WIXLIB

SEC511:Continuous Monitoring andSecurity OperationsSix-Day ProgramMon, Apr 4 - Sat, Apr 99:00am - 7:00pm (Days 1-5)9:00am - 5:00pm (Day 6)Laptop Required46 CPEsLaptop RequiredInstructor: Eric ConradGIAC Cert: GMONMaster’s ProgramOnDemand Bundle“ SEC511 delivers thepractical methodologiesand granular informationthat can help bridge thecommunications gapsthat may exist betweenanalysts, engineers, andoperations.”-Patrick Nolan,Intel Security Foundstone“ SEC511 is a practicalapproach to continuesecurity monitoring usingfree and open-sourcetools either alone or inconjunction with existingtools and devices. Thiscourse is a must foranyone responsible formonitoring networks forsecurity.”-Brad Milhorn, CompuComNew in 2016hato En nce Your Skills –Extended-HoursBootcampWe continue to underestimate theWho Should Attendtenacity of our adversaries! OrganizationsSecurity architectsare investing a significant amount ofSenior security engineerstime and financial and human resourcesTechnical security managerstrying to prevent and combat cyber Security Operations Center (SOC)analystsattacks, but despite this tremendousSOC engineerseffort organizations are still gettingSOC managerscompromised. The traditional perimeterCND analystsfocused, prevention-dominant approach to Individuals working to implementsecurity architecture has failed to preventContinuous Diagnostics andintrusions. No network is impenetrable,Mitigation (CDM), Continuousa reality that business executives andSecurity Monitoring (CSM), orNetwork Security Monitoringsecurity professionals alike have to accept.(NSM)Prevention is crucial, and we can’t losesight of it as the primary goal. However, a new proactive approachto security is needed to enhance the capabilities of organizations todetect threats that will inevitably slip through their defenses.The underlying challenge for organizations victimized by an attack istimely incident detection. Industry data suggest that most securitybreaches typically go undiscovered for an average of seven months.Attackers simply have to find one way into most organizations,because they know that the lack of visibility and internal securitycontrols will then allow them to methodically carry out their missionand achieve their goals.The Defensible Security Architecture, NetworkSecurity Monitoring (NSM)/Continuous Diagnosticsand Mitigation (CDM)/Continuous Security Monitoring(CSM) taught in this course will best position yourorganization or Security Operations Center (SOC) togiac.organalyze threats and detect anomalies that could indicatecybercriminal behavior. The payoff for this new proactiveapproach is early detection of an intrusion, or successfullythwarting the efforts of attackers altogether. Thesans.eduNational Institute of Standards and Technology (NIST)developed guidelines described in NIST SP 800-137 forContinuous Monitoring (CM), and this course will greatlyincrease your understanding and enhance your skills inWITH THIS COURSEimplementing CM utilizing the NIST framework.sans.org/ondemandEric ConradSANS Senior InstructorEric Conrad is the lead author of SANS MGT414: SANS Training Program for CISSP Certification, and coauthor of both SANS SEC511: Continuous Monitoring and SecurityOperations and SANS SEC542: Web App Penetration Testing and Ethical Hacking. He is alsothe lead author of the CISSP Study Guide, and the Eleventh Hour CISSP: Study Guide. Eric’s career began in 1991 asa UNIX systems administrator for a small oceanographic communications company. He gained information securityexperience in a variety of industries, including research, education, power, Internet, and healthcare. He is now CTOof Backshore Communications, a company focusing on hunt teaming, intrusion detection, incident handling, andpenetration testing. He is a graduate of the SANS Technology Institute with a master of science degree in informationsecurity engineering. In addition to the CISSP, he holds the prestigious GIAC Security Expert (GSE) certification as wellas the GIAC GPEN, GCIH, GCIA, GCFA, GAWN, and GSEC certifications. Eric also blogs about information security atwww.ericconrad.com. @eric conrad4Register at sans.org/reston-2016 301-654-SANS (7267)

