www.sans.org/austin-winter

The Most Trusted Source for Information Security Training, Certif ication, and Research

SAVE $400 Register and pay by October 11th – Use code EarlyBird17

AUSTIN WINTER 2017December 4-9 | Austin, TX

“ SANS training provides targeted, active exposure to very useful, real-world tools and skills in a very short time.” -SCOTT TREST, UNITED FEDERAL CREDIT UNION

Protect Your Business and Advance Your CareerEight hands-on, immersion-style information security courses taught by real-world practitioners

CYBER DEFENSEETHICAL HACKINGDIGITAL FORENSICS

PENETRATION TESTINGMANAGEMENTSIEM

Evening Bonus Sessions Take advantage of these extra evening presentations

and add more value to your training. Learn more on page 9.

KEYNOTE: Automobile Forensics: Infotainment and Telematics Paul A. Henry

Infosec Rock Star: Geek Will Only Get You So Far Ted Demopoulos

Be the Cheatsheet – Know Memory Alissa Torres

Register today for SANS Austin Winter 2017! www.sans.org/austin-winter

@SANSInstitute Join the conversation: #SANSAustin

Austin Winter 2017 DECEMBER 4-9

SANS Instructors SANS instructors are real-world practitioners who specialize in the subjects they teach. All instructors undergo rigorous training and testing in order to teach SANS courses, which guarantees what you learn in class will be up to date and relevant to your job. The SANS Austin Winter 2017 lineup of instructors includes:

Jake Williams Certified Instructor @MalwareJake

Christopher Crowley Principal Instructor @CCrowMontance

Paul A. Henry Senior Instructor @phenrycissp

Tim Garcia Certified Instructor @tbg911

Matthew Toussain Instructor @0sm0s1z

Alissa Torres Certified Instructor @sibertor

MON 12-4

TUE 12-5

WED 12-6

THU 12-7

FRI 12-8

SAT 12-9

SEC401 Security Essentials Bootcamp Style

SEC504 Hacker Tools, Techniques, Exploits, and Incident Handling

SEC555 SIEM with Tactical Analytics

SEC560 Network Penetration Testing and Ethical Hacking

FOR508 Advanced Digital Forensics, Incident Response, and Threat Hunting

MGT514 IT Security Strategic Planning, Policy, and Leadership

MGT517 Managing Security Operations: Detection, Response, and Intelligence

ICS456 Essentials for NERC Critical Infrastructure Protection

Page 2

Page 4

Page 6

Page 7

Page 8

Page 1

Page 3 NEW!

Page 5

Courses at a Glance

Tim Conway Certified Instructor

Ted Demopoulos Principal Instructor @TedDemop

Save $400 when you register and pay by October 11th using code EarlyBird17

For course updates, prerequisites, special notes, or laptop requirements, visit www.sans.org/event/austin-winter-2017/courses 1

SEC401Security Essentials Bootcamp Style

GSEC CertificationSecurity Essentials

www.giac.org/gsec

Six-Day Program Mon, Dec 4 - Sat, Dec 9 9:00am - 7:00pm (Days 1-5) 9:00am - 5:00pm (Day 6) 46 CPEs Laptop Required Instructor: Paul A. Henry

Who Should Attend Security professionals who want to fill the gaps in their understanding of technical information security Managers who want to understand information security beyond simple terminology and concepts Operations personnel who do not have security as their primary job function but need an understanding of security to be e¥ective IT engineers and supervisors who need to know how to build a defensible network against attacks Administrators responsible for building and maintaining systems that are being targeted by attackers Forensic specialists, penetration testers, and auditors who need a solid foundation of security principles to be as e¥ective as possible at their jobs Anyone new to information security with some background in information systems and networking

This course will teach you the most effective steps to prevent attacks and detect adversaries with actionable techniques you can directly apply when you get back to work. You’ll learn tips and tricks from the experts so you can win the battle against the wide range of cyber adversaries that want to harm your environment.STOP and ask yourself the following questions:

Do you fully understand why some organizations get compromised and others do not? If there were compromised systems on your network, are you confident you would be able to find them? Do you know the e�ectiveness of each security device and are you certain they are all configured correctly? Are proper security metrics set up and communicated to your executives to drive security decisions?

If you do not know the answers to these questions, SEC401 will provide the information security training you need in a bootcamp-style format that is reinforced with hands-on labs.SEC401: Security Essentials Bootcamp Style is focused on teaching you the essential information security skills and techniques you need to protect and secure your organization’s critical information assets and business systems. Our course will show you how to prevent your organization’s security problems from being headline news in the Wall Street Journal!Prevention Is Ideal but Detection Is a MustWith the rise in advanced persistent threats, it is almost inevitable that organizations will be targeted. Whether the attacker is successful in penetrating an organization’s network depends on the effectiveness of the organization’s defense. Defending against attacks is an ongoing challenge, with new threats emerging all of the time, including the next generation of threats. Organizations need to understand what really works in cybersecurity. What has worked, and will always work, is taking a risk-based approach to cyber defense. Before your organization spends a dollar of its IT budget or allocates any resources or time to anything in the name of cybersecurity, three questions must be answered:

What is the risk? Is it the highest priority risk? What is the most cost-e�ective way to reduce the risk?

