SEC401 Security Essentials: Whose Next-Gen Lab is it Anyway?

Key Takeaways

Oh, well, good day everyone. Uh, thanks for taking the time to uh, join me today for a discussion about some of the most recent changes that have been made to our SEC 401 class. Uh, just as we get started here, of course, I would never normally complain about sunshine, but you can just see the sunshine is highlighting on my face here. It's uh, it's kind of nice, but I have a little bit of a glow to me, so to speak. All right, with that again, thank you very much for taking the time to uh join me in this presentation of well talking about our class and the question being whose nextG lab is it anyway? Now what that really means is that in the past little while just actually within the past few weeks or so we've released a major update to the class itself and I'm really excited to talk a little bit more about that. Now just to give you of course another bit of a additional background information about myself. Uh my name is Brian Simon. I am a senior instructor at SANS and I am the author of our SEC 401 uh security essentials class where we focus on the topics and the essentials of network endpoint and cloud-based security. Now when it comes to the class itself actually I thought it would it would be quite beneficial to really just take a little bit of our time to talk about the class the structure uh who it's actually for before we talk about again some of the most recent releases or most recent uh changes in our most recent release of the course itself. Now, when it comes to the class, one of the biggest questions that I'm always asked is, well, just who should take the class? Who should take 401? And of course, uh my answer to that is actually quite an honest answer. The answer is yes. Yes, they should. Now, you should know when someone says yes to any kind of question, especially one where you need more information, there's really no going back against that answer. Now, it's not meant to be disingenuous, but it does sound disingenuous. who should take it? Yes, they should. Uh to dig a little bit deeper into that though, I want to take an opportunity just to give some explanation as to why I say that. When it comes to the idea of this class, our security essentials class, if you are newer to cyber security, if you're newer to information technology, need to learn about cyber security, this class is definitely right for you. Keeping that in mind though, I think one of the biggest misunderstandings about the class is that if you have some experience in the industry already that this class would somehow not be for you. That's why I say yes, it's for everyone. Because you see, whether you have several months or even several years in the industry, this class is still right for you. And how is that the case? Well, consider in today's world, you can definitely specialize in specific areas of cyber security where when you have a specialization, you're not really keeping in mind the entire the entirety of the enormity around you that is the cyber security industry. There just so much and how the industry has grown over the years that today when you specialize, you miss out on everything else that is all around you. Uh to give you an example of that, I have people who take the class that have multiple years of experience in the industry and they'll come up to me after a particular day in class or after the class is over itself and they'll say, "So that's how that worked." Ah, because we can again do our jobs without having to know everything around us. But by knowing what's around us in general, the enormity of the industry, we can do our jobs to a better degree. It's sort of like coming to class, learning to dot the eyes and cross the tees of cyber security. Now, to give you a little bit more of a of a perspective on that, in the class, we cover more than 30 different topical areas of information security where many of those um areas could actually be their own multi-level or multi-day class, meaning that multiple days across different levels of cyber security understanding. To cover more than 30 topical areas in a six-day class is in itself a bit of a challenge, but the goal is to give us a highle overview and then do deep technical dives where it makes sense to do so. And the whole spirit and the whole goal of this course and the structure is to help people walk away being capable, well-rounded cyber security professionals. You know, I I find it fascinating that in our industry, we do things a little bit opposite when you compare yourselves to other professional organizations or industries. Uh for example, if you wanted to be a doctor, you become a doctor first and then you specialize. And here we can actually do quite the opposite. We can specialize without having to have a general overview of everything around us. And I really do want people to walk away being more capable, well-rounded cyber security professionals. But with that in mind, you might ask, well, how do we cover so many different topical areas and still make it make sense at the same time? meaning that I mean is it a disjointed conversation? Is it just start and stop in a very abrupt way? the idea of module to module. Well, in case you know we're curious about that question, I can assure you it's not that way because as the author, one of the things that I wanted to ensure is that we take modules of content that are related one to the other and we form them into a topical theme. And each of our course books, which I also record refer to as course sections, each of our books then has a very specific topical theme with modules that tie together nicely to make that learning process more immunable and more digestible. But we're also going to do a little bit more than that