SEC560:Network Penetration Testingand Ethical HackingSix-Day ProgramMon, Apr 4 - Sat, Apr 99:00am - 7:15pm (Day 1)9:00am - 5:00pm (Days 2-6)37 CPEsLaptop RequiredInstructor: Adrien de BeaupreGIAC Cert: GPENCyber GuardianSTI Master’s ProgramOnDemand BundleWho Should Attend Security personnel whose jobinvolves assessing networksand systems to find andremediate vulnerabilities Penetration testers Ethical hackers Defenders who want tobetter understand offensivemethodologies, tools, andtechniques Auditors who need to builddeeper technical skills Red and blue team members Forensics specialists whowant to better understandoffensive tactics“ This course has a directcorrelation to my jobduties. The insight, realworld references, and theuse of various tools willmake my job a lot easier.You will learn skills andways your systems arevulnerable.”-Roland T., USAFAs a cybersecurity professional, you have a unique responsibility to findand understand your organization’s vulnerabilities, and to work diligentlyto mitigate them before the bad guys pounce. Are you ready? SANSSEC560, our flagship course for penetration testing, fully arms you toaddress this task head-on.SEC560 is the must-have course for every well-rounded security professional.With comprehensive coverage of tools, techniques, and methodologiesfor network penetration testing, SEC560 truly prepares you to conducthigh-value penetration testing projects step-by-step and end-to-end.Every organization needs skilled information security personnel whocan find vulnerabilities and mitigate their effects, and this entire courseis specially designed to get you ready for that role. The course startswith proper planning, scoping and recon, then dives deep into scanning,target exploitation, password attacks, and web app manipulation, withover 30 detailed hands-on labs throughout. The course is chock fullof practical, real-world tips from some of the world’s best penetrationtesters to help you do your job safely, efficiently and masterfully.Learn the best ways to test your own systems before the bad guys attack.SEC560 is designed to get you ready to conduct a full-scale, high-valuepenetration test – and on the last day of the course you’ll do just that.After building your skills in comprehensive and challenging labs over fivedays, the course culminates with a final full-day, real-world penetrationtest scenario. You’ll conduct an end-to-end pen test, applying knowledge,tools, and principles from throughout the course as youdiscover and exploit vulnerabilities in a realistic sampletarget organization, demonstrating the knowledge you’vemastered in this course.Equipping security organizations with comprehensivepenetration testing and ethical hacking know-how.giac.orgYou will learn how to perform detailed reconnaissance,studying a target’s infrastructure by mining blogs, searchengines, social networking sites, and other Internet andsans.eduintranet infrastructures. Our hands-on labs will equip youto scan target networks using best-of-breed tools. Wewon’t just cover run-of-the-mill options and configurations,we’ll also go over the lesser known but super-usefulcapabilities of the best pen test toolsets available today.sans.org/After scanning, you’ll learn dozens of methods forcyber-guardianexploiting target systems to gain access and measurereal business risk. You’ll dive deep into post-exploitation,password attacks, and web apps, pivoting through thetarget environment to model the attacks of real-world bad WITH THIS COURSEguys to emphasize the importance of defense in depth.sans.org/ondemandAdrien de BeaupreSANS Certified InstructorAdrien de Beaupre works as an independent consultant in beautiful Ottawa, Ontario. His workexperience includes technical instruction, vulnerability assessment, penetration testing, intrusiondetection, incident response and forensic analysis. He is a member of the SANS Internet Storm Center (isc.sans.edu).He is actively involved with the information security community, and has been working with SANS since 2000. Adrienholds a variety of certifications including the GXPN, GPEN, GWAPT, GCIH, GCIA, GSEC, CISSP, OPST, and OPSA. When notgeeking out he can be found with his family, or at the dojo. @adriendbFor course updates, prerequisites, special notes, or laptop requirements, visit sans.org/reston-2016/courses5

