Training Catalogue 2018 - SANS.org

Page created by Julia Wolf
 
CONTINUE READING
Training Catalogue 2018 - SANS.org
PRIVATE TRAINING
                                                                      TRAINING EVENTS

                                                                                                           ON DEMAND
   EMEA
                   WWW.SANS.ORG

 Training
Catalogue
                       2018

   THE LARGEST AND MOST TRUSTED SOURCE
             OF CYBER SECURITY TRAINING,
C E RT I F I C AT I O N , A N D R E S E A R C H I N T H E W O R L D

                          @SANSEMEA
Training Catalogue 2018 - SANS.org
About SANS                                                                                                                                      Contents
SANS is the world’s largest                     Focussed training                              There are over 30 specialised GIAC               SANS Cyber Defence Courses
and most trusted provider                       SANS training is job and skill-specific. We    certifications. Several GIAC certifications      SEC301   Intro to Information Security                                                     14         About SANS                                                                                                                                                                                                                                                                                                                                                                                                                      2
                                                offer more than 60 courses, designed to        are accepted under the ANSI/ISO/IEC 17024        SEC401   Security Essentials Bootcamp Style                                                15         Contents                                                                                                                                                                                                                                                                                                                                                                                                                        3
of cyber security training.                     align with dominant security team roles,       Personnel Certification programme.               SEC501   Advanced Security Essentials – Enterprise Defender                                16         Training Roadmap                                                                                                                                                                                                                                                                                                                                                                                                                4
Founded in 1989, SANS                           duties, and disciplines.                                                                        SEC503   Intrusion Detection In-Depth                                                      17         Training Formats                                                                                                                                                                                                                                                                                                                                                                                                                6
operates globally and has                                                                      Many SANS training courses align with GIAC       SEC504   Hacker Tools, Techniques, Exploits, and Incident Handling                         18         SANS Curricula                                                                                                                                                                                                                                                                                                                                                                                                                  8
over 140,000 alumni.                            The SANS Curriculum spans Digital              certifications. As such, SANS Training is an     SEC505   Securing Windows and PowerShell Automation                                        19         Course Descriptions                                                                                                                                                                                                                                                                                                                                                                                                             14
                                                Forensics, Audit, Management,                  ideal preparation for a GIAC certification       SEC506   Securing Linux/Unix                                                               20         Security Awareness Training                                                                                                                                                                                                                                                                                                                                                                                                     25
                                                Pen Testing, ICS, Secure Software              attempt.                                         SEC511   Continuous Monitoring and Security Operations                                     21         Netwars                                                                                                                                                                                                                                                                                                                                                                                                                         56
For over twenty-five years, we have worked      Development and more (see pages 20-25).                                                         SEC545   Cloud Security Architecture and Operations                                        22         Upcoming SANS Events                                                                                                                                                                                                                                                                                                                                                                                                            60
with many of the world’s more prominent         Each curriculum offers a progression of        Why SANS is the best training and                SEC555   SIEM with Tactical Analytics                                                      23
companies, military organisations, and          courses that can take practitioners from       educational investment                           SEC579   Virtualization and Software Defined Security                                      24
governments.                                    a subject’s foundations right up to top-       SANS’ immersion training is intensive and
                                                flight specialisms.                            hands-on and our courseware is unrivalled        SANS Penetration Testing & Vulnerability Courses
Technology may have changed in that time,                                                      in the industry.                                 SEC542   Web App Penetration Testing and Ethical Hacking                                   26         Training
but our core mission has remained constant:     Our training is designed to be practical;                                                       SEC550   Active Defense, Offensive Countermeasures, and Cyber Deception                    27   4     Roadmap
to protect people and assets through            students are immersed in hands-on lab          SANS Instructors and course authors are          SEC560   Advanced Penetration Testing, Exploit Writing, and Ethical Hacking                28                                      Training Roadmap

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       EMEA
                                                                                                                                                                                                                                                                                   Choose your path

                                                                                                                                                                                                                                                                             CORE                                                                                                   INTERMEDIATE                                                                                                    ADVANCED/SPECIALISED

sharing cutting-edge cyber-security skills      exercises built to let them rehearse, hone     leading industry experts and practitioners.      SEC561   Immersive Hands-on Hacking Techniques                                             29                                New to cyber security?
                                                                                                                                                                                                                                                                             SEC
                                                                                                                                                                                                                                                                             301
                                                                                                                                                                                                                                                                                       Intro to Information
                                                                                                                                                                                                                                                                                       Security
                                                                                                                                                                                                                                                                                       GISF Certification - Information Security Fundamentals

                                                                                                                                                                                                                                                                                                                                                                                                   You are experienced in security,
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               You are a candidate
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               for specialised or
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               advanced training
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                SANS’ comprehensive curriculum enables professionals to deepen their technical
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                skills in key practice areas. It also directly addresses software developers, industrial
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                control engineers, and non-technical personnel in management, legal, and audit.