Security is all about making sure you focus on the right areas of defense. In SEC401 you will learn the language and underlying theory of computer and information security. You will gain the essential and effective security knowledge you will need if you are given the responsibility for securing systems and/or organizations. This course meets both of the key promises SANS makes to our students: (1) You will learn up-to-the-minute skills you can put into practice immediately upon returning to work; and (2) You will be taught by the best security instructors in the industry.

www.sans.eduWITH THIS COURSE

www.sans.org/ondemandwww.sans.org/8140

Paul A. Henry SANS Senior InstructorPaul is one of the world’s foremost global information security and computer forensic experts, with more than 20 years’ experience managing security initiatives for Global 2000 enterprises and government organizations worldwide. Paul is a principal at vNet Security, LLC and is keeping a finger on the pulse of network security as the security and forensic analyst at Lumension Security. Throughout his career, Paul has played a key strategic role in launching new network security initiatives to meet our ever-changing threat landscape. He also advises and consults on some of the world’s most challenging and high-risk information

security projects, including the National Banking System in Saudi Arabia, the Reserve Bank of Australia, the U.S. Department of Defense’s Satellite Data Project, and both government and telecommunications projects throughout Southeast Asia. Paul is frequently cited by major publications as an expert on perimeter security, incident response, computer forensics, and general security trends and serves as an expert commentator for network broadcast outlets such as FOX, NBC, CNN, and CNBC. In addition, Paul regularly authors thought leadership articles on technical security issues, and his expertise and insight help shape the editorial direction of key security publications such as the Information Security Management Handbook, to which he is a consistent contributor. Paul is a featured speaker at seminars and conferences worldwide, delivering presentations on diverse topics such as anti-forensics, network access control, cyber crime, DDoS attack risk mitigation, perimeter security, and incident response. @phenrycissp

security projects, including the National Banking System in Saudi Arabia, the Reserve Bank of Australia, the U.S. Department of

“The course content is spot-on, very relevant, and has useful topics which I will put to use

immediately.” -STEFAN WINTER, COSTCO

Register at www.sans.org/austin-winter | 301-654-SANS (7267) 2

“SEC504 fills in the gap of ‘here’s what

adversaries do’ and the evidence they leave.”

-KEVIN HEITHAUS, JPMORGAN CHASE

“Jake did a great job presenting the material. He was very clear, had a

good sense of humor, and was very helpful.”

-AARON MAY, BNSF

SEC504Hacker Tools, Techniques, Exploits, and Incident Handling

GCIH CertificationIncident Handler

www.giac.org/gcih

Six-Day Program Mon, Dec 4 - Sat, Dec 9 9:00am - 7:15pm (Day 1) 9:00am - 5:00pm (Days 2-6) 37 CPEs Laptop Required (If your laptop supports only wireless, please bring a USB Ethernet adapter.) Instructor: Jake Williams

Who Should Attend Incident handlers

Leaders of incident handling teams

System administrators who are on the front lines defending their systems and responding to attacks

Other security personnel who are first responders when systems come under attack

The Internet is full of powerful hacking tools and bad guys using them extensively. If your organization has an Internet connection and one or two disgruntled employees (and whose does not!), your computer systems will get attacked. From the five, ten, or even one hundred daily probes against your Internet infrastructure to the malicious insider slowly creeping through your most vital information assets, attackers are targeting your systems with increasing viciousness and stealth. As defenders, it is essential we understand these hacking tools and techniques.

“As someone who works in information security but has never had to do a full incident report, SEC504 taught me all the proper processes and steps.”

-TODD CHORYAN, MOTOROLA SOLUTIONS

This course enables you to turn the tables on computer attackers by helping you understand their tactics and strategies in detail, giving you hands-on experience in finding vulnerabilities and discovering intrusions, and equipping you with a comprehensive incident handling plan. It addresses the latest cutting-edge, insidious attack vectors, the “oldie-but-goodie” attacks that are still prevalent, and everything in between. Instead of merely teaching a few hack attack tricks, this course provides a time-tested, step-by-step process for responding to computer incidents and a detailed description of how attackers undermine systems so you can prepare for, detect, and respond to those attacks. In addition, the course explores the legal issues associated with responding to computer attacks, including employee monitoring, working with law enforcement, and handling evidence. Finally, students will participate in a hands-on workshop that focuses on scanning, exploiting, and defending systems. This course will enable you to discover the holes in your system before the bad guys do!

The course is particularly well-suited to individuals who lead or are a part of an incident handling team. General security practitioners, system administrators, and security architects will benefit by understanding how to design, build, and operate their systems to prevent, detect, and respond to attacks.

www.sans.eduWITH THIS COURSE

www.sans.org/ondemandwww.sans.org/cyber-guardian www.sans.org/8140

Jake Williams SANS Certified InstructorJake Williams is a principal consultant at Rendition Infosec. He has more than a decade of experience in secure network design, penetration testing, incident response, forensics, and malware reverse engineering. Before founding Rendition Infosec, Jake worked with various cleared government agencies in information security roles. He is well-versed in cloud forensics and previously developed a cloud forensics course for a U.S. government client. Jake regularly responds to cyber intrusions by state-sponsored actors in the financial, defense, aerospace, and healthcare sectors using cutting-edge forensics and incident

response techniques. He often develops custom tools to deal with specific incidents and malware-reversing challenges. Additionally, Jake performs exploit development and has privately disclosed a multitude of zero-day exploits to vendors and clients. He found vulnerabilities in one of the state counterparts to healthcare.gov and recently exploited antivirus software to perform privilege escalation. Jake developed Dropsmack, a pentesting tool (okay, malware) that performs command and control and data exfiltration over cloud file sharing services. Jake also developed an anti-forensics tool for memory forensics, Attention Deficit Disorder (ADD). This tool demonstrated weaknesses in memory forensics techniques. @MalwareJake

response techniques. He often develops custom tools to deal with specific incidents and malware-reversing challenges. Additionally,

For course updates, prerequisites, special notes, or laptop requirements, visit www.sans.org/event/austin-winter-2017/courses 3

“Today’s labs pushed me out of my comfort zone. Two thumbs up on the content and delivery!”

-KEVIN, APPALACHIAN STATE UNIVERSITY

“There is no other training like this!” -ERIC KAHKLEN, EBATES

SEC555SIEM with Tactical Analytics NEW!

