· Bluetooth and ZigBee

· 802.11

· Wireless security

· Lab1.3: Aircrack-ng: In the lab, you will use the aircrack-ng tool suite to assess the security of both the Wired Equivalent Privacy (WEP) security algorithm and Wi-Fi Protected Access (WPA) protocol associated with 802.11 wireless network security. You will learn:

· Introduction to the aircrack-ng suite

· Cracking a WEP key

· Cracking a WPA2 passphrase Module 6: Securing Web Communications Involves understanding how web applications work. Learn best practices for creating secure web applications and how to identify and fix vulnerabilities in web applications.

· How Web Applications Work

· Basics of Secure Coding

· Web Application Vulnerabilities

· Lab 1.4: WireShark: In this lab, you will learn how to use Wireshark and understand how to analyze packets.

· Introduction to Wireshark and its GUI

· Basic capture of an FTP connection

· Analysis of a TFTP session SEC401.2: Defense-In-Depth and Attacks

Overview To secure an enterprise network, you must understand the general principles of network security. In 401.2, we look at threats to our systems and take a "big picture" look at how to defend against them. You will learn that protections need to be layered: a principle called defense-in-depth. We explain some principles that will serve you well in protecting your systems. You will also learn about key areas of network security.

The course starts with information assurance foundations. Students look at security threats, and how they have impacted confidentiality, integrity, and availability. The first half of the day also covers creating sound security policies and password management, including tools for password strength on both Unix and Windows platforms. The day draws to a close by looking at attack strategies and how the offense operates.

Students will understand to properly secure and defend a network, you must first have a clear and strong understanding of both the logical and physical components of an architecture. In security (and design), huge mistakes have been made because the security architect did not look at the system as a whole, but rather focused on a particular problem which weakened the overall analysis. It's always important to remember that analyzing the security of something as complex as a network is in itself a complex process.

CPE/CMU Credits: 8 Topics SEC401.2 Defense-In-Depth and Attacks -Module Outline

· Defense-in-Depth

· Access Control & Password Management

· Lab - John the Ripper

· Security Policies

· Lab - Cain & Abel

· Critical Controls

· Malicious Code and Exploit Mitigations

· Lab - Malicious Software

· Advanced Persistent Threat (APT) Module 7: Defense-in-Depth Involves understanding what defense in depth is and an overview of the key areas of security.

· Defense-in-Depth Overview

· Risk = Threats x Vulnerabilities

· CIA Triad

· Strategies for Defense in Depth

· Core Security Strategies Module 8: Access Control & Password Management: Involves understanding understand the fundamental theory of access control

· Access control

· Data classification

· Managing access

· Separation of duties

· Password management

· Password management technologies

· How password assessment works

· Lab 2.1 - John the Ripper: In this lab students will perform a lab using John the Ripper, a widely-used password cracking tool, which was covered in the module. Completing the lab, you will learn:

· Introduction to John the Ripper and its various components

· Cracking passwords with John the Ripper Module 9: Security Privacy Involves the understanding on how to assess a policy by establishing a baseline framework to work within, and by establishing a mission statement that defines your policies.

· Security Policies

· Need for policies

· Policy Framework

· Enforcement

· Lab 2.2 - Cain & Abel: This lab is designed to help learn how to use a multi-purpose tool like Cain & Abel and understand the fundamentals of auditing the strength of passwords. In this lab, you will learn:

· Introduction to Cain & Abel and its GUI

· Extracting and cracking passwords from your Windows 10 SAM database

· Cracking a password from a Cisco Router Module 10: Critical Security Controls Involves understanding the purpose and background of the Critical Security Controls.

· Overview of the Critical Security Controls

· The Critical Security Controls

· Sample Critical Security Control Module 11: Malicious Code and Exploit Mitigation Involves understanding the details of the Mitnick-Shimomura attack, as well as what we can learn from this attack to appropriately protect our networks against these threats.

· Mitnick-Shimomura

· Defensive strategies

· Common types of attacks

· Lab 2.3 - Malicious Software: In this lab, you will learn how to defend against malicious software understand the operations of malicious software. You will also learn:

· Analyzing the non-trojaned program

· Analyzing the trojaned program and gaining privileged access

· Checking for a buffer overflow Module 12: Advanced Persistent Threat (APT) Involves learning the new threats that exist in cyberspace and effective ways for dealing with these threats. Students will also understand what an APT is and the basic strategies of how they work and operate.