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Cyber Defence Operations                                                                  Industrial Control Systems Security

and knowledge.                                  and perfect what they’ve learned.              Their real-world experience informs their        SEC573   Automating Information Security for Python                                        30
                                                                                                                                                                                                                                                                                                                                                                                                   preparing for a specialised job
                                                                                                                                                                                                                                                                                       You are experienced in                                                                       2              role or focus                                                                                        SEC501 Advanced Security Essentials                                                      ICS410 ICS/SCADA Security Essentials - GICSP
                                                                                                                                                                                                                                                                             1A        technology, but need to learn                                                                                                                                                                                           Enterprise Defender - GCED
                                                                                                                                                                                                                                                                                       hands-on, essential security                                                                                                                                                                                                                                                                              ICS456 Essentials for NERC Critical
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        SEC505 Securing Windows and                                                                     Infrastructure Protection
                                                                                                                                                                                                                                                                                       skills and techniques                                                                      Security Monitoring & Detection                                                                                              PowerShell Automation - GCWN                                                      ICS515 ICS Active Defence
                                                                                                                                                                                                                                                                                                                                                                                                 Intrusion Detection                                                                                    SEC506 Securing Linux/Unix - GCUX                                                               and Incident Response - GRID
                                                                                                                                                                                                                                                                                                                                                                                    SEC          In-depth                                                                                               SEC566 Implementing and Auditing the Critical
                                                                                                                                                                                                                                                                             Core Security Techniques                                                                               401          GCIA - Certified Intrusion Analyst                                                                            Security Controls - In-Depth - GCCC
                                                                                                                                                                                                                                                                             Defend & Maintain                                                                                                   Continuous Monitoring                                                                                  SEC579 Virtualization and Private Cloud Security
                                                                                                                                                                                                                                                                                                                                                                                    SEC          and Security Operations                                                                                SEC599 Defeating Advanced Adversaries -
                                                                                                                                                                                                                                                                             The defence-in-depth techniques taught in SEC401 are                                                   511          GMON - Continuation Monitoring                                                                                Implementing Kill Chain Defences

                                                                                               teaching and SANS’ training content.             SEC575   Mobile Device Security and Ethical Hacking                                        31
                                                                                                                                                                                                                                                                             essential for every security professional. SEC504 provides
                                                                                                                                                                                                                                                                             additional “offence informs defence” knowledge, teaching
                                                                                                                                                                                                                                                                             defence specialists how attacks occur and how to
                                                                                                                                                                                                                                                                             respond. Students with existing core defence skills could                                            Penetration Testing                                                                                               Penetration Testing and Ethical Hacking
                                                                                                                                                                                                                                                                             begin their training journey with SEC504.
                                                                                                                                                                                                                                                                                                                                                                                  and Vulnerability Analysis
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        SEC550 Active Defence, Offensive Countermeasures                                         SEC642 Advanced Web App Penetration Testing
                                                                                                                                                                                                                                                                                                                                                                                                 Network Penetration Testing                                                                                   and Cyber Deception                                                                      and Ethical Hacking
                                                                                                                                                                                                                                                                                       Security Essentials                                                                          SEC          and Ethical Hacking
                                                                                                                                                                                                                                                                             SEC       Bootcamp Style                                                                                                                                                                                                   SEC561 Immersive Hands-On Hacking Techniques                                             SEC660 Advanced Penetration Testing,
                                                                                                                                                                                                                                                                             401                                                                                                    560          GPEN - Penetration Tester                                                                                                                                                                              Exploit Writing, and Ethical Hacking - GXPN
                                                                                                                                                                                                                                                                                       GSEC - Security Essentials                                                                                                                                                                                       SEC573 Python for Penetration Testers - GPYC
                                                                                                                                                                                                                                                                                                                                                                                                 Web App Penetration Testing                                                                            SEC575 Mobile Device Security                                                            SEC760 Advanced Exploit Development
                                                                                                                                                                                                                                                                                       Hacker Tools, Techniques,                                                                    SEC          and Ethical Hacking                                                                                           and Ethical Hacking - GMOB                                                               for Penetration Testers
                                                                                                                                                                                                                                                                              SEC      Exploits, and Incident Handling                                                              542          GWAPT - Web Application Penetration Tester
                                                                                                                                                                                                                                                                              504

