Channel Title: SANS Cyber Defense Channel Description: The Cyber Defense curriculum, epitomizes security professionals on the front-line of defending, day-in and day-out. Heavy emphasis on facilitating the detection and response to compromise monitoring for adversary activities. Detection made easier with a more secure posture and actively maintaining/improving security over time. <video> Guardrails for Innovation: Navigating Security Standards in Generative AI and LLMs Description: As generative AI and large language models (LLM) gain momentum, solid security standards are more critical than ever. In this talk, SANS Faculty Fellow and SEC511 author Seth Misenar dives into the key frameworks and models shaping the security landscape for AI: the EU AI Act, NIST AI Risk Management Framework (AI RMF), OWASP Top 10 for LLM, and MITRE ATLAS. Seth shows how these frameworks act as essential guardrails, guiding us through the risks while fostering innovation. Whether you're building, deploying, or managing AI systems, you'll leave with actionable insights to better secure your AI initiatives and stay ahead in this rapidly evolving field. Learn more about SEC511 Cybersecurity Engineering: Advanced Threat Detection and Monitoring: https://www.sans.org/u/1vzW About the Speaker Seth Misenar is a Cyber Security Expert who serves as a SANS Faculty Fellow and Principal Consultant at Context Security, LLC. He is numbered among the few security experts worldwide to have achieved the GIAC GSE (#28) credential. His background includes network and Web application penetration testing, vulnerability assessment, regulatory compliance efforts, security architecture design, and general security consulting. Seth teaches a variety of cybersecurity courses for the SANS Institute including two popular courses for which he is co-author: the bestselling SEC511: Continuous Monitoring and Security Operations and LDR414: SANS Training Program for CISSP® Certification. He also co-authored Syngress CISSP® Study Guide, now in its 3rd Edition. </video> <video> Hybrid Fortresses: How A Defensible Security Architecture Raises the Bar Against Modern Attacks Description: As we navigate 2024, we have witnessed a surge in complex ransomware campaigns, cloud infrastructure breaches, and sophisticated supply chain attacks, each pushing the boundaries of what constitutes a secure architecture. In this talk, Ismael Valenzuela and Andy Smith, will delve into the key security patterns and anti-patterns that have emerged in response to these threats. We will explore how hybrid security architectures-combining optimized on-premises defenses with advanced cloud-based solutions-can provide a more resilient and adaptable security posture. Learn more about SEC530 Defensible Security Architecture and Engineering: Implementing Zero Trust for the Hybrid Enterprise: https://www.sans.org/u/1vA1 About the Speakers Ismael Valenzuela is author of the Cyber Defense and Blue Team Operations course, SANS SEC530: Defensible Security Architecture and Engineering and co-author of SEC568: Combating Supply Chain Attacks with Product Security Testing. Ismael is Vice President Threat Research & Intelligence at BlackBerry Cylance, where he leads threat research, intelligence, and defensive innovation. Ismael Valenzuela has participated as a security professional in numerous projects across the globe for over 20+ years, which included being the founder of one of the first IT Security consultancies in Spain. Andy Smith works as a Principal Security Architect for BP, where he draws on his strengths in security architecture and engineering to focus on securing emerging technologies and developing security strategies for complex businesses. His background is a mix of deeply technical elements and a good understanding of business practicalities, both of which he considers essential to developing solutions that not only meet technical security requirements but also work for real people. </video> <video> Encrypted DNS Developments Description: Over the last couple of years, there have been several new standards for natively encrypting DNS traffic. DoT, DoH, DoQ - What are these new acronyms, what is the difference, and why should you care? Let's answer these questions and, well, also look at some packets. Learn more about SEC503 Network Monitoring and Threat Detection In-Depth: https://www.sans.org/u/1vtz About the Speaker: Andrew Laman is the founder and principal consultant at A4 InfoSec, an independent consulting firm with services focusing on monitoring, detection, and incident response. Andy has more than 25 years of information technology and security experience in multiple industries. He has held lead security positions in Fortune 500 and several global companies. Andy is a course contributor