· What are APTs and why are they so hard to manage?

· Defending Against an APT

· How can cyber remediation be approached?

· Offensive Operations

SEC401.3: Threat Management

Overview Whether targeting a specific system or just searching the Internet for an easy target, an attacker uses an arsenal of tools to automate finding new systems; mapping out networks; and probing for specific, exploitable vulnerabilities. This phase of an attack is called reconnaissance, and it can be launched by an attacker any amount of time before exploiting vulnerabilities and gaining access to systems and networks. In fact, evidence of reconnaissance activity can be a clue that a targeted attack is on the horizon.

Those in charge of system and network security cannot afford to be any less proficient in discovering and eliminating these vulnerabilities than the attackers are at finding and exploiting them. One strategy is to make full use of the very tools being used against you and to do it regularly. With security, proper visibility is critical. If you do not understand or know about vulnerabilities, this puts you at a disadvantage, especially based on the fact that the adversary is usually aware of these exposures. The more you know about your environment, the better you can protect it.

This module covers technology, tools, and techniques used for information gathering, network mapping, vulnerability scanning, and the management application of mapping, scanning technology, including exploitation. First, let's set the stage in terms of the management expectation of such a program. Second, we define threat vectors and common sources of reconnaissance on your systems. Then, we examine some of the classic probing tools and their impact. We then show you how to use your own tools to find vulnerabilities before the attackers do. Finally, we will show the basic steps of how to do a penetration test to verify and validate the security of your organization.

CPE/CMU Credits: 8 Topics SEC401.3 Threat Management - Module Outline

· Vulnerability Scanning and Penetration Testing

· Lab - nmap

· Network Security Devices

· Lab - Snort

· Endpoint Security

· Lab -hping

· SIEM/log management

· Active Defense

· Lab - Command Injection Module 13: Vulnerability Scanning and Penetration Testing Involves understanding the concepts and relationships behind reconnaissance, resource protection, risks, threats and vulnerabilities.

· Vulnerability management overview

· Network scanning

· Penetration Testing

· Lab 3.1 - Nmap: The purpose of this lab is to identify open ports on a system and understand the operations of port-scanning software. Completing the lab, you will learn:

· Introduction to Nmap and its features

· Port scanning with Nmap

· OS and application version scanning

· Nmap Scripting Engine (NSE) Module 14: Network Security Devices Involves taking a look at the 3 main categories of network security devices: firewalls, NIDS and NIPS. Together they provide a complement of prevention and detection capabilities.

· Firewalls

· Overview

· Types of Firewalls

· Configuration and Deployment

· NIDS

· Types of NIDS

· Snort as an NIDS

· NIPS

· Methods of Deployment

· Lab 3.2: Snort: In this lab, you will learn how to run and configure Snort and understand how to utilize an IDS to detect attacks. Area's within the lab are:

· Introduction to Snort and its features

· Running Snort and triggering an alert

· Reviewing Snort logs and the matched signatures Module 15: Endpoint Security Involves understanding the overall importance and concepts of endpoint security. This module, we will examine some of the key components, strategies, and solutions for implementing endpoint security.

· Endpoint Security Overview

· Endpoint Security Solutions

· HIDS Overview

· HIPS Overview

· Lab 3.3 - hping 3: This lab teaches you how to craft packets and understand packet-creation software. Area's in the lab are:

· Introduction to hping 3 and its features

· Crafting packets with hping 3

· Spoofing IP addresses with hping 3 Module 16: SIEM/Log Management Involves student being able to obtain a high-level understanding of what logging is and why it is important. The student will also know have a high-level understanding of what logging is and why it is important.

· Logging Overview

· Setting Up and Configuring Logging

· Logging Analysis Basics

· Key Logging Activity Module 17: Active Defense Involves explaining what active defense is and how it can be used. You will get an appreciation for new ways to approach security and how to make your defensive solutions more active.