Strength from people                                                                                                                            SEC617   Wireless Ethical Hacking, Penetration Testing, and Defenses                       32
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        SEC617 Wireless Ethical Hacking,

                                                The SANS Promise
                                                                                                                                                                                                                                                                                       GCIH - Certified Incident Handler
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               Penetration Testing, and Defences - GAWN

                                                                                                                                                                                                                                                                                                                                                                                  Incident Response
                                                                                                                                                                                                                                                                                                                                                                                  and Enterprise Forensics                                                                                          Digital Forensics & Incident Response                                                     Software Security
                                                                                                                                                                                                                                                                                                                                                                                                 Advanced Digital Forensics,                                                                            FOR500 Windows Forensic Analysis - GCFE                                                  DEV522 Defending Web Applications
                                                                                                                                                                                                                                                                                                                                                                                    FOR          Incident Response, and Threat Hunting
                                                                                                                                                                                                                                                                                                                                                                                    508          GCFA - Forensic Analyst                                                                                FOR518 Mac Forensic Analysis                                                                    Security Essentials - GWEB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        FOR526 Memory Forensics In-Depth                                                         DEV541 Secure Coding in Java/JEE: Developing
                                                                                                                                                                                                                                                                                       You will be responsible for                                                                               Advanced Network Forensics                                                                                                                                                                             Defensible Applications - GSSP-JAVA
                                                                                                                                                                                                                                                                              1B       managing security teams or                                                                   FOR          and Analysis                                                                                           FOR578 Cyber Threat Intelligence
                                                                                                                                                                                                                                                                                       implementations, but do not                                                                  572                                                                                                                                                                                                          DEV544 Secure Coding in .NET: Developing
                                                                                                                                                                                                                                                                                                                                                                                                 GNFA - Network Forensic Analyst                                                                        FOR585 Advanced Smartphone Forensics - GASF                                                     Defensible Applications - GSSP-.NET

SANS Instructors are, first and foremost,       At the heart of everything we do is the SANS   SANS training strengthens a student’s ability    SEC642   Advanced Web App Penetration Testing, Ethical Hacking, and Exploitation Tech...   33
                                                                                                                                                                                                                                                                                       require hands-on skills                                                                                                                                                                                          FOR610 Reverse-Engineering Malware: Malware
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               Analysis Tools and Techniques - GREM

                                                                                                                                                                                                                                                                             Security Management
                                                                                                                                                                                                                                                                                       Securing The Human: How to Build, Maintain                                                                                                                                                                   Management                                                                                Audit / Legal
                                                                                                                                                                                                                                                                              MGT      & Measure a High-Impact Awareness Program
                                                                                                                                                                                                                                                                              433      Security Leadership                                                                                                                                                                                                                                                                                       AUD507 Auditing & Monitoring Networks,
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        MGT514 IT Security Strategic Planning,
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               Policy and Leadership                                                                    Perimeters & Systems - GSNA
                                                                                                                                                                                                                                                                                       SANS Security Leadership Essentials
                                                                                                                                                                                                                                                                              MGT      For Managers (with Knowledge Compression™)                                                                                                                                                                       MGT525 IT Project Management, Effective                                                  SEC566 Implementing and Auditing the
                                                                                                                                                                                                                                                                              512      GSLC - Security Leadership                                                                                                                                                                                              Communication, & PMP® Exam Prep - GCPM                                                   Critical Security Controls - In-Depth - GCCC

industry professionals with a wealth of         Promise: Students will be able to deploy the   to achieve a GIAC certification, with both       SEC660   Advanced Penetration Testing, Exploit Writing, and Ethical Hacking                34
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 LEG523 Law of Data Security & Investigations - GLEG
                                                                                                                                                                                                                                                                                       Implementing and Auditing
                                                                                                                                                                                                                                                                              SEC      the Critical Security Controls - In-Depth
                                                                                                                                                                                                                                                                              566      GCCC - Critical Security Controls