SEC562:CyberCity Hands-on KineticCyber Range ExerciseSix-Day ProgramMon, Apr 4 - Sat, Apr 99:00am - 5:00pm36 CPEsLaptop RequiredInstructor: Tim MedinComputers, networks, and programmableWho Should Attendlogic controllers operate most of theRed and blue team membersphysical infrastructure of our modernCyber warriorsworld, ranging from electrical powerIncident handlersgrids, water systems, and traffic systemsPenetration testersall the way down to HVAC systems andEthical hackersindustrial automation. Increasingly, security Other security personnel who arefirst responders when systemsprofessionals need the skills to assess andcome under attack.defend this important infrastructure. In thisinnovative and cutting-edge course based on the SANS CyberCitykinetic range, you will learn how to analyze and assess the security ofcontrol systems and related infrastructure, finding vulnerabilities thatcould result in significant kinetic impact.“ This course is theNetWars CyberCitygreatest! I’ve taken over14 SANS training coursesand have been beenwaiting for this type ofcourse. I would like totake this course again ina few years.”-Masashi Fujiwara,Hitachi, LTD“ Tim is a great instructor,I really enjoyed the livedemos and the style ofhis teaching. He reallykeeps you engaged.”-Drew Davis, Rook SecurityNetWars CyberCity, our most in-depth and ambitious offering, isdesigned to teach warriors and infosec pros that cyber action canhave significant kinetic impact in the physical world. As computertechnology, networks, and industrial control systems permeate nearlyevery aspect of modern life, military, government, and commercialorganizations are realizing an increasing need for skilled defendersof critical infrastructure. We engineered and built CyberCity to helporganizations grow these capabilities in their teams.CyberCity is a 1:87 scale miniaturized physical city that featuresSCADA-controlled electrical power distribution, as well as water,transit, hospital, bank, retail, and residential infrastructure. CyberCityengages participants to defend the city’s components from terroristcyber attacks, as well as to utilize offensive tactics to retake ormaintain control of critical assets.The main objectives of CyberCity are to: Teach cyber warriors and their leaders the potential kinetic impacts of cyber attacks Provide a hands-on, realistic kinetic cyber range with engaging missions to conductdefensive and offensive actions Develop capabilities for defending and controlling critical infrastructure componentsto mitigate or respond to cyber attacks Demonstrate to senior leaders and planners the potential impacts of cyber attacksand cyber warfareTim MedinSANS Certified InstructorTim Medin is a senior technical analyst at Counter Hack, a company devoted to thedevelopment of information security challenges for education, evaluation, and competition.Through the course of his career, Tim has performed penetration tests on a wide range oforganizations and technologies. Prior to Counter Hack, Tim was a Senior Security Consultant for FishNet Securitywhere the majority of his focus was on penetration testing. He gained information security experience in a variety ofindustries including previous positions in control systems, higher education, financial services, and manufacturing. Timregularly contributes to the SANS Penetration Testing Blog (pen-testing.sans.org/blog/) and the Command Line Kung FuBlog (blog.commandlinekungfu.com). He is also project lead for the Laudanum Project, a collection of injectable scriptsdesigned to be used in penetration testing. @timmedin6Register at sans.org/reston-2016 301-654-SANS (7267)

FOR508:Advanced Digital Forensics andIncident ResponseSix-Day ProgramMon, Apr 4 - Sat, Apr 99:00am - 5:00pm36 CPEsLaptop RequiredInstructor: Alissa TorresGIAC Cert: GCFACyber GuardianSTI Master’s ProgramDoDD 8570OnDemand BundleFOR508: Advanced Digital Forensics andIncident Response will help you determine:H ow the breach occurred How systems were affected and compromised What attackers took or changed How to contain and mitigate the incidentOver 80% of all breach victims learn of a compromise from thirdparty notifications, not from internal security teams. Inmost cases, adversaries have been rummaging throughyour network undetected for months or even years.“ It was an extremelyvaluable course overall,and brings essentialtopics into one. Thiscourse covers an extensiveexcellent referencematerial.”-Edgar Zayas, U.S. Securitiesand Exchange Commission“ Wow! What a course,and one of the best Ihave attended in mylearning career.”