· Defining Active Defense

· Active Defense Techniques

· Active Defense Tools

· Honeypots & Active Defense

· Lab 3.4 - Command Injection: In this lab, you will Learn how to perform command injection and understand how attacks work and operate. Completing the lab, you will understand:

· Normal operation

· Injecting a command to break out of a restriction SEC401.4: Cryptography, Risk Management and Response

Overview There is no silver bullet when it comes to security. However, there is one technology that would help solve a lot of security issues, though few companies deploy it correctly. This technology is cryptography. Concealing the meaning of a message can prevent unauthorized parties from reading sensitive information. Sec401.4 looks at various aspects of encryption and how it can be used to secure a company's assets. A related area called steganography, or information hiding, is also covered.

Cryptography, the science of secret writing, helps us communicate without revealing the meaning of information to adversaries. It also potentially validates to whom we are communicating. It can protect any kind of data, from very sensitive information, such as Internet-based commerce and banking transactions, to harmless messages you would prefer that no one else knew about, such as a letter to a friend. Cryptography (abbreviated as crypto) can provide a great deal of confidentiality and integrity checks for information. However, it is not a silver bullet, and it can lead to a tremendous false sense of security unless used properly and implemented correctly. Cryptography should always be a part of a larger defense-in-depth strategy, providing just one layer of the security onion.

CPE/CMU Credits: 8 Topics SEC401.4 Cryptography, Risk Management and Response - Module Outline

· Cryptography

· Lab - Stego

· Cryptography Algorithms and Deployment

· Applying Cryptography

· Lab - GPG

· Incident Handling and Response

· Lab - Hashing

· Contingency Planning - BCP/DRP

· IT Risk Management Module 18: Cryptography Involves students having a basic understanding of the fundamental concepts of cryptography

· Overview of Cryptology

· Plaintext, Ciphertext, and Key

· Types of Symmetric Encryption

· Symmetric Encryption

· Asymmetric Encryption

· Hash

· Lab 4.1 - Image Steganography: In this lab, you will understand the operations of data hiding program and learn how to utilize steganography programs. The topics will be:

· Learn how to utilize steganography programs Module 19: Cryptography Algorithms and Deployment Involves students having a high-level understanding of the mathematical concepts that contribute to modern cryptography

· Crypto Concepts

· Symmetric and asymmetric cryptosystems

· Crypto attacks Module 20: Applying Cryptography Involves having a high-level understanding of what VPNs are and how they operate. Students will also understand the functionality of the GPG cryptosystem and how they operate.

· Data in transit

· Virtual private networks (VPNs)

· Data at rest

· Data encryption

· Full disk encryption

· GNU Privacy Guard (GPG)

· Key management

· Public key infrastructure (PKI)

· Digital certificates

· Certificate authorities (CA)

· Lab 4.2 - GNU Privacy Guard (GPG): In this lab, you will learn how to utilize GPG and understand the operations of cryptography algorithms.

· Encryption

· Decryption

· Signing a message

· Verifying a signature Module 21: Incident-Handling Foundations Involves understanding the concepts of incident handling and the six-step incident-handling process. Students will also be able to identify areas of law that are important to incident handling and understand important practices in handling evidence

· Incident-handling fundamentals

· Six step processes for handling an incident

· Legal aspects of incident handling

· Lab 4.3 - Hashing: In this lab, you will learn how to utilize hashing programs and understand the operations of cryptography algorithms. Completing the lab, students will review:

· Introduction to hashing tools and file integrity validation

· Automating file integrity checks Module 22: Contingency Planning - BCP/DRP Involves understanding the critical aspect of contingency planning with a business continuity plan (BCP) and disaster recovery plan (DRP)

· Contingency Planning

· Business Continuity Planning (BCP)

· Disaster Recovery Planning (DRP) Module 23: Risk Management Involves understanding the terminology and basic approaches to cyber security risk management

· Risk management overview

· Best-practice approach to risk management

· Threat assessment, analysis, and report to management SEC401.5: Windows Security

Overview Remember when Windows was simple? Windows XP desktops in a little workgroup... what could be easier? A lot has changed over time. Now, we have Windows tablets, Azure, Active Directory, PowerShell, Office 365, Hyper-V, Virtual Desktop Infrastructure (VDI), and so on. Microsoft is battling Google, Apple, Amazon.com, and other cloud giants for supremacy. The trick is to do it securely, of course.