Six-Day Program Mon, Dec 4 - Sat, Dec 9 9:00am - 7:00pm (Days 1-5) 9:00am - 5:00pm (Day 6) 46 CPEs Laptop Required Instructor: Tim Garcia

Who Should Attend Security analysts Security architects Senior security engineers Technical security managers SOC analysts, engineers, and managers CND analysts Security monitoring specialists System administrators Cyber threat investigators Individuals working to implement Continuous Security Monitoring Individuals working in a hunt team capacity

Many organizations have logging capabilities but lack the people and processes to analyze it. In addition, logging systems collect vast amounts of data from a variety of data sources that require an understanding of the sources for proper analysis. This class is designed to provide individuals with training, methods, and processes for enhancing existing logging solutions. This class will also help you understand the when, what, and why behind the logs. This is a lab-heavy course that utilizes SOF-ELK, a free, SANS-sponsored Security Information and Event Management (SIEM) solution, to provide hands-on experience and the mindset for large-scale data analysis.

Today, security operations do not suffer from a “big data” problem but rather a “data analysis” problem. Let’s face it, there are multiple ways to store and process large amounts of data without any real emphasis on gaining insight into the information collected. Added to that is the daunting idea of an infinite list of systems from which one could collect logs. It is easy to get lost in the perils of data saturation. This course moves away from the typical churn-and-burn log systems and moves instead towards achieving actionable intelligence and developing a tactical Security Operations Center (SOC).

This course is designed to demystify the SIEM architecture and process by navigating the student through the steps of tailoring and deploying a SIEM to full SOC integration. The material will cover many bases in the “appropriate” use of a SIEM platform to enrich readily available log data in enterprise environments and extract actionable intelligence. Once the information is collected, the student will be shown how to present the gathered input into usable formats to aid in eventual correlation. Students will then iterate through the log data and events to analyze key components that will allow them to learn how rich this information is, how to correlate the data, start investigating based on the aggregate data, and finally, how to go hunting with this newly gained knowledge. They will also learn how to deploy internal post-exploitation tripwires and breach canaries to nimbly detect sophisticated intrusions. Throughout the course, the text and labs will not only show how to manually perform these actions, but also how to automate many of the processes mentioned so students can employ these tasks the day they return to the office.

The underlying theme is to actively apply Continuous Monitoring and analysis techniques by utilizing modern cyber threat attacks. Labs will involve replaying captured attack data to provide real-world results and visualizations.

Tim Garcia SANS Certified InstructorTimothy Garcia is a seasoned security professional who loves the challenging and continuously changing landscape of defense. Tim currently works as an information security engineer for a Fortune 100 financial company, where he helps project teams ensure the security of IT operations and compliance with policies and regulations. He also leads the team that is tasked with firewall review, SIEM management and privileged access monitoring and policy compliance. Tim has worked as a systems engineer and database administrator and has expertise in systems engineering, project management and information security

principles and procedures/compliance. Tim previously worked for Intel and served in the U.S. Navy. At SANS, Tim also works with the OnDemand team as a subject-matter expert, serves as a mentor for the Vet Success program, and provides consulting and content review for the Securing The Human project. Tim is a contributor to the Arizona Cyber Warfare Range and works with the local security community giving monthly talks on information security tools and techniques. Tim holds the CISSP, GSEC, GSLC, GISF, GMON, GAWN, GCCC, and GCED as well as the NSA-IAM certifications. He has extensive knowledge of security procedures and legislation such as Sarbanes-Oxley, GLBA, CobiT, COSO, and ISO 1779. @tbg911

principles and procedures/compliance. Tim previously worked for Intel and served in the U.S. Navy. At SANS, Tim also works with the

Register at www.sans.org/austin-winter | 301-654-SANS (7267) 4

SEC560Network Penetration Testing and Ethical Hacking

GPEN CertificationPenetration Tester

www.giac.org/gpen

Six-Day Program Mon, Dec 4 - Sat, Dec 9 9:00am - 7:15pm (Day 1) 9:00am - 5:00pm (Days 2-6) 37 CPEs Laptop Required Instructor: Matthew Toussain

Who Should Attend Security personnel whose jobs involve assessing networks and systems to find and remediate vulnerabilities

Penetration testers

Ethical hackers

Defenders who want to better understand o¥ensive methodologies, tools, and techniques

Auditors who need to build deeper technical skills

Red and blue team members

Forensics specialists who want to better understand o¥ensive tactics

As a cybersecurity professional, you have a unique responsibility to find and understand your organization’s vulnerabilities, and to work diligently to mitigate them before the bad guys pounce. Are you ready? SANS SEC560, our flagship course for penetration testing, fully arms you to address this task head-on.

SEC560 is the must-have course for every well-rounded security professional.With comprehensive coverage of tools, techniques, and methodologies for network penetration testing, SEC560 truly prepares you to conduct high-value penetration testing projects step-by-step and end-to-end. Every organization needs skilled information security personnel who can find vulnerabilities and mitigate their effects, and this entire course is specially designed to get you ready for that role. The course starts with proper planning, scoping and recon, then dives deep into scanning, target exploitation, password attacks, and web app manipulation, with more than 30 detailed hands-on labs throughout. The course is chock-full of practical, real-world tips from some of the world’s best penetration testers to help you do your job safely, efficiently…and masterfully.

Learn the best ways to test your own systems before the bad guys attack.SEC560 is designed to get you ready to conduct a full-scale, high-value penetration test – and on the last day of the course you’ll do just that. After building your skills in comprehensive and challenging labs over five days, the course culminates with a final full-day, real-world penetration test scenario. You’ll conduct an end-to-end pen test, applying knowledge, tools, and principles from throughout the course as you discover and exploit vulnerabilities in a realistic sample target organization, demonstrating the knowledge you’ve mastered in this course.