as well. You see, when it comes down to it, I really do want you to walk away being a more capable professional. And one of the things that I would tell you as I was, you know, start to lecture for the class, I would tell you that today it seems to be that we live in a state of only more compromise than ever before. And one of the things that concerns me about that idea, you know, there's always a new compromise seems to be daily in the news. I think what concerns me the most is we have more cyber security than ever before in the history of computing. And yet somehow we also have more compromise at the same time. and that just doesn't line up. So, what I decided to do was to furthermore paint a different example of a story throughout our content. And by story, it's a very loose term. What I mean there is I paint a narrative throughout our conversation. All predicated around how to leverage a more modern defense against a more modern adversary. So in other words, you actually come to class and walk away with the opportunity to apply a modern defensive strategy, but all in the spirit of making you aware of the enormity of the cyber security industry, right? That that's giving you what you need to do your job in a better way, but still know everything else around you at the same time. And the reason I bring that up is just to further delineate that when it comes down to it in our first four books of content, we really focus on the how you need to do things differently relative to learning about the industry at the same time. And by the end of those first four books of content, you are quite eager to know even more specifically how you apply those concepts. And that's where the final two books of content come into play where we take all of the how but then specifically apply it even more intrinsically than what was covered earlier but in the perspectives of operating systems Windows, Unix, Linux, Mac OS as well as the idea of continued conversation on cloud and not only do they do that through the entire week but again more specifically focused for you those final two days of our course content. Just kind of give you an idea of the the different types of themes. We can see here that in our first book of content, we start with the importance of defensible network. We talk about the security essentials that relate to network defensibility because if there's one place the adversary has to be, it's on the network. They can do a lot to hide when it comes to an endpoint. A lot of different things they can leverage by way of root kits and so on to hide their activity. But the one place they cannot hide is the network. Yes, they can encrypt their communication, but you can still observe network communication itself. That's why we begin with that allimportant concept. But then in the next book, well, pardon me, I should finish that book as well. In the first book, we talk about the network security defensibility. And of course, all that information would apply to an on-remise perspective. But we know that today we only use more cloud than ever before. And that statement should be true continually going forward. And so we also leverage that into a conversation around the essentials of cloud-based security, a dedicated set of time where we talk about cloud, what it is, how you want to use it, and where some of the security concerns arise. And then we even do a comparison between on premise and the cloud because of course networking and defensibility there is equally important, if not in some ways even more important than it is on an on-remise perspective. Taking all of that, we then tie into our second book of content, which is on the theme of defense and depth. And defense and depth is the cornerstone of everything we do in a modern cyber security posture. But we actually spend time even just talking about defense and depth because it's a misunderstood concept. And misunderstanding leads to a great deployment that can be quite insecure but give you a false sense of security at the same time. That just makes the fall even more difficult and more painful. Pivoting beyond that, we group topics together. We talk about the idea of vulnerability management and incident response because we'll learn in defense in depth that we're concerned about adversaries. We're concerned about vulnerabilities or to say it be better, we're worried about threats and vulnerabilities themselves. And so in our third book, we extrapolate that set of concepts even more specifically talking about how threats achieve their modern perspectives in today's world. talk about how vulnerability management fits into the perspective and of course when an adversary is in the environment we have to know what it means to do proper incident response methodology. We'll take that and pivot into our fourth book which is on data security technologies. And in data security technologies we talk more specifically more than half the book on cryptographic deployment. Cryptography representing uh some very very important uh examples of security- based goals that we need to achieve. But again an example of technologies and capabilities that are well misunderstood. Therefore misapplied leading to once again that bigger fall because of the false sense of security. Now, after that first four books of content, you really do want to know even more specifically how we do what it is to address these issues. And so with that, we then bring it up in the idea of operating system security for books five and six. Once again, taking those concepts of the first four books and articulated to Windows, Unix, Linux, Mac OSbased security and still continue conversation on cloud because throughout the entire week wherever we can compare and contrast on premise and cloud, we specifically