and teaches SEC503: Network Monitoring and Threat Detection In-Depth, for the SANS Institute. In addition to the CISSP, Andy holds multiple GIAC certifications including the prestigious GIAC Security Expert (GSE #142) certification as well as multiple other industry certifications. </video> <video> Stand out from the crowd! Using PowerShell to automate your daily tasks Description: A common question I get asked is how can I differentiate myself from my colleagues when competing for entry level positions. The answer is improving your scripting skills. This not only can help you stand out for potential employers but is a skills multiplier in your current role. Powershell is Microsoft's scripting environment that is now available in Linux and Mac. It provides a powerful platform to automate your workflows and free you up to focus on the analysis of information. This talk will highlight some of the ways we use Powershell in SEC401 to lay a strong foundation to build upon to help you differentiate yourself as you move forward in your career. Learn more about SEC401 Security Essentials - Network, Endpoint, and Cloud: https://www.sans.org/u/1vuM About the Speaker Timothy Garcia is a seasoned security professional who loves the challenge and continuously changing landscape of defense. Tim started his career as an engineer in IT and after working on a few security incidents related to Code Red and Nimda; he realized he had found his calling. Tim currently works as an Information Security Engineer for a Fortune 100 financial institution where he provides security consulting to project teams to ensure security of IT operations and compliance with policies and regulations. </video> <video> MAVIS: Machine Assisted Vulnerability Identification System Description: Code review has become what log review was a few years ago; everyone knows they should do it, everyone says they are doing something, but everybody knows they aren't doing enough. In this talk David covers the highlights of MAVIS, a new open source project that can be used to supplement or even guide code review of internal projects. MAVIS is an ML/AI based tool that can be hooked into your CI pipeline to flag code commits that deserve "special attention." Learn more about SEC595 Applied Data Science and AI/Machine Learning for Cybersecurity Professionals: https://www.sans.org/u/1vzR About the Speaker David Hoelzer, a SANS Fellow and author of more than twenty days of SANS courseware, is an expert in a variety of information security fields, having served in most major roles in the IT and security industries over the past twenty-five years. Currently, David serves as the principal examiner and director of research for Enclave Forensics, a New York/Las Vegas based incident response and forensics company. He also serves as the chief information security officer for Cyber-Defense, an open-source security software solution provider. </video> <video> Edge Out Your Next BEC Adversary: Investigation and Prevention Strategies Using OSINT Description: In this presentation, Jeff explores the latest trends in Business Email Compromises (BEC) and demonstrates how Open Source Intelligence (OSINT) can enhance response and help prevent many of these incidents. Adversaries are now employing a range of tactics to infiltrate your network and steal your money using cyber techniques and traditional attacks. This talk identifies the current BEC tactics being used while highlighting the role of OSINT in identifying vulnerabilities. Gain practical insights into implementing OSINT strategies for the prevention and response caused by the most persistent threat actors in this space. Learn more about SEC497 Practical Open-Source Intelligence (OSINT): https://www.sans.org/u/1vuW About the Speaker Jeff Lomas works as a Detective and Digital Forensic Examiner at the Las Vegas Metropolitan Police Department and has proudly served the Las Vegas community since 2008. Jeff has digital forensic experience and training with Mac, iOS Windows, and Android operating systems. Jeff maintains certifications as a digital forensic examiner with IACIS (CFCE), has a bachelor's degree in Intelligence Management with a focus in Cybersecurity, a master's degree in Cybersecurity, and over 15 other industry-accepted certifications in areas ranging from mobile forensics, vehicle forensics, and computer forensics. Jeff is passionate about sharing his knowledge and experience with students to help them master the topic of mobile forensics. As a SANS Instructor, Jeff teaches SEC497: Practical Open-Source Intelligence (OSINT). </video> <video> Automating Log Analysis Description: In this presentation, Mark Baggett explores the amazing benefits of automating log file analysis using Python. He shows how Python makes it easy to handle