You will bring comprehensive penetration testing and ethical hacking know-how back to your organization.You will learn how to perform detailed reconnaissance, studying a target’s infrastructure by mining blogs, search engines, social networking sites, and other Internet and intranet infrastructures. Our hands-on labs will equip you to scan target networks using best-of-breed tools. We won’t just cover run-of-the-mill options and configurations, we’ll also go over the lesser known but super-useful capabilities of the best pen test toolsets available today. After scanning, you’ll learn dozens of methods for exploiting target systems to gain access and measure real business risk. You’ll dive deep into post-exploitation, password attacks, and web apps, pivoting through the target environment to model the attacks of real-world bad guys to emphasize the importance of defense in-depth.

www.sans.eduWITH THIS COURSE

www.sans.org/ondemandwww.sans.org/cyber-guardian

“I like that the labs in SEC560 provided clear, step-by-step guidance. The instructor’s level of

knowledge and ability to relay

information is fantastic.” - BRYAN BARNHART,

INFILTRATION LABS

Matthew Toussain SANS InstructorMatthew Toussain is an active-duty U.S. Air Force o²cer and the founder of Spectrum Information Security, a firm focused on maximizing the value proposition of information security programs. As an avid information security researcher, Matthew regularly hunts for vulnerabilities in computer systems and releases tools to demonstrate the e¥ectiveness of attacks and countermeasures. He has been a guest speaker at many conference venues, including DEFCON, the largest security conference in the world. After graduating from the U.S. Air Force Academy, where he architected and instructed the summer cyber

course that now trains over 400 cadets per year, Matthew served as the Senior Cyber Tactics Development Lead for the Air Force. He directed the teams responsible for developing innovative tactics, techniques, and procedures for o¥ensive operations as well as for cyber protection teams (CPTs). Later, as a member of the 688th Cyber Warfare Wing, he managed the Air Force’s transition of all 18 CPTs to fully operational capability. As a founding member of Spectrum, Matthew regularly performs a wide variety of information security services. He earned his master’s degree in information security engineering as one of the first graduates of the SANS Technology Institute and supports many national and international cyber competitions including the CCDC, SANS NetWars, and the National Security Agency’s Cyber Defense Exercise as a red team member and instructor. @0sm0s1z

course that now trains over 400 cadets per year, Matthew served as the Senior Cyber Tactics Development Lead for the Air Force. He

For course updates, prerequisites, special notes, or laptop requirements, visit www.sans.org/event/austin-winter-2017/courses 5

www.sans.edu

“Many people lack good forensics skills; being able to figure out what happened is sometimes more

important than fixing it.” -JUSTIN DAVIS,

ST. JUDE MEDICAL

“Come prepared to learn a lot!”

-TODD BLACK LEE,

GOLDEN 1 CREDIT UNION

FOR508Advanced Digital Forensics, Incident Response, and Threat Hunting

GCFA CertificationForensic Analyst

www.giac.org/gcfa

Six-Day Program Mon, Dec 4 - Sat, Dec 9 9:00am - 5:00pm 36 CPEs Laptop Required Instructor: Alissa Torres

Who Should Attend Incident response team members

Threat hunters

Experienced digital forensic analysts

Information security professionals

Federal agents and law enforcement

Red team members, penetration testers, and exploit developers

SANS FOR500 (formerly FOR408) and SEC504 graduates

FOR508: Advanced Digital Forensics, Incident Response, and Threat Hunting will help you to:

Detect how and when a breach occurred Identify compromised and a�ected systems Determine what attackers took or changed Contain and remediate incidents Develop key sources of threat intelligence Hunt down additional breaches using knowledge of the adversary

DAY 0: A 3-letter government agency contacts you to say an advanced threat group is targeting organizations like yours, and that your organization is likely a target. They won’t tell how they know, but they suspect that there are already several breached systems within your enterprise. An advanced persistent threat, aka an APT, is likely involved. This is the most sophisticated threat that you are likely to face in your efforts to defend your systems and data, and these adversaries may have been actively rummaging through your network undetected for months or even years.

This is a hypothetical situation, but the chances are very high that hidden threats already exist inside your organization’s networks. Organizations can’t afford to believe that their security measures are perfect and impenetrable, no matter how thorough their security precautions might be. Prevention systems alone are insufficient to counter-focused, human adversaries who know how to get around most security and monitoring tools.

This in-depth incident response and threat hunting course provides responders and threat hunting teams with advanced skills to hunt down, identify, counter, and recover from a wide range of threats within enterprise networks, including APT nation-state adversaries, organized crime syndicates, and hactivism. Constantly updated, FOR508: Advanced Digital Forensics, Incident Response, and Threat Hunting addresses today’s incidents by providing hands-on incident response and threat hunting tactics and techniques that elite responders and hunters are successfully using to detect, counter, and respond to real-world breach cases.