do so. Now, all of that gives you a bit of an overview of what is in the 401 class. A very high level overview, but you can see it's a lot of exceptional and exciting style content. But the title of this talk is all around the idea of well whose next gen lab is it anyway. So let me go ahead and talk about one of the biggest changes that has happened recently to the course and it all relates to the hands-on exercises that are a part of the course itself. You see, when it comes down to it, SANS has a promise. And that promise is that what you learn is immediately applicable as soon as you return to work. And everything that you've seen up to this point and you've heard me discuss is all predicated around making sure that we fulfill that promise. Because of course, we keep our course content up to date, relative at all given points in time. That applies across all of Sans's courseware. But we do really want you to be able to go back to work and get hands-on right away. And therefore, the best way to apply hands-on learning is during the week as well by way of our hands-on lab-based exercises. And that's what I really want to talk to you about here in the remaining part of our conversation. So, that I'd like to introduce the ideas that go into our nextgen lab exercises. Uh, you should know that when it comes to 401 today, we've just released our brand new release that has all new hands-on lab exercises. We have 20 exciting exercises to tie together all the important concepts of the week. But you might say, what does it mean to have NextGen Labs? And that's something that we really took ourselves to the drawing board to ask, what would that definition be? And so first and foremost to giving you that idea of that uh perspective nextg what I would say is that labs that are real world and focused on real scenarios that you would experience as an a security uh professional that would be the first example of what goes into a nextgen lab. So to give you a little bit more of that idea throughout the entirety of the course uh you will be a part of a security team. the security team at Alpha Inc. Now, Alpha Incorporated or Alpha Inc. is a fictitious organization based out of Canada and Alpha Incorporated has experienced a series of compromises. There's some interrelatability, but they're also different at the same time. And talking about the compromises, we then constructed hands-on exercises that form four different specific scenarios that you would face in today's very much real uh world. meaning that you're going to spend a week in the life of the time of the Alpha Inc. security operations. To give you some ideas of the scenarios and some of the examples of the names of the labs that go with it, that's where I'd like to take you next. In our first example of a scenario, uh we recognize, of course, that today, once again, only more cloud computing is going to be leveraged than ever before. But no matter where you run your computing, you're going to have the idea of compromise. And so that being said in scenario one we have or the uh Alpha Inc. organization has deployed some functionality in Amazon web services and more specifically they have some web services that are running in AWS and those services have had some issues and we'll leave it that we don't get too much more deeply into that but some suspicious activity has occurred so I won't go too much into this conversation here but to give you some of the ideas of what you would do relative to that scenario we talk about of course in the idea of our first section of content the idea of defensibility across the network. And so we're going to leverage that concept and talk about how you would sniff network communication and you're going to look for commonality that indicate the idea of potential compromise in the environment. And one of the things that's actually very exciting, I just ran a recent uh uh a recent example of this class. I ran it and one of the attendees who was taking said to me just said out loud to the entire class as well said what we just did in Wireshark. We just extracted executables that the adversary might have used malware. Can we really do that? They just did it and they wanted some assurance some it just was amazing. Can we really extract and retrieve indicators of compromise the way that we just did as easily as it was? The answer is yes. And I love getting that kind of feedback because that's exactly the idea of a nextgen lab that you can go and you can go hands-on and you can do the things that you just learned. We also talk about in defensibility of the network that adversaries leave indicators again of their behavior. Not just compromise but behavior command and control a victim reaching outbound to its controller. There are artifacts that would be related to that in network based communication. Volume of communication, length of time across connection, amount of data transferred and we even apply that leveraging flow logs that came from our Amazon web services instance or I should say really the VPC. So the environment itself. Of course we extrapolate other things too. Perhaps there were artifacts that were stolen that might be password protected, right? Maybe we have intrinsic intellectual property that was stolen by the adversary and we're curious to understand more about how passwords came into play there as well. I mean, it's fascinating that in today's day and world, in fact, for more than 30 years, I've been hearing about how passwords are so problematic that they need to go away. And yet, we still discuss all the ideas that that come up related to the problems of passwords still being used in today's environments. And of course, also when it comes down to it, I'll just tell you that when you're doing incident response, if you