real-world experience – experience that they    new skills they’ve learned immediately.        SANS and GIAC placing an emphasis on             SEC760   Advanced Exploit Development for Penetration Testers                              35         Are you planning your next
bring into the classroom.                                                                      learning practical skills.                                                                                                                             course or career move? Turn to
                                                The global community                                                                            SANS Forensics and Incident Response Courses                                                          page 4 for our Career Roadmap
Across our roster of Instructors are many       SANS Institute is a prominent member of        How to register for SANS training                FOR500   Windows Forensic Analysis                                                         36         and see where SANS training
active security practitioners who work for      the global cyber security community. We        SANS runs public training events globally,       FOR508   Advanced Digital Forensics, Incident Response, and Threat Hunting                 37         could take you.
high profile organisations. The list includes   operate the Internet Storm Centre – the        including multiple events across Europe          FOR518   Mac Forensic Analysis                                                             38
red team leaders, information warfare           internet’s early warning system.               and the Middle East, offering students the       FOR526   Memory Forensics In-Depth                                                         39
officers, technical directors, CISOs, and                                                      opportunity to take a SANS course across an      FOR572   Advanced Network Forensics and Analysis                                           40
research fellows.                               SANS also develops, maintains, and             intensive 5 or 6 days.                           FOR578   Cyber Threat Intelligence                                                         41         SANS
                                                publishes a large collection of research                                                        FOR585   Advanced Smartphone Forensics                                                     42   8     Courses
Along with respected technical credentials,     papers about many aspects of information       SANS training events provide the perfect         FOR610   Reverse-Engineering Malware: Malware Analysis Tools and Techniques                43             SEC
                                                                                                                                                                                                                                                          301

                                                                                                                                                                                                                                                          CORE
                                                                                                                                                                                                                                                                      Intro to
                                                                                                                                                                                                                                                                      Information Security
                                                                                                                                                                                                                                                                      PA G E 1 4

                                                                                                                                                                                                                                                                      Security Essentials
                                                                                                                                                                                                                                                                                                                           SANS Cyber
                                                                                                                                                                                                                                                                                                                           Defence Courses
                                                                                                                                                                                                                                                                                                                           Learn the hands-on, practical skills needed
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                SEC
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                542
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           Web App Penetration
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           Testing and Ethical
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           Hacking
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           PA G E 2 6

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           Active Defense, Offensive
                                                                                                                                                                                                                                                          SEC         Bootcamp Style                                       to defend and protect networks, people, and                                                                                                                                                                                                                                          SEC                        Countermeasures, and

SANS Instructors are also expert teachers.      security. These papers are made available      learning environment and offer the chance
                                                                                                                                                                                                                                                          401         PA G E 1 5                                                                                                                                                                                                                                                                                                                                550                        Cyber Deception
                                                                                                                                                                                                                                                                                                                           infrastructure.                                                                                                                                                                                                                                                                                                 PA G E 2 7

                                                                                                                                                                                                                                                                      Advanced Security                                    SANS Cyber Defence curriculum teaches the            Equipped to defend                                                                                                                                                                                                                                         Advanced Penetration
                                                                                                                                                                                                                                                          SEC         Essentials – Enterprise                              cyber security skills necessary to prevent,          SANS training is hands-on. Rather than just                                                                                                                                                                                     SEC                        Testing, Exploit Writing,
                                                                                                                                                                                                                                                          501         Defender                                             detect, and respond to digital threats.              sharing well-known theories, SANS courses                                                                                                                                                                                       660                        and Ethical Hacking
                                                                                                                                                                                                                                                                      PA G E 1 6                                           Two sub curricula comprise the full Cyber            place an emphasis on opening a command                                                                                                                                                                                                                     PA G E 2 8
                                                                                                                                                                                                                                                                                                                           Defence Curriculum: Core Security and                line prompt and working through an attack

                                                                                                                                                SANS Management and Audit Courses
                                                                                                                                                                                                                                                                      Intrusion Detection                                  Network and Security Operations.                     or defence situation.                                                                                                                                                                                                                                      Immersive Hands-on
                                                                                                                                                                                                                                                          SEC         In-Depth                                                                                                                                                                                                                                                                                                                                  SEC                        Hacking Techniques