G AT H E R YO U R I N C I D E N T R E S P O N S E T E A M – I T ’ S T I M E T O G O H U N T I N G !

www.sans.org/8140WITH THIS COURSE

www.sans.org/ondemandwww.sans.org/cyber-guardian

Alissa Torres SANS Certified InstructorAlissa has more than 15 years of experience in computer and network security that spans government, academic, and corporate environments. She has the deep experience and technical savvy to take on even the most di²cult computer forensics challenges that come her way. Her current role as an Incident Response Advisor at Cargill provides daily challenges “in the trenches” and demands constant technical growth. Alissa is also the founder of her own firm, Sibertor Forensics, and has taught internationally in more than 10 countries. Alissa has a B.S from the University of Virginia and a M.S. in information

technology from the University of Maryland. She is a GIAC Certified Forensic Analyst (GCFA), and holds the GCFE, GCIH, GSEC, CISSP, and EnCE certifications. Alissa has served as a member of the GIAC Advisory Board since 2013 and was recognized by SC Magazine as one of its “2016 Women to Watch.” @sibertor

technology from the University of Maryland. She is a GIAC Certified Forensic Analyst (GCFA), and holds the GCFE, GCIH, GSEC, CISSP,

6 Register at www.sans.org/austin-winter | 301-654-SANS (7267)

GSTRT CertificationStrategic Planning, Policy, and Leadership

www.giac.org/gstrt

MGT514IT Security Strategic Planning, Policy, and Leadership

Five-Day Program Mon, Dec 4 - Fri, Dec 8 9:00am - 5:00pm 30 CPEs Laptop NOT Needed Instructor: Ted Demopoulos

Who Should Attend Chief Information Security O²cers (CISOs)

Information security o²cers

Security directors

Security managers

Aspiring security leaders

Other security personnel who have team lead or management responsibilities

As security professionals, we have seen the landscape change. Cybersecurity is now more vital and relevant to the growth of organizations than ever before. As a result, information security teams have more visibility, more budget, and more opportunity. However, with this increased responsibility comes more scrutiny.

This course teaches security professionals how to handle three critical tasks:

• Develop Strategic Plans Strategic planning is hard for people in IT and IT security, because we spend so much time responding and reacting. We almost never get to practice until we get promoted to a senior position, and then we are not equipped with the skills we need to run with the pack. Learn how to develop strategic plans that resonate with other IT and business leaders.

• Create Effective Information Security Policy Policy is a manager’s opportunity to express expectations for the workforce, set the boundaries of acceptable behavior, and empower people to do what they ought to be doing. It is easy to get wrong. Have you ever seen a policy and your response was, “No way, I am not going to do that!”? Policy must be aligned with an organization’s culture. We will break down the steps to policy development so that you have the ability to develop and assess policy to successfully guide your organization.

• Develop Management and Leadership Skills Leadership is a capability that must be learned, exercised, and developed to better ensure organizational success. Strong leadership is brought about primarily through selfless devotion to the organization and staff, tireless effort in setting the example, and the vision to see and effectively use available resources toward the end goal. Effective leadership entails persuading team members to accomplish their objectives while removing obstacles and maintaining the well-being of the team in support of the organization’s mission. Learn to utilize management tools and frameworks to better lead, inspire, and motivate your teams.

“I moved into management a few years ago and am

currently working on a new security strategy/roadmap and this class just condensed the past two months of my life

into a one-week course and I still learned a lot!”

-TRAVIS EVANS, SIRIUSXM

www.sans.edu

WITH THIS COURSE www.sans.org/ondemand

Ted Demopoulos SANS Principal InstructorTed Demopoulos’ first significant exposure to computers was in 1977 when he had unlimited access to his high school’s PDP-11 and hacked at it incessantly. He consequently almost flunked out but learned he liked playing with computers a lot. His business pursuits began in college and have been continuous ever since. His background includes over 25 years of experience in information security and business, including 20+ years as an independent consultant. Ted helped start a successful information security company, was the CTO at a “textbook failure” of a software startup, and has advised several other businesses. Ted is a

frequent speaker at conferences and other events and is quoted often by the press. He also has written two books on social media, has an ongoing software concern in Austin, Texas in the virtualization space, and is the recipient of a Department of Defense Award of Excellence. In his spare time, he is also a food and wine geek, goes flyfishing, and enjoys playing with his children. @TedDemop

frequent speaker at conferences and other events and is quoted often by the press. He also has written two books on social media,

MGT517Managing Security Operations: Detection, Response, and Intelligence

Five-Day Program Mon, Dec 4 - Fri, Dec 8 9:00am - 5:00pm 30 CPEs Laptop Required Instructor: Christopher Crowley

Who Should Attend Information security managers

Security Operations Center managers, analysts, and engineers

Information security architects

IT managers

Operations managers

Risk management professionals

IT/system administration/network administration professionals

IT auditors

Business continuity and disaster recovery sta¥

This course covers the design, operation, and ongoing growth of all facets of the security operations capabilities in an organization. An effective Security Operations Center (SOC) has many moving parts and must be designed to have the ability to adjust and work within the context and constraints of an organization. To run a successful SOC, managers need to provide tactical and strategic direction and inform staff of the changing threat environment, as well as provide guidance and training for employees. This course covers design, deployment, and operation of the security program to empower leadership through technical excellence.

The course covers the functional areas of communications, network security monitoring, threat intelligence, incident response, forensics, and self-assessment. We discuss establishing security operations governance for:

Business alignment and ongoing adjustment of capabilities and objectives

Designing the SOC and the associated objectives of functional areas

Software and hardware technology required for performance of functions

Knowledge, skills, and abilities of sta� as well as sta� hiring and training

Execution of ongoing operations

You will walk out of this course armed with a roadmap to design and operate an effective SOC tailored to the needs of your organization.

Course Author Statement“The inclusion of all functional areas of security operations is intended to develop a standardized program for an organization and express all necessary capabilities. Admittedly ambitious, the intention of the class is to provide a unified picture of coordination among teams with di¥erent skillsets to help the business prevent loss due to poor security practices. I have encountered detrimental compartmentalization in most organizations. There is a tendency for specialists to look only at their piece of the problem, without understanding the larger scope of information security within an organization. Organizations are likely to perceive a Security Operations Center (SOC) as a tool, and not as the unification of people, processes, and technologies.

“This course provides a comprehensive picture of a SOC. Discussion on the technology needed to run a SOC is handled in a vendor-agnostic way. In addition, technology is addressed in a way that attempts to address both minimal budgets as well as budgets with global scope. The course outlines sta¥ roles, addresses sta¥ training through internal training and information-sharing, and examines the interaction between functional areas and data exchange.

