Koulutus: SANS SEC540 Cloud Native Security and DevSecOps Automation

What SEC540 will teach:

• Understand DevOps principles for secure workflows
• Integrate AI security tools into developer environments and CI/CD pipelines
• Manage secrets and automate infrastructure with IaC
• Harden and monitor containers and Kubernetes workloads
• Secure software supply chain with SBOMs and artifact signing
• Defend microservices using cloud native identity provider and API Gateway services
• Automate compliance with policy guardrails and remediation
• Understand attacker tradecraft to perform proactive compromise assessments
• Upgrade detection capabilities via better understanding of novel attack techniques, focus on critical attack paths, and knowledge of available forensic artifacts
• Develop threat intelligence to track targeted adversaries and prepare for future intrusion events
• Build advanced forensics skills to counter anti-forensics and data hiding from technical subjects for use in both internal and external investigations

Should a breach occur, FOR508 graduates will have the skills to:

• Detect how and when attack happened
• Quickly identify compromised and infected systems
• Perform damage assessments and determine what was read, stolen, or changed
• Contain and remediate incidents

You Will Be Able To:

• Learn and master the tools, techniques, and procedures necessary to effectively hunt, detect, and contain a variety of adversaries and to remediate incidents.
• Detect and hunt unknown live, dormant, and custom malware in memory across multiple Windows systems in an enterprise environment
• Hunt through and perform incident response across hundreds of unique systems simultaneously using PowerShell, Velociraptor, and the SIFT Workstation
• Identify and track malware beaconing outbound to its command and control (C2) channel via memory forensics, registry analysis, and network connection residue.
• Determine how the breach occurred by identifying the root cause, the beachhead systems and initial attack mechanisms.
• Identify living off the land techniques, including malicious use of PowerShell and WMI.
• Target advanced adversary anti-forensics techniques like hidden and time-stomped malware, along with living off the land techniques used to move in the network and maintain an attacker's presence.
• Use memory analysis, incident response, and threat hunting tools in the SIFT Workstation to detect hidden processes, malware, attacker command lines, rootkits, network connections, and more.
• Track user and attacker activity second-by-second on the system you are analyzing through in-depth timeline and super-timeline analysis.
• Recover data cleared using anti-forensics techniques via Volume Shadow Copy/Restore Point analysis.
• Identify lateral movement and pivots within your enterprise across your endpoints, showing how attackers transition from system to system without detection.
• Understand how the attacker can acquire legitimate credentials - including domain administrator rights - even in a locked-down environment.
• Track data movement as attackers collect critical data and shift it to exfiltration collection points.
• Recover data cleared using anti-forensics techniques via Volume Shadow Copy and Restore Point analysis and artifact carving.
• Use collected data to perform effective remediation across the entire enterprise.