can come across things that are related to the adversary, like the malware they might have been using, malware analysis will be important to help you answer questions such as how did the adversary achieve their goals, what were their motivations, and so on. Things that are really important during incident response. And so, yes, if you come across malware, you might be interested in doing malware analysis. And we do that here too in class. That's right. We do some aspects of malware analysis even as a part of scenario one. And last but not least talking about network defensibility, we just know the power of intrusion detection systems essentially aggregating on logs, the idea of leveraging a seam and we do all of that there as well. All just related to scenario one. And there are four specific scenarios that you will address throughout the entirety of your time in the 401 class, making you a well-rounded, more capable professional all at the exact same time. And I I don't know if you can tell, but I I can't help but be excited because for me, you know, one of the things I do intrinsically care about is making sure that you can be a more capable professional. Because you see when it comes down to it, working collectively together, right, we can all do much more than any one individual could do on their own. And to me, I really do take that carrying and that benefit of what that would achieve into the idea of our courseware, our lecture amongst all of our instructors and so on. So you say, well, I'm excited, Brian. What are the other scenarios? So as another example of a scenario, we have scenario number two. And in scenario number two is all around the idea of DLP, data loss prevention. Now I'll tell you when it comes to DLP, data loss prevention, it's not just the ideas of of of the perspective where someone makes a mistake. That's like a traditional definition where we're worried about errors and emissions. People attach things to emails they shouldn't. People copy data to a external drive and they lost the drive. They shouldn't have copied it to begin with or the data wasn't encrypted. Those are all really important perspectives. But of course, DLP also relates to ideas of insider threat where you have people who could be working with malicious intent against an organization. And in scenario number two, we have a perspective where a USB thumb drive has been found in a company vehicle. So we have a car pool, a thumb drive was found and turned into the security department. And based upon the information that was on that USB drive, we think there's potentials of either compromise and or insider threat. It could be both. We don't know initially until we start to do some investigation. So, a lot of interesting things around that series of investigations that occur. But one of the things that's I think is really cool is of course we talk about mobile devices during the week, especially in the uh defense and depth section of the course. Because when it comes to defense and depth, if there was any one example of a technology where defense and depth becomes even more paramount, it would be mobile devices. Some of the issues that we see on mobile devices, we haven't seen on traditional desktops for quite some time. So, a lot of moving parts in mobile. Now, as a part of scenario number two, there is the idea potentially once again of an intentional insider, someone who means to do the organization harm. And while we might be able to acquire their mobile device, it may or may not be in a form that's analyzable the way that we would like. Now, this is saying that there could be different protection mechanisms. We may not be able to unlock the device and so on. Those aspects become complex to deal against. But one thing we should know is that when a mobile device is connected to a computer and a backup of that device is made, well, that backup may not be as protected as the device itself. that is the mobile device. So, you're even going to do a hands-on exercise where you work through the idea of mobile backup device recovery, right? Or I said that wrong. Mobile device backup recovery. So, you have the backup of a mobile device. You're actually going to leverage it and uh see if you can find some additional information that relates to your continued ongoing investigation. And of course, you know, all of that just plays naturally into the conversation that our devices, whether they're mobile or not, we risk to have things like whole disk encryption. And in our fourth book of content, we spend more than half a day talking about cryptographic deployment and application. And so we can see here even in scenario 2, we have specific lab exercises all around encryption, decryption capabilities, digital signatures on files, and so on. So really do go hands-on. I think you're starting to see just how much you actually go hands-on in a very much real world way. All right, so how about our third scenario? Now, in our third scenario, of course, we recognize that today fishing is still a very common attack vector and a great way to get into one's organization. Here might have the example of an user end user who's been fished in some way uh specifically and you'll get to that as a part of your investigation. But we also do some great things by doing enduser I should say um uh endpoint security conversations. So how to say that a little bit differently? So part of your investigation you'll start to analyze the ideas of a Windows system and you'll leverage all the power that is Windows PowerShell. PowerShell being that ability to automate when it comes to security in a Windows ecosystem. And you'll even have experience where you leverage a containerized network running Windows server services. And you can see how you can leverage