“After attending this class, the participant will have a roadmap for what needs to be done in an organization seeking to implement security operations.”

-Christopher Crowley

Christopher Crowley SANS Principal InstructorChristopher has 15 years of industry experience managing and securing networks. He currently works as an independent consultant in the Washington, D.C. area. His work experience includes penetration testing, computer network defense, incident response, and forensic analysis. He is the course author for SANS MGT535: Incident Response Team Management and holds the GSEC, GCIA, GCIH (gold), GCFA, GPEN, GREM, GMOB, and CISSP certifications. His teaching experience includes SEC401, SEC503, SEC504, SEC560, SEC575, SEC580, FOR585, and MGT535; Apache web server administration and configuration; and shell

programming. He was awarded the SANS 2009 Local Mentor of the Year Award, which is given to SANS Mentors who excel in leading SANS Mentor Training classes in their local communities. @CCrowMontanceprogramming. He was awarded the SANS 2009 Local Mentor of the Year Award, which is given to SANS Mentors who excel in leading

“Wow! Chris is wicked smart, knows this space,

and is a real expert. It would be very hard to

do better or have a more solid presentation.”

-MICHAEL CARTER, LDS CHURCH

For course updates, prerequisites, special notes, or laptop requirements, visit www.sans.org/event/austin-winter-2017/courses 7

8 Register at www.sans.org/austin-winter | 301-654-SANS (7267)

ICS456Essentials for NERC Critical Infrastructure Protection

Five-Day Program Mon, Dec 4 - Fri, Dec 8 9:00am - 5:00pm 30 CPEs Laptop Required Instructor: Tim Conway

Who Should Attend IT and OT (ICS) cybersecurity professionals Field support personnel Security operations personnel Incident response personnel Compliance sta¥ Team leaders Governance o²cials Vendors/Integrators Auditors

This course empowers students with knowledge of the “what” and the “how” of the version 5/6 standards. The course addresses the role of the North American Electric Reliability Corporation (NERC), the Federal Energy Regulatory Commission (FERC), and the Regional entities. It provides multiple approaches for identifying and categorizing BES Cyber Systems and helps asset owners determine the requirements applicable to specific implementations. The course also covers implementation strategies for the version 5/6 requirements with a balanced practitioner approach to both cybersecurity benefits, as well as regulatory compliance. Our 25 hands-on labs range from securing workstations to digital forensics and lock picking.

Course Day Descriptions456.1 HANDS ON: Asset Identification and GovernanceA transition is under way from NERC Critical Infrastructure Protection (CIP) programs that are well defined and understood to a new CIP paradigm that expands its scope into additional environments and adds significantly more complexity. On day 1 students will develop an understanding of the electricity sector regulatory structure and history as well as an appreciation for how the CIP Standards fit into the overall framework of the reliability standards. Key NERC terms and definitions related to NERC CIP are reviewed using realistic concepts and examples that prepare students to better understand their meaning. We will explore multiple approaches to BES Cyber Asset identification and learn the critical role of strong management and governance controls. The day will examine a series of architectures, strategies, and di²cult compliance questions in a way that highlights the reliability and cybersecurity strengths of particular approaches. Unique labs will include a scenario-based competition that helps bring the concepts to life and highlights the important role we play in defending the grid.

456.2 HANDS ON: Access Control and MonitoringStrong physical and cyber access controls are at the heart of any good cybersecurity program. During day 2 we move beyond the “what” of CIP compliance to understanding the “why” and the “how.” Firewalls, proxies, gateways, IDS and more – learn where and when they help and learn practical implementations to consider and designs to avoid. Physical protections include more than fences and you’ll learn about the strengths and weaknesses of common physical controls and monitoring schemes. Labs will reinforce what is learned throughout the day and will introduce architecture review and analysis, firewall rules, IDS rules, compliance evidence demonstration, and physical security control reviews.

456.3 HANDS ON: System ManagementCIP-007 has consistently been one of the most violated Standards going back to CIP version 1. With the CIP Standards moving to a systematic approach with varying requirement applicability based on system impact rating, the industry now has new ways to design and architect system management approaches. Throughout day 3, students will dive into CIP-007. We’ll examine various Systems Security Management requirements with a focus on implementation examples and the associated compliance challenges. This day will also cover the CIP-010 requirements for configuration change management and vulnerability assessments that ensure systems are in a known state and under e¥ective change control. We’ll move through a series of labs that reinforce the topics covered from the perspective of the CIP practitioner responsible for implementation and testing.

456.4 HANDS ON: Information Protection and ResponseEducation is key to every organization’s success with NERC CIP and the students in ICS 456 will be knowledgeable advocates for CIP when they return to their place of work. Regardless of their role, all students can be a valued resource to their organization’s CIP-004 training program, the CIP-011 information protection program. Students will be ready with resources for building and running strong awareness programs that reinforce the need for information protection and cybersecurity training. On day 4 we’ll examine CIP-008 and CIP-009 covering identification, classification, and communication of incidents as well as the various roles and responsibilities needed in an incident response or a disaster recovery event. Labs will introduce tools for ensuring file integrity and sanitization of files to be distributed, how to best utilize and communicate with the E-ISAC, and how to preserve incident data for future analysis.

456.5 HANDS ON: CIP ProcessOn the final day students will learn the key components for running an e¥ective CIP Compliance program. We will review the NERC processes for standards development, violation penalty determination, Requests For Interpretation, and recent changes stemming from the Reliability Assurance Initiative. Additionally we’ll identify recurring and audit-related processes that keep a CIP compliance program on track: culture of compliance, annual assessments, gap analysis, TFEs, and self-reporting. We’ll also look at the challenge of preparing for NERC audits and provide tips to be prepared to demonstrate the awesome work your team is doing. Finally, we’ll look at some real-life CIP violations and discuss what happened and the lessons we can take away. At the end of day 5 students will have a strong call to action to participate in the ongoing development of CIP within their organization and in the industry overall as well as a sense that CIP is do-able! Labs will cover DOE C2M2, audit tools, and an audit-focused take on the “blue team – red team” exercise.