Windows is the most widely-used and targeted operating system on the planet. At the same time, the complexities of Active Directory, PKI, BitLocker, AppLocker, and User Account Control represent both challenges and opportunities. This section will help you quickly master the world of Windows security while showing you the tools that can simplify and automate your work. You will complete the day with a solid grounding in Windows security, by looking at automation, auditing and forensics.

This module discusses the infrastructure that supports Windows security. This is the big-picture overview of the Windows security model, and it provides the background concepts necessary to understand everything else that follows. Because it is the big picture, we can't talk about everything, but many of the details will be filled in throughout the following modules.

CPE/CMU Credits: 8 Topics SEC401.5 Windows Security - Module Outline

· Windows Security Infrastructure

· Lab - Process Hacker

· Service packs, hot fixes, and backups

· Windows access controls

· Lab - Microsoft Baseline Security Analyzer

· Enforcing security policy

· Lab - Secedit

· Securing Windows Network Services

· Automation, auditing, and forensics

· Lab - PowerShell Scripting Module 24: The Windows Security Infrastructure Involves the ability to identify the different types of Windows operating systems and the differences between them. Students will also be able to identify the different types of Windows operating systems and the differences between them.

· Three classes of operating system:

· Client

· Server

· Embedded

· Lab 5.1 - Process Hacker: This lab teaches how to utilize a tool like Process Hacker and understand the operations of Windows and how it works.

· Install and launch Process Hacker

· Examine the details of a process, such as its modules and memory regions

· Inject a DLL into a process and then aggressively terminate that process Module 25: Service Packs, Hotfixes, and Backups:

Involves the understanding of how to manage Windows Service Packs and Hotfixes for a network of Windows hosts.

· Service packs

· E-mail security bulletins

· Patch installation

· Automatic updates

· Windows server update services

· Windows backup

· System restore

· Device driver rollback Module 26: Windows Access Controls Involves understanding how permissions are applied in the Windows NT File System, Shared Folders, Printers, Registry Keys, and Active Directory, and how Privileges are applied.

· NTFS Permissions

· Shared Folder Permissions

· Registry Key Permissions

· Active Directory Permissions

· Privileges

· BitLocker Drive Encryption

· Lab 5.2 - Microsoft Baseline Security Analyzer: Learn to utilize a tool like Microsoft Baseline Security Analyzer and operations of Windows and how to properly secure the operating system. Completing the lab, students will understand the following topics:

· Install the Microsoft Baseline Security Analyzer (MBSA)

· Scan the local computer for vulnerabilities

· Examine an MBSA vulnerability report

· Remediate an identified vulnerability using the NET.EXE utility

· Scan local system again to confirm remediation Module 27: Enforcing Security Policy Involves having a high-level understanding of the features of Group Policy and working with INF security templates

· Applying security templates

· Employing the Security Configuration and Analysis snap-in

· Understanding Local Group Policy Objects

· Understanding Domain Group Policy Objects

· Administrative Users

· AppLocker

· User Account Control

· Checking Recommended GPO settings, including

· Password Policy

· Account Lockout Policy

· Security Options

· Internet Explorer Security

· Miscellaneous Administrative Templates

· Other Settings

· Lab 5.3 - Secedit: In this lab, students will learn to utilize a tool like Secedit and understand the operations of security templates and how to analyze a system

· Open the PowerShell ISE desktop application

· Compare current state of system against an INF security template

· Apply the INF security template to the local computer to reconfigure it

· Re-examine current state to confirm changes made Module 28: Securing Windows Network Services Involves the understanding on how to take basic measures in securing Windows network services

· Best way to secure a service

· Packet filtering

· IPsec authentication and encryption

· Internet Information Server (IIS)

· Remote Desktop Services

· Windows Firewall Module 29: Automation, Auditing, and Forensics Involves Introduction to the techniques and technologies used to audit Windows hosts.

· Verifying Policy Compliance

· Vulnerability Scanning and Reporting

· Creating Baseline System Snapshots

· Gathering Ongoing Operational Data

· Employing Change Detection and Analysis

· Lab 5.4 - PowerShell Scripting: In this lab, students will learn to utilize PowerShell scripting and understand the operations of scripting and automation.