things like PowerShell for speed and scale, let alone getting the intrinsic understanding of Windows process architecture, understanding the file system and its access permissions and how you can leverage those. All just incredibly exciting as you start to tie all of those final pieces together. And last but not least, also really importantly in our fourth scenario, we talk about the idea that in today's world, we still feel pressure to get things done. And all too often we've heard about how important it is to have application security. And it is important, but where there can be a shortcoming is when you have to rush into production. So as a part of that scenario, we have some web based front-end services that were rushed into production. And let's just say that they have some issues in the way that the application was designed. This could even mean that you can understand how an adversary would subvert right connections that are a part of your application services and get access to back-end databases. But that's not all. We also talk again about the importance of logging and we'll talk about how logging can vary from inpersent to persistent style logging especially when you use containerized applications. Oh, and did I say that you actually get to exploit an application as well? It's just exciting the things that we've done. We believe that alto together this is what the definition of a nextgen lab exercise would be. That's why I can't help but be so excited about the things that we've done just to make this course even more real world. It's always been real world, but we're always looking for that next level that when you come to class, everything you learn is so immediately applicable when you return to work. And of course, there's actually one other thing I would just throw into the mix there. Now, for many years, we've had the idea of an electronic workbook that's already built into the concept uh of our virtual machines, but we've taken it to the next level as well when it comes to your hands-on exercises. One of the things that's uh really beneficial about electronic workbook book workbook, pardon me, is that in both of our virtual machines, so you get two. One's running the Windows operating system, the other one is running uh Linux. Uh just natively built in, you have the electronic workbook that you can follow all the hands-on exercises just like in your printed copies of your workbooks. That's where the exercises are. You can follow along there as well, but in a digital way. And the ultimate benefit to that would be that as we discover perhaps any kinds of minor problems with the labs or we want to change it up and and give you a different perspective, we can make changes even in class to that digital copy and you can get that digital copy updated in that electronic workbook in almost a real-time perspective. Of course, it also makes its way into the printed copy in an ongoing way, but you know, getting a printed copy of a book takes longer than just a real world real-time update to the virtual machines that you have happen to have in class. That means that when you take the class itself, no matter how you take it, um those virtual machines have that electronic workbook. And for that current release of the course, you're going to get those updates to the labs as they happen throughout a period of time going forward as well. Uh that doesn't mean of course that as we delve new labs they don't backport into your existing copy but all in all making sure that you get timely updates to the labs that you've been given to us that also qualifies as real world and next generation capability. So with all that being said then I would just say an ultimate conclusion that there's really no substitute to learning by going hands-on and and when it comes down to it at the end of the day it's practice that makes perfect. You see, one of the things I'm always fond of saying when it comes to incident response is that we need time to practice our incident response on a weekly basis. If you're a firefighter, you don't wait for fire and then run into the fire. No, you make fire. You run into that. So, you know what it's like to be under fire before the real thing, which is even much more dangerous, actually manifest in front of you. And so with that, I would just love to uh to uh invite all of you to come and experience the NextG Labs u let alone all the other exciting parts of the course to experience it firsthand yourself. So that of course would just remind you that when it comes to taking our SANS classes, you have different options. We have SANS live, right? So I should say SANS in person, that's where you can come and attend in person. We have SANS live online. Live online can sometimes be hybrid or it's a mixed class between inerson attendees as as well as online or maybe the class is completely online itself. Let let alone that we have our SANS on demand which is where you can have a self-paced perspective over a period of months uh module by module some extra uh questions to to test your uh comprehensive understanding of the material as well. But all in all, that is the idea of our NextG lab exercises. And with that, uh, I'm going to pass it back over to Emily and then we can look at taking some questions as well. So, Emily, thank you, Brian. That was awesome. Um, we do have a few questions. One, right off the bat, I think you get questions like this fairly often when you're um, in classes, is kind of a a course recommendation. So, Harold Stockton um asks, "How do I decide between taking SEC 401 versus SEC 488? If both are recommended, which should I take first?" It's an excellent question. So, Harold, thanks for your question. Now, Harold, when it comes to the idea of uh 401 versus 488. So, 488 is really