Their passion for their subject shines          for free.                                      to network with other security professionals,
                                                                                                                                                                                                                                                          503         PA G E 1 7                                           SANS Cyber Defence Curriculum explores               SANS’ success is rooted in the quality of                                                                                                                                                                                       561                        PA G E 2 9
                                                                                                                                                                                                                                                                                                                           how to perform the following core cyber              its people, specifically our Instructors’
                                                                                                                                                                                                                                                                                                                           defence duties:                                      experience.
                                                                                                                                                                                                                                                                      Hacker Tools, Techniques,                                                                                                                                                                                                                                                                                                                                            Automating Information
                                                                                                                                                                                                                                                          SEC         Exploits, and Incident                               •   Detect, prevent and respond to attacks           SANS Instructors are experts in their                                                                                                                                                                                           SEC                        Security for Python
                                                                                                                                                                                                                                                          504
                                                                                                                                                                                                                                                                                                                                                                                                                                                                         SANS Penetration                                                                                                                       573
                                                                                                                                                                                                                                                                      Handling                                             •   Design and build secure business                 respective fields. They are security                                                                                                                                                                                                                       PA G E 3 0
                                                                                                                                                                                                                                                                      PA G E 1 8                                               procedures                                       practitioners who work on the frontline.

                                                                                                                                                                                                                                                          SEC
                                                                                                                                                                                                                                                                      Securing Windows and
                                                                                                                                                                                                                                                                      PowerShell Automation
                                                                                                                                                                                                                                                                                                                           •   Identify, assess, and remediate
                                                                                                                                                                                                                                                                                                                               exposures in existing networks
                                                                                                                                                                                                                                                                                                                                                                                They’re acquainted with the dominant
                                                                                                                                                                                                                                                                                                                                                                                threats organisations face, and understand                                               Testing & Vulnerability                                                                                                                SEC
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           Mobile Device Security
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           and Ethical Hacking

                                                                                                                                                                                                                                                                                                                                                                                                                                                                         Courses
                                                                                                                                                                                                                                                                                                                           •   Model a threat and plan a defence                the prevailing defences.

through, making the SANS classroom                                                                                                              SEC566   Implementing and Auditing the Critical Security Controls In-Depth                 44
                                                                                                                                                                                                                                                          505                                                                                                                                                                                                                                                                                                                                                   575

                                                                                               as well as SANS Instructors and staff.
                                                                                                                                                                                                                                                                      PA G E 1 9                                           •   Communicate a cyber attack - and its                                                                                                                                                                                                                                                                        PA G E 31
                                                                                                                                                                                                                                                                                                                               ramifications - to managers                      SANS also equips students with a wealth of
                                                                                                                                                                                                                                                                                                                           •   Build security solutions that are scalable       supplementary learning resources. Students                                               Hands-on penetration testing security training
                                                                                                                                                                                                                                                                      Securing                                             •   Secure and protect an organisation’s             are, for example, provided with a library of                                             that teaches how to think, work and attack like                                                                                                                   Wireless Ethical Hacking,
                                                                                                                                                                                                                                                          SEC         Linux/Unix                                               intellectual property                            textbooks. The books are created by the same                                                                                                                                                                                    SEC                        Penetration Testing, and
                                                                                                                                                                                                                                                          506         PA G E 2 0                                                                                                experts who created the course they support.
                                                                                                                                                                                                                                                                                                                                                                                                                                                                         a hacker.                                                                                                                              617                        Defenses
                                                                                                                                                                                                                                                                                                                           SANS Cyber Defence Curriculum teaches all            We also provide students with posters, cheat                                                                                                                                                                                                               PA G E 3 2
                                                                                                                                                                                                                                                                                                                           of these skills, and more.                           sheets and software tool kits. All of our                                                SANS Pen Test courses focus on equipping                        Real World Experience
                                                                                                                                                                                                                                                                      Continuous Monitoring                                                                                     training content is updated regularly.                                                   students with the technical skills, knowledge                   SANS Penetration Testing Instructors bring                                                        Advanced Web App
                                                                                                                                                                                                                                                          SEC         and Security Operations                                                                                                                                                                            and tools they need to make a difference, as                    expert technical and industrial experience                             SEC                        Penetration Testing, Ethical
                                                                                                                                                                                                                                                          511                                                                                                                                                                                                                                                                                                                                                                              Hacking, and Exploitation