-Srinath Kannan, AccentureI ncident response team leadersand members Security Operations Centerpersonnel and informationsecurity practitioners Experienced digital forensicanalysts System administrators Federal agents and lawenforcement Red team members, penetrationtesters, and exploit developers SANS FOR408 and SEC504graduatesDAY 0: A 3-letter government agencycontacts you to say critical informationwas stolen through a targeted attack onyour organization. They won’t tell how theyknow, but they identify several breachedsystems within your enterprise. An advancedpersistent threat adversary, aka an APT, islikely involved – the most sophisticated threat you are likely to face inyour efforts to defend your systems and data.digital-forensics.sans.orgamount of topics withWho Should AttendIncident response tactics and procedures have evolvedrapidly over the past several years. Data breaches andintrusions are growing more complex. Adversaries areno longer compromising one or two systems in yourenterprise; they are compromising hundreds. Yourteam can no longer afford antiquated incident responsetechniques that fail to properly identify compromisedsystems, provide ineffective containment of the breach,and ultimately fail to rapidly remediate the incident.This in-depth incident response course provides responders with advanced skills to hunt down, counter, andrecover from a wide range of threats within enterprisenetworks, including APT adversaries, organized crime syndicates, and hactivism. Constantly updated, FOR508 addresses today’s incidents by providing hands-on incidentresponse tactics and techniques that elite responders aresuccessfully using in real-world breach cases.GATHER YOUR INCIDENT RESPONSE TEAM –IT’S TIME TO GO s.org/8570WITH THIS COURSEsans.org/ondemandAlissa Torres SANS Certified InstructorAlissa Torres specializes in teaching advanced computer forensics and incident response. Herindustry experience includes serving in the trenches as part of the Mandiant Computer IncidentResponse Team (MCIRT) as an incident handler and working on a internal security team as adigital forensic investigator. She has extensive experience in information security, spanning government, academic, andcorporate environments and holds a Bachelors degree from the University of Virginia and a Masters from the Universityof Maryland in Information Technology. Alissa has taught at the Defense Cyber Investigations Training Academy (DCITA),delivering incident response and network basics to security professionals entering the forensics community. She haspresented at various industry conferences and numerous B-Sides events. In addition to being a GIAC Certified ForensicAnalyst (GCFA), she holds the GCFE, GPEN, CISSP, EnCE, CFCE, MCT, and CTT certifications. @sibertorFor course updates, prerequisites, special notes, or laptop requirements, visit sans.org/reston-2016/courses7

FOR578:Cyber Threat IntelligenceFive-Day ProgramMon, Apr 4 - Fri, Apr 89:00am - 5:00pm30 CPEsLaptop RequiredInstructor: Jake WilliamsOnDemand BundleMake no mistake: current computer network defense and incidentresponse contain a strong element of intelligence and counterintelligencethat analysts must understand and leverage in order to defend theircomputers, networks, and proprietary data.FOR578: Cyber Threat Intelligence will help network defenders andincident responders:digital-forensics.sans.orgWho Should Attend Incident response teammembers Security Operations Centerpersonnel and informationsecurity practitioners Experienced digital forensicanalysts Federal agents and lawenforcement officials SANS FOR408, FOR572,FOR508, or FOR610graduates looking to taketheir skills to the next level“ Fantastic class! I love theway the terminology wascovered. I will be makingindex cards to ensure Ihave them memorized.”-Nate DeWitt, eBay, Inc.C onstruct and exploit threat intelligence to detect, respond, and defeat advancedpersistent threats (APTs) Fully analyze successful and unsuccessful intrusions by advanced attackers Piece together intrusion campaigns, threat actors, and nation-state organizations Manage, share, and receive intelligence on APT adversary groups Generate intelligence from their own data sources and share it accordingly Identify, extract, and leverage intelligence from APT intrusions Expand upon existing intelligence to build profiles of adversary groups Leverage intelligence to better defend against and respond to future intrusionsConventional network defenses such as intrusion detection systemsand anti-virus tools focus on the vulnerability component of risk, andtraditional incident response methodology pre-supposes a successfulintrusion. However, the evolving sophistication of computer networkintrusions has rende

Eric Conrad is the lead author of SANS MgT414: SANS Training Program for CISSP Certification, and coauthor of both SANS SEC511: Continuous Monitoring and Security Operations and SANS SEC542: Web App Penetration Testing and Ethical Hacking. He is also the lead author of the CISSP Study guide, and the Eleventh Hour CISSP: Study guide.