your log files with simple file operations. He dives into the power of regular expressions to search through your logs and find important patterns. Finally, he introduces some cool analysis techniques to extract useful data and insights from your logs. By the end of this session, you'll see how automating log analysis can save you time, help you catch issues faster, and make your life a whole lot easier. Get ready to transform how you handle log files with the power of Python! Learn more about SEC573 Automating Information Security with Python: https://www.sans.org/u/1vAq About the Speaker Mark Baggett’s first foray into information security was on the receiving end of hacking, and he was amazed by the experience. “The hackers made my computer do stuff that I didn't think was possible,” he says. “It was like magic and I had to know how the trick was done.” He immediately became obsessed with understanding all the tricks, how they worked, and how to prevent them from happening again. Fast forward to today and Mark’s infosec career spans nearly 30 years with 15 of those years spent teaching for SANS. Mark is currently a senior instructor for SANS and an independent consultant through his company Indepth Defense providing forensics, incident response, and penetration testing services. Mark has also served as the technical advisor to the DoD for SANS since 2011, where he assists various government organizations in the development of information security capabilities. </video> <video> The Python Security Pickle Description: In this presentation, Mark Baggett dives into the world of Python and its tool called pickle, which helps save and load data easily. First, he explores how pickle makes it simple to store information and share it between different parts of a program. But here's the exciting (and a bit scary) part: pickle has a big security flaw because it can run any code when loading data, which can be dangerous. He shows some eye-opening examples of how hackers can use this flaw to run harmful code on your computer. By seeing these real-life demos, you'll understand the risks and tricks hackers use. At the end, he shares some cool tips and tricks to keep your programs safe, making sure you use the best tools and practices to avoid these sneaky threats. Get ready for a thrilling journey into the world of Python security! Learn more about SEC673 Advanced Information Security Automation with Python: https://www.sans.org/u/1vuR About the Speaker Mark Baggett’s first foray into information security was on the receiving end of hacking, and he was amazed by the experience. “The hackers made my computer do stuff that I didn't think was possible,” he says. “It was like magic and I had to know how the trick was done.” He immediately became obsessed with understanding all the tricks, how they worked, and how to prevent them from happening again. Fast forward to today and Mark’s infosec career spans nearly 30 years with 15 of those years spent teaching for SANS. Mark is currently a senior instructor for SANS and an independent consultant through his company Indepth Defense providing forensics, incident response, and penetration testing services. Mark has also served as the technical advisor to the DoD for SANS since 2011, where he assists various government organizations in the development of information security capabilities. </video> <video> Supply Chain Security Incident Response: Strategies for Responding to Emerging Threats Description: In an ideal world, we would have a well-defined supply chain incident response plan, complete with well-tested procedures, SBOMs, and comprehensive software inventories. However, reality often catches us off-guard. In this presentation, Tony Turner will delve into effective strategies for navigating the threat landscape across various supply chain vectors, including hardware, software, and service providers. We will explore new tools and approaches to ensure your teams are prepared to respond effectively to new and emerging threats. Key Topics Covered: - Threat Landscape Navigation: Understanding the different vectors in hardware, software, and service providers. - Effective Response Strategies: Techniques to enhance your incident response capabilities. - Innovative Tools and Approaches: Exploring new solutions to improve your incident response. - Preparation and Response: Practical advice on ensuring your teams are ready for unexpected incidents. </video> <video> CYA by Using CIA...Correctly for a Change Description: In this insightful cybersecurity presentation, Keith Palmgren, a seasoned SANS instructor, challenges the conventional wisdom around the CIA (Confidentiality, Integrity, Availability) triad. Rather than viewing CIA as three equal parts, Ponder argues that companies must prioritize