about the security essentials that you would need if you're going to be deploying extensive cloud capability. But I I don't really feel that that answer really does it best for you. I see one of the things that uh there can be some confusion especially the idea um around some of the naming that the nomclature we use in our in our course uh naming which is why you're asking about I really appreciate that. Um 401 is to make you that well-rounded capable professional to give you an understanding of the enormity of the industry and with that I think the best answer to tell you is that that would be the class I would recommend taking first. Um, we've had people who have taken 488 but had not taken 401 first and and I think maybe their misunderstanding was somehow the 488 was security essentials but only applied to cloud and and it's not what it's meant to be there. Uh, meaning that some people thought there was a divergence. There were two different paths. You want to know cloud, you take 48. You don't want to know cloud, you take 401. So for that again 401 is going to give you the overview of everything that you need to know that will make you even more capable as a cloud-based professional. So 401 first 488 would be thereafter because you can take that foundational knowledge and then apply your cloud security in a much better more understanding way. And while we never have prerequisites really so to speak for our classes uh people that take 48 are definitely much well served by taking 401 first. So hopefully that answers your question Harold. It's uh it takes a little bit of a circle to get to that answer, but hopefully it helps you out. Excellent. So, Harold, I see you there. Wonderful. That was great. Um I don't see any other questions. I I see some myself. Um I don't know if I'm seeing something different here. Should I just go ahead? Well, if you Yeah, you can go ahead. Uh so, I'm seeing a question here. Uh so the question is uh my question is I'm planning to take the exam in the next 3 months. When is the last date to take the exam based on a previous class before the update? Now I'm not really sure I follow exactly the entirety of that question, but um the update we're talking about here, if you had already taken the class where you had that update, you would it would be attached to it. So maybe a better way to say it, your exam is attached to your version of the books. So, if you took it prior to this newest release with these new labs, then these new labs don't apply to your exam. That's probably what you were curious about, I'm assuming. If you have any other questions about that, um, I would reach out to Gak, that's the certification arm. In the emails you receive from them, there'll be a contact address or a place to go for more information. But hopefully that helps answer that question there as well. Kyle asks, "Is there a way to just access the labs without taking the 401 course again?" Uh, sorry Kyle to give you uh the bad news there. No, there's there's not a way to do that. Although I would say that um there is a possibility of you taking it as a former um alumnest of the course itself. Uh and I think maybe just another thing to say is the goal of my course uh and the updates that I make being the author is that every time you need to renew your certification, the course should be very different from the way you took it before. So this is just the idea of, you know, we make these advances going forward. So I hate to give you the bad news there, Kyle. Um I I I'm glad you're excited about the labs. Yeah, it's sort of like, you know, you buy a computer, it could be, you know, a new one comes just down the road. We don't always know um, you know, how that's going to look tomorrow. Yeah. To follow up with that, Kyle, um, there is for alumni of a course. So, if you've taken 401 before, um, there is a 50% discount if you take it again. Um, so you can get access to labs, but not just by themselves for free, unfortunately. Um, but hope that that helps. And Emily, if Kyle was interested in that, what's the best way for Kyle to reach out? Reaching out to customer service is definitely going to be the best way to go. Um, they deal with that often and will be very familiar with it. Did you happen to know of an email address or something we can just verbally mention or even Let me look real quick because I don't want to give false information, but I believe uh where is it? Why am I not finding it? So, there is um like a chat feature on our website as well. So, you can do that. Um, but then in the American regions, um, it's going to be supports.org for email. That was supports.org. Yes. Perfect. Thanks for that, Emily. And I think that covers all of the questions. Um, so thanks Brian for this presentation. This has been really great information. Um to our audience, we greatly appreciate you listening in. Um do you have anything else, Brian? No, that's it. I just want to thank everyone for taking their time uh today to hear about uh these exciting new changes that we brought to the course. And uh with that, I hope to uh see you um in a class uh soon. Oh, we do have a question um from Mabuya and he or she, I'm sorry, is asking if there is a way to contact you directly. Do you uh prefer email or you know X formerly known as Twitter? Well, I think um you feel free to send me a LinkedIn request and then uh we can quickly chat or converse through there. Um tends to probably be the the easiest way. Um so that is probably the best. Perfect. Thank you so much, Brian. Um, for the audience, for a schedule of all upcoming and ondemand SANS webcasts, please v visit sans.org/webcast. And we hope to have you back again for another SANS webcast soon. Take care everyone. Thanks everyone. Have a great rest of your day.