SECURITY 504 - Day 1
Incident Handling Step-by-Step and Computer Crime Investigation
Securing an infrastructure is a complex task of balancing business needs against security
risks. With the discovery of new vulnerabilities almost on a daily basis, there is always the
potential for an intrusion. In addition to online intrusions, physical incidents like fires,
floods and crime all require a solid methodology for incident handling to be in place, in
order to get systems and services back online as quickly and securely as possible.
The first part of the course looks at the invaluable Incident Handling Step-by-Step model.
Incident Handling Step-by-Step was created through a consensus process involving experienced
incident handlers from corporations, government agencies, and educational institutes, and has
been proven effective in hundreds of organizations. This section is designed to provide students
a complete introduction to the incident handling process, using the six steps (preparation,
identification, containment, eradication, recovery and lessons learned) one needs to follow to
prepare for and deal with a computer incident.
The second part of this course examines from-the-trenches case studies to understand what does
and does not work in identifying computer attackers. This section provides valuable information
on the steps a systems administrator can take to improve the chances of catching and prosecuting
attackers.
SECURITY 504 - Day 2
Computer and Network Hacker Exploits - Part 1
Seemingly innocuous data leaking from your network could provide the clue needed by an
attacker to blow your systems wide open. This day-long course covers the details associated with
reconnaissance and scanning, the first two phases of many computer attacks.
Your networks reveal an enormous amount of information to potential attackers. In addition to
looking for information leakage, attackers also conduct detailed scans of systems, scouring for
openings to get through your defenses. They scope out targets of opportunity to break into your
network, such as weak DMZ systems and firewalls, unsecured modems, or the increasingly popular
wireless LAN attacks. Attackers are increasingly employing inverse scanning, blind scans, and
bounce scans to obscure their source and intentions. They are also targeting firewalls,
attempting to understand and manipulate rule sets to penetrate our networks. Another very hot
area in computer attacks involves Intrusion Detection System evasion, techniques that allow an
attacker to avoid detection by these computer burglar alarms.
If you don't have the skills needed to understand these critical phases of an attack in detail,
you won't be able to protect your network. Students who take this class and master the material
will understand these attacks and the associated defenses.
It is imperative that you get written permission from the proper authority in your organization
before using these tools and techniques on your organizations systems, and also that you advise
your network and computer operations teams of your testing schedule.
SECURITY 504 - Day 3
Computer and Network Hacker Exploits - Part 2
Computer attackers are ripping our networks and systems apart in novel ways, while constantly
improving their techniques. This day-long course covers the third step of many hacker attacks:
gaining access.
Attackers employ a variety of strategies to take over systems, from the network level up to
the application level. This section covers the attacks in depth, from the details of buffer
overflow and format string attack techniques to the latest in session hijacking of supposedly
secure protocols. Additionally, you'll get hands-on experience in running sniffers and the
incredibly flexible Netcat tool.
Administrators need to get into the "meat" of how the attacks and their associated defenses
work to really defend against these attacks. For each attack, the course explains the
vulnerability, how various tools exploit it, the signature of the attack, and how to harden
the system or application against the attack. Students who sign an ethics and release form
are issued a CD-ROM containing the attack tools examined in class.
It is imperative that you get written permission from the proper authority in your
organization before using these tools and techniques on your organizations system, and also
that you advise your network and computer operations teams of your testing schedule.
SECURITY 504 - Day 4
Computer and Network Hacker Exploits - Part 3
This course starts out by covering one of the attackers favorite techniques for
compromising systems: worms. We'll analyze worm developments over the last two years,
and project these trends into the future to get a feel for the coming Super Worms we'll
face. Then, the course turns to another vital area often exploited by attackers: web
applications. Because most organizations' homegrown web applications don't get the security
scrutiny of commercial software, attackers exploit these targets using SQL injection, cross-
site scripting, session cloning, and a variety of other mechanisms discussed in detail.
The course also presents a taxonomy of nasty denial of service attacks, illustrating how
attackers can stop services or exhaust resources, as well as what you need to do to prevent
their nefarious deeds.
Also, once intruders have gained access into a system, they want to keep that access,
preventing pesky system administrators and security personnel from detecting their presence.
To fool you, attackers install backdoor tools and manipulate existing software on a system
to maintain access to the machine on their own terms.
To defend against these attacks, you need to understand how attackers alter systems to
discover the sometimes-subtle hints associated with system compromise. This course arms
you with the understanding and tools you need to defend against attackers maintaining
access and covering their tracks.
It is imperative that you get written permission from the proper authority in your
organization before using these tools and techniques on your organizations system, and
also that you advise your network and computer operations teams of your testing schedule.
SECURITY 504 - Day 5
Computer and Network Hacker Exploits - Part 4
This day-long course covers the fourth and fifth steps of many hacker attacks: maintaining
access and covering their tracks. Computer attackers install backdoors, apply Rootkits, and
sometimes even manipulate the underlying kernel itself to hide their nefarious deeds. Each
of these categories of tools requires specialized defenses to protect the underlying system.
In this course, we'll analyze the most commonly used malicious code specimens, as well as
explore future trends in malware, including BIOS-level and combo malware possibilities.
Attackers also cover their tracks by hiding files, sniffers, network usage, and active
processes. Additionally, super stealthy sniffing backdoors are increasingly being used
to thwart investigations. Finally, attackers often alter system logs, all in an attempt
to make the compromised system appear normal. This course gives you the tools and
techniques you need to detect and respond to these activities on your computers and
network.
It is imperative that you get written permission from the proper authority in your
organization before using these tools and techniques on your organizations system,
and also that you advise your network and computer operations teams of your testing
schedule.
SECURITY 504 - Day 6
Hacker Tools Workshop
Over the years, the security industry has become smarter and more effective in stopping
hackers; unfortunately, hacker tools are becoming smarter and more complex. One of the
most effective methods in stopping the enemy is actually testing the environment with
the same tools and tactics an attacker might use against you.
This workshop lets you put what you have learned over the past week into practice.
You will be connected to one of the most hostile networks on planet Earth. This network
simulates the Internet and allows students to try actual attacks against live machines
and learn how to protect against these attacks. This workshop will supplement the
classroom training that the student has already received and give them flight time with
the attack tools to better understand how they work. Instructors will give guidance on
exactly what is happening as exploits and defensive measures are running. As students
work on various exploits and master them, the environment will become increasingly
difficult so that students will have to master additional skills in order to successfully
complete the exercises.
Additionally, students can participate in the workshop's Capture The Flag event.
By penetrating systems, discovering subtle flaws, and using puzzle-solving techniques,
you can test the skills you've built over the week in this engaging contest. The Capture
The Flag victors will win a prize.
Paranoia is good!
Your laptop will be attacked. Do not have any sensitive data stored on the system. SANS
is not responsible for your system if (actually, when) someone in the class attacks it
in the workshop. Bring the right equipment and prepare it in advance to maximize what
you'll learn and the fun you'll have doing it.
Download File Size:53.86 MB
|