                                                                                                                                                MGT414   SANS Training Program for CISSP® Certification                                    45
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                642

efficient and effective.                        The GIAC Advantage
                                                                                                                                                                                                                                                                      PA G E 21                                            “This was the best and                               “I got a real insight                                                                    soon as they get back to the office.                            into the classroom. Many Instructors
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           Techniques
                                                                                                                                                                                                                                                                                                                           most well-presented                                  into the mind of the                                                                                                                                     hold prominent positions in high-profile,
                                                                                                                                                                                                                                                                                                                           course I ever attended.”                             adversary.”                                                                              SANS Pen Test training is hands on.                             global organisations. Others run pen test                                                         PA G E 3 3
                                                                                                                                                                                                                                                                      Cloud Security                                       London                                               London                                                                                   Students can expect in-depth lab exercises,                     consultancies and work with prominent
                                                                                                                                                                                                                                                          SEC         Architecture                                         SEC401                                               SEC401                                                                                   simulations, cryptographic challenges and                       businesses. SANS Instructors bring this                                                           Advanced Penetration
                                                                                                                                                                                                                                                          545         and Operations                                                                                                                                                                                     war games.                                                      experience into the classroom.                                         SEC                        Testing, Exploit Writing,
                                                                                                                                                                                                                                                                      PA G E 2 2                                                                                                                                                                                                                                                                                                                                660                        and Ethical Hacking
                                                                                                                                                                                                                                                                                                                                                                                                                                                                         At the heart of our penetration testing                                                                                                                           PA G E 3 4
                                                                                                                                                                                                                                                                      SIEM with                                                                                                                                                                                          training curriculum is a belief in high-value
                                                                                                                                                                                                                                                          SEC         Tactical Analytics                                                                                                                                                                                 testing. This encompasses:                                                                                                                                        Advanced Exploit
                                                                                                                                                                                                                                                          555                                                                                                                                                                                                                                                                                                                                                   SEC                        Development for

                                                                                                                                                MGT433   Securing The Human: How to build, maintain, and measure
                                                                                                                                                                                                                                                                      PA G E 2 3

                                                GIAC validates the skills of information       Students should register online by visiting
                                                                                                                                                                                                                                                                                                                                                                                                                                                                         •     Modelling the activities of real-world                                                                                           760                        Penetration Testers
                                                                                                                                                                                                                                                                                                                                                                                                                                                                               attackers.                                                                                                                                                  PA G E 3 5
                                                                                                                                                                                                                                                                      Virtualization and                                                                                                                                                                                 •     Finding vulnerabilities in target systems.
                                                                                                                                                                                                                                                          SEC         Software Defined Security                                                                                                                                                                          •     Exploiting them under controlled
                                                                                                                                                                                                                                                          579         PA G E 24                                                                                                                                                                                                circumstances.
                                                                                                                                                                                                                                                                                                                                                                                                                                                                         •     Determining and documenting business
                                                                                                                                                                                                                                                                                                                                                                                                                                                                               risk.                                                        “Overall a well presented
                                                                                                                                                                                                                                                                                                                                                                                                                                                                         •     Applying technical excellence.                               and comprehensive course
                                                                                                                                                                                                                                                                                                                                                                                                                                                                         •     Working in a professional, safe fashion                      that I would recommend to
                                                                                                                                                                                                                                                                                                                                                                                                                                                                               according to a carefully designed scope                      any information security

Cutting edge training                           security professionals, proving that those     www.sans.org/emea                                         a high-impact awareness programme                                                 46
                                                                                                                                                                                                                                                                                                                                                                                                                                                                               and rules of engagement.                                     professional.”
                                                                                                                                                                                                                                                                                                                                                                                                                                                                         •     Helping an organisation prioritise its                       London
                                                                                                                                                                                                                                                                                                                                                                                                                                                                               resources to improve the security stance.                    SEC560

                                                                                                                                                                                                                                                      8    S A N S T R A I N I N G C ATA LO G U E , 2018                                                                                                                                                                                                                                                                                                                    S A N S T R A I N I N G C ATA LO G U E , 2018                      9