these elements based on their specific needs and resources. Through real-world examples from organizations like Coca-Cola, Ball Corporation, Chase Bank, and pharmaceutical giants, Palmgren demonstrates how the prioritization of CIA can vary significantly across sectors and even within different departments of the same company. He emphasizes that the rigid "triad" approach is often an unattainable ideal, and encourages attendees to instead use CIA as a framework for strategic prioritization. This presentation offers valuable insights for anyone seeking to optimize their organization's security posture in a practical and effective manner. About the Speaker: Keith Palmgren is a cybersecurity professional with over 35 years of experience specializing in the IT Security field. He is a SANS Senior Instructor and the author of SEC301: Introduction to Cyber Security. Keith also runs a successful security consulting practice, working with corporate leadership and security staff to help lower their organization's risk. Keith has taught over 25,000 students and authored 22 courses, seven of which the American Council on Education certified as eligible for college credit. Not only does he make sure students are grounded with the importance of fundamentals, but he shows them the evolution of cybersecurity; an evolution that he was part of. </video> <video> APT Takedown: The 2024 Blueprint for Cyber Victory Description: 2024 cyber news has been filled with stories of highly complex compromises that involve living off the land, network infrastructure compromise, and complex cloud-native breach techniques. What are defenders to do? Do we have any chance at detecting and stopping in these attacks? Of course we do! It won't be easy, but this is YOUR turf, and you have the advantage...if you know how to use it. With a strong understanding of defense fundamentals, attack methods, the right data sources, and some grit, your cyber defense team can go head to head with APTs and come out on top! Learn more about SEC450 Blue Team Fundamentals: Security Operations and Analysis: https://www.sans.org/u/1vA6 About the Speaker John Hubbard is a Security Operations Center (SOC) consultant and speaker, a Senior SANS instructor, and the course author of two SANS courses, SEC450: Blue Team Fundamentals - Security Operations and Analysis and LDR551: Building and Leading Security Operations Centers. John previously taught additional SANS Cyber Defense courses such as SEC511: Continuous Monitoring and Security Operations, and SEC555: SIEM with Tactical Analytics. Through his years of experience as a Lead Cyber Security Analyst and SOC Manager for a major pharmaceutical company with over 100,000 employees and global operations, John has developed real-world, first-hand knowledge of what it takes to defend an organization against advanced cyber-attacks. </video> <video> OSINT & Vicarious Trauma Description: In the world of OSINT, vicarious trauma is a silent threat, creeping in as we expose ourselves to disturbing content daily. This isn't just an occupational hazard--it's a mental health crisis that demands our attention. By recognizing the signs and prioritizing mental well-being, we can safeguard not only our effectiveness but also our humanity. Acknowledging the impact isn't a weakness; it's essential for sustaining our crucial work. Let's bring this conversation to the forefront of our OSINT practices. Learn more about SEC587 Advanced Open-Source Intelligence (OSINT) Gathering and Analysis: https://www.sans.org/u/1vv6 About the Speaker Nico is a SANS Instructor for SEC497 Practical Open-Source Intelligence (OSINT), the lead author for SEC587: Advanced Open-Source Intelligence (OSINT) Gathering and Analysis, the owner of Dutch Osint Guy Intelligence Services, and an all-round All Source Analyst with years of government experience. Before he became a SANS instructor, Nico helped set up the OSINT units within the Dutch Government. He has taught hundreds of police, tax, and military units to conduct OSINT research & analysis, and is a well-known keynote speaker who has given lectures about OSINT & cyber intelligence for governments in Europe and the United States. Nico has been honored by Head of Europol, the DHS, and NATO for his efforts in the OSINT field. </video> <video> The SBOM Makeover Description: Software Bill of Materials (SBOM) are increasingly being used in software supply chain security to provide transparency and support vulnerability identification and remediation. But SBOMs are only as good as the data they contain, and not all tools provide beautiful results. In this presentation Tony Turner highlights the attributes of high quality SBOMs, what makes them beautiful (useful) and how tools are supporting these use cases or failing to deliver