Tim Conway SANS Certified InstructorTim is the technical director of ICS and SCADA programs at SANS. He is responsible for developing, reviewing, and implementing technical components of the SANS ICS and SCADA product o¥erings. He previously served as the director of CIP Compliance and Operations Technology at Northern Indiana Public Service Company (NIPSCO), where he was responsible for Operations Technology, NERC CIP Compliance, and the NERC training environments for the operations departments within NIPSCO Electric. Tim was also an EMS Computer Systems Engineer at NIPSCO for eight years, with responsibility over the control system

servers and the supporting network infrastructure. He was the chair of the RFC CIPC, and is the current chair of the NERC CIP Interpretation Drafting Team, a member of the NESCO advisory board, chair of the NERC CIPC GridEx Working Group, and chair of the NBISE Smart Grid Cyber Security panel.

servers and the supporting network infrastructure. He was the chair of the RFC CIPC, and is the current chair of the NERC CIP

GCIP CertificationComing Soon!

Register at www.sans.org/austin-winter | 301-654-SANS (7267) 9

Bonus SessionsEnrich your SANS training experience! Evening talks by our instructors and selected subject-matter experts help you broaden your knowledge, hear from the voices that matter in computer security, and get the most for your training dollar.

KEYNOTE: Automobile Forensics: Infotainment and TelematicsPaul A. HenryThis presentation walks the attendee through creating a logical/physical image of an automobile infotainment and telematics system using the JTAG process and the subsequent forensic analysis of the data within the image. While such systems do not include evidence from the automobile crash sensors/airbag control module, the following evidence is typically available in an automobile’s infotainment and telematics system(s):

• Vehicle system information• Installed application data• Connected devices• Navigation data• Device information• Events

Infosec Rock Star: Geek Will Only Get You So FarTed DemopoulosThis presentation is based on the recently published book of the same title. Some of us are so effective, and well known, that the term “Rock Star” is entirely accurate. What kind of skills do Rock Stars have and wannabe Rock Stars need to develop? Although we personally may never be swamped by groupies, we can learn the skills to be more effective, well respected, and well paid. Obviously it’s not just about technology; in fact most of us are very good at the technology part. Although the myth of the Geek with zero social skills is just that, a myth, the fact is that increasing our skills more on social and business side will make most of us more effective at what we do than learning how to read hex better while standing on our heads, becoming “One with Metasploit,” or understanding the latest hot technologies. Presentation topics, with input from real Rock Stars of Infosec, include:

• The five levels to Rock Star• Positioning – why “they” don’t like us or security and what we can do about it• The Science of Influence – ruthless social engineering or e®ective professional skills?• Getting Things Done – brutal time management and the art of saying “no” without upsetting too many people• How to let people know you rock – you might be the best in the world, but if no one knows it you’re not going to

do much good

Be the Cheatsheet – Know MemoryAlissa TorresThere is an arms race between analysts and attackers. Today, modern malware employs sophisticated obfuscation techniques such as code injection and anti-analysis mechanisms to evade detection and throw the investigator off its trail. Examiners must have an understanding of memory management and OS internals to identify anomalies and discern the attackers’ intentions. It’s time to re-up your skills at hunting evil in memory. Attend this session, learn the newest memory forensics techniques and tear into our memory images to find your own evil.

10

11

12

Future Training Events

Future Community SANS Events

Baltimore Fall . . . . . . . . . . . . . . Baltimore, MD . . . . . . . . Sep 25-30Rocky Mountain Fall . . . . . . . . . Denver, CO . . . . . . . . . . .Sep 25-30Phoenix-Mesa . . . . . . . . . . . . . . Mesa, AZ . . . . . . . . . . . . . . Oct 9-14Tysons Corner Fall . . . . . . . . . . McLean, VA . . . . . . . . . . . Oct 14-21San Diego . . . . . . . . . . . . . . . . . San Diego, CA . . . . . . Oct 30 - Nov 4Seattle . . . . . . . . . . . . . . . . . . . . Seattle, WA . . . . . . . . Oct 30 - Nov 4Miami . . . . . . . . . . . . . . . . . . . . Miami, FL . . . . . . . . . . . . . Nov 6-11San Francisco Winter . . . . . . . . San Francisco, CA . . .Nov 27 - Dec 2Austin Winter . . . . . . . . . . . . . . Austin, TX . . . . . . . . . . . . . .Dec 4-9

Cyber Defense Washington, D.C. Dec 12-19 Initiative

Security East New Orleans, LA Jan 8-13, 2018

Northern VA Winter – Reston . . Reston, VA . . . . . . . . . . . . Jan 15-20Las Vegas . . . . . . . . . . . . . . . . . Las Vegas, NV . . . . . .Jan 28 - Feb 2Miami . . . . . . . . . . . . . . . . . . . . Miami, FL . . . . . . . . .Jan 29 - Feb 3Scottsdale . . . . . . . . . . . . . . . . . Scottsdale, AZ . . . . . . . . . . Feb 5-10Anaheim . . . . . . . . . . . . . . . . . . Anaheim, CA . . . . . . . . . . Feb 12-17Dallas . . . . . . . . . . . . . . . . . . . . Dallas, TX . . . . . . . . . . . . Feb 19-24New York City Winter . . . . . . . . New York, NY . . . . . . Feb 26 - Mar 3San Francisco Spring . . . . . . . . San Francisco, CA . . . . . . Mar 12-17Pen Test Austin . . . . . . . . . . . . . Austin, TX . . . . . . . . . . . .Mar 19-24Northern VA Spring – Tysons . . McLean, VA . . . . . . . . . . . Mar 17-24Boston Spring . . . . . . . . . . . . . . . Boston, MA . . . . . . . . . . Mar 25-30