Cybercrime evolves constantly. SANS             certified have the technical knowledge                                                          MGT512   SANS Security Leadership Essentials For Managers                                             Are you taking your first
prepares students to meet today’s dominant      necessary to work in key areas of cyber        SANS training can also be delivered                       with Knowledge CompressionTM                                                      47         sans training course? Turn
threats and tomorrow’s challenges.              security.                                      online through our OnDemand product,             MGT514   IT Security Strategic Planning, Policy, and Leadership                            48         to page 8 for our curriculum
                                                                                               as a private class within an organisation,       MGT517   IT Project Management, Effective Communication, and PMP® Exam Prep                49         guides and page 14 onwards
We do this through constantly updating and      GIAC certifications are respected globally     and through other mediums, including             MGT525   IT Project Management, Effective Communication, and PMP® Exam Prep                50         for course descriptions
rewriting our courses and support material.     because they measure specific skill and        classroom training in French, German, Italian    AUD507   Auditing & Monitoring Networks, Perimeters, and Systems                           51
This process is steered by an expert panel      knowledge areas. GIAC offers the only cyber    and Spanish. See page 6 for details of all our   LEG523   Law of Data Security and Investigations                                           52
that draws on the global community’s            security certifications that cover advanced    training delivery options or visit
consensus regarding best practice.              technical subject areas.                       www.sans.org/emea.                               SANS Secure Software Development Courses                                                           Training event
                                                                                                                                                DEV522   Defending Web Applications Security Essentials                                    53   60 schedule at a glance
                                                                                                                                                DEV541   Secure Coding in Java/JEE: Developing Defensible Application                      54                                                                                                                                                                                              Future SANS EMEA Training Events

                                                                                                                                                                                                                                                                                            EMEA
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        For a full list of training events, please visit www.sans.org

                                                                                                                                                DEV544   Secure Coding in .NET: Developing Defensible Applications                         55

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     Management

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          ICS/SCADA
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       Developer
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           Forensics
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Pen Test
                                                                                                                                                                                                                                                                                                                                                                                                     Defence
                                                                                                                                                                                                                                                                                                                                                              6       6        6          6           6        6           6       6       6        6        6        6          6         6         6        6        6        6        6        6                    6    5        6         6       6        5                 6           5         6          5                  5

Contact SANS
                                                                                                                                                                                                                                                                                                                                                             DAYS     DAYS     DAYS       DAYS       DAYS      DAYS     DAYS      DAYS     DAYS     DAYS     DAYS     DAYS      DAYS       DAYS      DAYS     DAYS     DAYS     DAYS     DAYS     DAYS             DAYS     DAYS     DAYS     DAYS     DAYS     DAYS              DAYS        DAYS     DAYS        DAYS           DAYS

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       FOR500

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                FOR508

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       AUD507
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     FOR585

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  MGT514
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  FOR526

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                MGT512
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     SEC660
                                                                                                                                                                                                                                                                                                                                                                                                     SEC504

                                                                                                                                                                                                                                                                                                                                                                                                                                                             SEC560

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              FOR610
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            FOR578

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              SEC566
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         FOR518
                                                                                                                                                                                                                                                                                                                                                                                                                                           SEC599

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       DEV522
                                                                                                                                                                                                                                                                                                                                                                                          SEC503

                                                                                                                                                                                                                                                                                                                                                                                                                        SEC545

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           SEC642

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              SEC760

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   FOR572
                                                                                                                                                                                                                                                                                                                                                                                                                                  SEC555

                                                                                                                                                                                                                                                                                                                                                                                                                                                    SEC542
                                                                                                                                                                                                                                                                                                                                                             SEC301

                                                                                                                                                                                                                                                                                                                                                                      SEC401

                                                                                                                                                                                                                                                                                                                                                                               SEC501

                                                                                                                                                                                                                                                                                                                                                                                                                                                                      SEC575

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                SEC617
                                                                                                                                                                                                                                                                                                                                                                                                               SEC511

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   ICS410

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      ICS515
                                                                                                                                                                                                                                                                 Location                                                           Date
                                                                                                                                                                                                                                                                 Dubai                                                              Jan 27 - Feb 1

                                                                                                                                                                                                                                                                 London                                                             Feb 5 - 10

                                                                                                                                                SANS Industrial Control Systems Courses
                                                                                                                                                                                                                                                                 Brussels                                                           Feb 19 - 24