value. He explores how you can evaluate SBOM quality yourself to understand the maturity of your suppliers' process or to evaluate the capabilities of SBOM tools you are considering acquiring. Lastly, you'll look at how you can enrich your own SBOMs, including use cases your tools might not even support. This will be a technical foray into the topic of SBOM quality and enrichment suitable for cybersecurity, product and software architects and engineers tasked with producing or analyzing SBOMs, as well as the managers who oversee this work. We hope you are ready for a SBOM Makeover! Learn more about SEC547 Defending Product Supply Chains: https://www.sans.org/u/1vv1 About the Speaker Tony Turner is the CEO and Founder of Opswright. This software company helps to address challenges with “insecure by design” by embedding security into engineering workflows. Working in cyber affords him the ability to think evilly but do so with a positive intent. Cyber defense is Tony’s true love, and he enjoys helping other people in the industry illuminate the fog and confusion on approaches that work to reduce risk. Since the beginning of his career, SANS has been Tony's high watermark of quality and excellence. “I have looked up to my instructors for years and when the opportunity arose to contribute, I could not say no.” </video> <video> Mastering the Journal Description: As Linux systems become increasingly complex, security professionals struggle to effectively manage and analyze log data. The Systemd Journal offers a robust and centralized logging solution but often remains underutilized. This talk will equip you with the practical knowledge to harness the full potential of journald for enhanced security. Charlie Goldner dives into configuration best practices, including securing log data, managing access controls, and implementing optimal retention policies. Learn how to efficiently ship logs to external systems for redundancy and analysis. Finally, he explores techniques to detect and mitigate log tampering attempts. By the end of this session, you will have the skills to confidently protect your systems through effective log management. Learn more about SEC406 Linux Security for InfoSec Professionals: https://www.sans.org/u/1vAv About the Speaker Charlie Goldner is a Cyber Security Analyst Expert for SANS Institute, specifically supporting the US Army Defensive Cyber Operations Branch. Working for more than two decades for the US Army and Nevada National Guard, Charlie brings a wealth of military and government experience to the classroom. He has been a Network Operations Manager, Network Engineer, Network Assurance Manager, App Developer and Strategic Analyst. Before onboarding with SANS in early 2020, Charlie served for 5 years as the Director of Information Security and Architecture for the Nevada Army National Guard. Charlie is an instructor for AUD507: Auditing Systems, Applications, and the Cloud. </video> <video> Next Gen SOC Description: The increasing complexity and sophistication of cyber threats demands a fundamental shift in how SOCs operate. This talk explores the evolution of SOCs from traditional reactive models to proactive, intelligence-driven operations. Nick discusses the integration of cutting-edge technologies such as AI, ML, and SOAR, which are transforming SOCs into more agile and effective defenders against advanced threats. Insight will be provided into modern SOC architectures, the importance of threat intelligence, and how to foster collaboration between human analysts and automated systems. Nick also covers strategies for building a resilient and scalable SOC that can adapt to the ever-changing threat landscape, ensuring robust cybersecurity defense for organizations in the digital age. Learn more about SEC555 SIEM with Tactical Analytics: https://www.sans.org/u/1yyi About the Speaker Nick Mitropoulos is the CEO at Scarlet Dragonfly, a company that handles a range of security services like SOC, Incident Handling and Vulnerability Management to name a few. He has over 16 years of experience in various industries ranging from consulting, education, telecommunications, healthcare, investment banking, financial, energy, oil and gas, insurance, pharmaceutical, law, military and news. His breadth of experience combined with his love for teaching are crucial in helping his students better grasp the various facets of security. </video>

Contacts and Links

Description

The Cyber Defense curriculum, epitomizes security professionals on the front-line of defending, day-in and day-out. Heavy emphasis on facilitating the detection and response to compromise monitoring for adversary activities. Detection made easier with a more secure posture and actively maintaining/improving security over time.

Videos from channel