· Open the graphical PowerShell ISE editor (ISE = Integrated Scripting Environment)

· List and manipulate processes and services

· Interact with the file system, such as sorting and hashing files

· Export data to HTML and comma-delimited CSV text files

· Query the Windows Management Instrumentation (WMI) service

· Query a local or remote Windows Event Log messages SEC401.6: Linux Security

Overview While organizations do not have as many Unix/Linux systems, those that they do have are often some of the most critical systems that need to be protected. Sec401.6 provides step-by-step guidance to improve the security of any Linux system. The course combines practical "how to" instructions with background information for Linux beginners, as well as security advice and best practices for administrators of all levels of expertise.

This module discusses the foundational items that are needed to understand how to configure and secure a Linux system. It also provides an overview of the operating system and mobile markets. To lay a foundation, it provides an overview of the different operating systems that are based on Linux.

CPE/CMU Credits: 6 Topics Sec401.6 Linux Security - Module Outline

· Linux Security: Structure, Permissions and Access

· Hardening and Securing Linux Services

· Monitoring and Attack Detection

· Security Utilities Module 30: Linux Security: Structure, Permissions and Access Involves the foundational items that are needed to understand how to configure and secure a Linux system. It also provides an overview of the operating system and mobile markets. To lay a foundation, it provides an overview of the different operating systems that are based on Linux.

· Operating System comparison

· Linux security

· Apple Mac OS security

· Mobile security

· Linux shells

· Linux kernel

· Permissions

· User accounts Module 31: Hardening and Securing Linux Services Involves methods, tips, and tricks for hardening and securing Linux services. The Golden Rule to always remember is: The best way to secure a service is to turn it off.

· Starting services at boot time

· Package control

· Kernel security

· Port control and port restriction Module 32: Monitoring and Attack Detection Involves, Configuring and monitoring logs, logging with syslog and alternatives, parsing and filtering logs with grep, sed, awk, and cut and monitoring and accounting with uditd.

· Log Aggregation and SIEM

· Log Files

· Log Parsing Module 33: Security Utilities Involves some security-enhancement utilities, capabilities, and patch-management applications.

· Using built-in commands and security features

· Configuring integrity checkers

· Integrating host-based firewalls and managing them to provide security

· Using hardening scripts

· Deploying package management strategies

· Understanding other tools for increasing security

SANS SEC 575 Course Syllabus

SEC575.1: Device Architecture and Common Mobile Threats

Overview The first module of SEC575 quickly looks at the significant threats affecting mobile device deployments, highlighted by a hands-on exercise evaluating network traffic from a vulnerable mobile banking application. As a critical component of a secure deployment, we will examine the architectural and implementation differences and similarities between Android (including Android Marshmallow), Apple iOS 11, and the Apple Watch and Google Wear platforms. We will also look at the specific implementation details of popular platform features such as iBeacon, AirDrop, App Verification, and more. Hands-on exercises will be used to interact with mobile devices running in a virtualized environment, including low-level access to installed application services and application data. We'll examine the tools used to evaluate mobile devices as part of establishing a lab environment for mobile device assessments, including the analysis of mobile malware affecting Android and non-jailbroken iOS devices. Finally, we will address the threats of lost and stolen devices (and opportunities for a pen tester), including techniques to bypass mobile device lock screens.

CPE/CMU Credits: 6 Topics Mobile Problems and Opportunities

· Challenges and opportunities for secure mobile phone deployments

· Weaknesses in mobile devices

· Exploiting weaknesses in mobile apps: Bank account hijacking exercise Mobile Device Platform Analysis

· iOS and Android permission management models

· Code signing weaknesses on Android

· Inter-app communication channels on iOS

· Android app execution: Android Runtime vs. Android Dalvik virtual machine

· Android Nougat security benefits Wearable Platforms

· Application isolation and data sharing for Apple Watch

· Network connectivity and Android Wear apps

· Data exfiltration in WatchOS

· Weaknesses in wearable device authentication controls

· Deficiencies in Android Wear and storage encryption Mobile Device Lab Analysis Tools