SANS 2018 Orlando, FL Apr 3-10

Future Summit EventsData Breach . . . . . . . . . . . . . . . Chicago, IL . . . . . . . . Sep 25 - Oct 2Secure DevOps . . . . . . . . . . . . . Denver, CO . . . . . . . . . . . .Oct 10-17SIEM & Tactical Analytics . . . . . Scottsdale, AZ . . . . . Nov 28 - Dec 5Cyber Threat Intelligence . . . . . Bethesda, MD . . . . . .Jan 29 - Feb 5Cloud Security . . . . . . . . . . . . . . San Diego, CA . . . . . . . . . Feb 19-26ICS Security . . . . . . . . . . . . . . . . Orlando, FL . . . . . . . . . . .Mar 19-26

Local, single-course events are also offered throughout the year via SANS Community. Visit www.sans.org/community for up-to-date Community course information.

Top 5 reasons to stay at the Hilton Austin1 All SANS attendees receive complimentary

high-speed Internet when booking in the SANS block.

2 No need to factor in daily cab fees and the time associated with travel to alternate hotels.

3 By staying at the Hilton Austin, you gain the opportunity to further network with your industry peers and remain in the center of the activity surrounding the training event.

4 SANS schedules morning and evening events at the Hilton Austin that you won’t want to miss!

5 Everything is in one convenient location!

The Hilton Austin is situated adjacent to the Convention Center in downtown Austin, TX and is a quick walk from exclusive shopping, amazing restaurants, and fun live music venues on 6th Street and the surrounding area. Guests of the renovated hotel also enjoy fantastic views of the Capitol of Texas and Lady Bird Lake from 31 stories up. Hotel dining, a full-service spa, VIP perks – we’ve got you covered for a great stay in Austin.

Special Hotel Rates AvailableA special discounted rate of $194.00 S/D will be honored based on space available. Government per diem rooms are available with proper ID. These rates include high-speed Internet in your room and are only available through November 10, 2017. To make reservations, please call 512-482-8000.

Hilton Austin 500 East 4th Street Austin, TX 78701 Phone: 512-482-8000 www.sans.org/event/austin-winter-2017/location

Hotel Information

Registration InformationRegister online at www.sans.org/austin-winterwww.sans.org/austin-winter

We recommend you register early We recommend you register early to ensure you get your first choice of courses.to ensure you get your first choice of courses.Select your course and indicate whether you plan to test for GIAC certification. If the course Select your course and indicate whether you plan to test for GIAC certification. If the course is still open, the secure, online registration server will accept your registration. Sold-out courses will be removed from the online registration. Everyone with Internet access must complete the online registration form. We do not take registrations by phone.

Cancellation & Access PolicyIf an attendee must cancel, a substitute may attend instead. Substitution requests can be made at any time prior to the event start date. Processing fees will apply. All substitution requests must be submitted by email to registration@sans.org. If an attendee must cancel and no substitute is available, a refund can be issued for any received payments by November 15, 2017. A credit memo can be requested up to the event start date. All cancellation requests must be submitted in writing by mail or fax and received by the stated deadlines. Payments will be refunded by the method that they were submitted. Processing fees will apply.

SANS Voucher ProgramExpand your training budget! Extend your fiscal year. The SANS Voucher Program provides flexibility and may earn you bonus funds for training.

www.sans.org/vouchers 13

Pay Early and Save*

DATE DISCOUNT DATE DISCOUNT

Pay & enter code by 10-11-17 $400.00 11-1-17 $200.00

*Some restrictions apply. Early bird discounts do not apply to Hosted courses.

Use code EarlyBird17 when registering early

5705 Salem Run Blvd.Suite 105Fredericksburg, VA 22407

B R O C H U R E C O D E

Save $400 when you pay for any 4-, 5-, or 6-day course and enter the code “EarlyBird17” before January 4th.

www.sans.org/dallas

To be removed from future mailings, please contact unsubscribe@sans.org or (301) 654-SANS (7267). Please include name and complete address. NALT-BRO-DALLAS17

Open a SANS Account todayto enjoy these FREE resources:

W E B C A S T SAsk The Expert Webcasts – SANS experts bring current and timely information on relevant topics in IT Security.

Analyst Webcasts – A follow-on to the SANS Analyst Program, Analyst Webcasts provide key information from our whitepapers and surveys.

WhatWorks Webcasts – The SANS WhatWorks webcasts bring powerful customer experiences showing how end users resolved specific IT Security issues.

Tool Talks – Tool Talks are designed to give you a solid understanding of a problem, and to show how a vendor’s commercial tool can be used to solve or mitigate that problem.

N E W S L E T T E R SNewsBites – Twice-weekly high-level executive summary of the most important news relevant to cybersecurity professionals

OUCH! – The world’s leading monthly free security-awareness newsletter designed for the common computer user

@RISK: The Consensus Security Alert – A reliable weekly summary of (1) newly discovered attack vectors, (2) vulnerabilities with active new exploits, (3) how recent attacks worked, and (4) other valuable data

OT H E R F R E E R E S O U R C E S InfoSec Reading Room

Top 25 Software Errors

20 Critical Controls

Security Policies

Intrusion Detection FAQs

Tip of the Day

Security Posters

Thought Leaders

20 Coolest Careers

Security Glossary

SCORE (Security Consensus Operational Readiness Evaluation)

www.sans.org/account