· Using iOS and Android emulators

· Android mobile application analysis with Android Debug Bridge (ADB) tools

· Uploading, downloading, and installing applications with ADB

· Application testing with the iOS Simulator Mobile Device Malware Threats

· Trends and popularity of mobile device malware

· Mobile malware command and control architecture

· Efficiency of Android ransomware malware threats

· Analysis of iOS malware targeting non-jailbroken devices

· Hands-on analysis of Android malware

· Mobile malware defenses: What works and what doesn't

SEC575.2: Mobile Platform Access and Application Analysis

Overview With an understanding of the threats, architectural components and desired security methods, we dig deeper into iOS and Android mobile platforms focusing on sandboxing and data isolation models, and on the evaluation of mobile applications. This module is designed to help build skills in analyzing mobile device data and applications through rooting and jailbreaking Android and iOS devices and using that access to evaluate file system artifacts. We will also start to evaluate the security of mobile applications, using network capture analysis tools to identify weak network protocol use and sensitive data disclosure over the network. Finally, we'll wrap up the module with an introduction to reverse engineering of iOS and Android applications using decompilers, disassemblers, and manual analysis techniques.

CPE/CMU Credits: 6 Topics Unlocking, Rooting, and Jailbreaking Mobile Devices

· Legal issues with rooting and jailbreaking

· Jailbreaking iOS

· Android root access through unlocked bootloaders

· Root exploits for Android

· Debugging and rooting Android Wear devices

· Using a rooted or jailbroken device effectively: Tools you must have!

Mobile Phone Data Storage and File System Architecture

· Data stored on mobile devices

· Mobile device file system structure

· Decoding sensitive data from database files on iOS and Android

· Extracting data from Android backups

· Using file system artifacts for location disclosure attacks beyond GPS coordinates

· Hands-on attacks against password management apps Network Activity Monitoring

· Mobile application network capture and data extraction

· Capturing iOS cellular/4G network traffic

· Transparent network proxying for data capture

· Encrypted data capture manipulation

· Extracting files and sensitive content from network captures

· Recovering sensitive data from popular cloud storage providers Static Application Analysis

· Retrieving iOS and Android apps for reverse engineering analysis

· Decompiling Android applications including Android Wear

· Circumventing iOS app encryption with Dumpdecrypted and Rasticrac

· Header analysis and Objective-C disassembly

· Accelerating iOS disassembly: Hopper and IDA Pro

· Swift iOS apps and reverse engineering tools

SEC575.3: Mobile Application Reverse Engineering

Overview One of the core skills you need as a mobile security analyst is the ability to evaluate the risks and threats a mobile app introduces to your organization. Through lecture and hands-on exercises in this module, with some analysis skills, you will be able to evaluate critical mobile applications to determine the type of access threats and information disclosure threats they represent. In this module we will use automated and manual application assessment tools to evaluate iOS and Android apps. We'll build upon the static application analysis skills covered in Module 2 to manipulate application components, including Android Intents and iOS URL extensions. We'll also learn and practice techniques for manipulating iOS and Android applications, such as method swizzling on iOS, and disassembly, modification, and reassembly of Android apps. The module ends with a look at a consistent system for evaluating and grading the security of mobile applications using the Application Report Card Project.

CPE/CMU Credits: 6 Topics Automated Application Analysis Systems

· iOS application vulnerability analysis with Needle

· Structured iOS application header analysis

· Tracing iOS application behavior and API use

· Effective Android application analysis with Androwarn

· Android application interaction and Intent manipulation with Drozer

· Extracting secrets with KeychainDumper Reverse Engineering Obfuscated Applications

· Identifying obfuscation techniques

· Decompiling obfuscated applications

· Effective reconstructed code annotation with Android Studio

· Decrypting obfuscated content with Simplify Application Report Cards

· Step-by-step recommendations for application analysis

· Tools and techniques for mobile platform vulnerability identification and evaluation

· Recommended libraries and code examples for developers

· Detailed recommendations for jailbreak detection, certificate pinning, and application integrity verification

· Android and iOS critical data storage: Keychain and key store recommendations

SEC575.4: Penetration Testing Mobile Devices, Part 1

Overview An essential component of developing a secure mobile device deployment is to perform or outsource a penetration test. Through ethical hacking and penetration testing, we examine the mobile devices and infrastructure from the perspective of an attacker, identifying and exploiting flaws that deliver unauthorized access to data or supporting networks.