Email: emea@sans.org
                                                                                                                                                                                                                                                                 Cyber Threat Summit ‘18, London                                    Feb 27 - 28

                                                                                                                                                                                                                                                                 London                                                             Mar 5 - 10

                                                                                                                                                                                                                                                                 Paris                                                              Mar 12 - 17                        F        F

                                                                                                                                                                                                                                                                 Munich                                                             Mar 19 - 24

Tel: +44 20 3384 3470                                                                                                                           ICS410   ICS/SCADA Security Essentials                                                     57
                                                                                                                                                                                                                                                                 Abu Dhabi                                                          Apr 7 - 12

                                                                                                                                                                                                                                                                 Zurich                                                             Apr 16 - 21

                                                                                                                                                                                                                                                                 London                                                             Apr 16 - 21

                                                                                                                                                                                                                                                                 Doha                                                               Apr 23 - May 3

                                                                                                                                                                                                                                                                 Riyadh                                                             Apr 28 - May 3

Address: SANS EMEA,                                                                                                                             ICS456   Essentials for NERC Critical Infrastructure Protection                            58
                                                                                                                                                                                                                                                                 Amsterdam                                                          May 28 - Jun 2

                                                                                                                                                                                                                                                                 London                                                             Jun 4 - 9

                                                                                                                                                                                                                                                                 SANS ICS Europe Summit, Munich                                     Jun 18

                                                                                                                                                                                                                                                                 Munich                                                             Jun 18 - 23

                                                                                                                                                                                                                                                                 Oslo                                                               Jun 18 - 23

PO Box 124, Swansea, SA3 9BB, UK                                                                                                                ICS515   ICS Active Defense and Incident Response                                          59
                                                                                                                                                                                                                                                                 Paris                                                              Jun 25 - 30                                                        F

                                                                                                                                                                                                                                                                 Most courses are also available online, via SANS OnDemand. Contact emea@sans.org for information.                                                                                                             Dates, locations and courses offered subject to change                                                                                                          F = TRAINING IN FRENCH

www.sans.org
                                                           SANS is a Cyber Security
                                                           Supplier to HM Government
                                                                                                                                                                                                                                                S A N S T R A I N I N G C ATA LO G U E , 2018                                                                                                                                                                                                                                                                                                                                                                                                      3
Training Catalogue 2018 - SANS.org
Training Roadmap

                                                                                                                                                                                                                                                                       EMEA
                         Choose your path

                    CORE                                                               INTERMEDIATE                                       ADVANCED/SPECIALISED

                    New to cyber security?
                              Intro to Information                                                                                                 You are a candidate            SANS’ comprehensive curriculum enables professionals to deepen their technical
                    SEC       Security                                                                                                                                            skills in key practice areas. It also directly addresses software developers, industrial
                    301                                                                                                                            for specialised or
                              GISF Certification - Information Security Fundamentals                                                      3        advanced training              control engineers, and non-technical personnel in management, legal, and audit.

                                                                                              You are experienced in security,
                                                                                              preparing for a specialised job             Cyber Defence Operations                                        Industrial Control Systems Security
                              You are experienced in                                   2      role or focus                                   SEC501 Advanced Security Essentials                             ICS410 ICS/SCADA Security Essentials - GICSP
                    1A        technology, but need to learn                                                                                          Enterprise Defender - GCED
                              hands-on, essential security                                                                                                                                                    ICS456 Essentials for NERC Critical
                                                                                                                                              SEC505 Securing Windows and                                            Infrastructure Protection
                              skills and techniques                                    Security Monitoring & Detection                               PowerShell Automation - GCWN                             ICS515 ICS Active Defence
                                                                                             Intrusion Detection                              SEC506 Securing Linux/Unix - GCUX                                      and Incident Response - GRID
                                                                                       SEC   In-depth                                         SEC566 Implementing and Auditing the Critical
                    Core Security Techniques                                           401   GCIA - Certified Intrusion Analyst                      Security Controls - In-Depth - GCCC
                    Defend & Maintain                                                        Continuous Monitoring                            SEC579 Virtualization and Private Cloud Security
                                                                                       SEC   and Security Operations                          SEC599 Defeating Advanced Adversaries -
                    The defence-in-depth techniques taught in SEC401 are               511   GMON - Continuation Monitoring                          Implementing Kill Chain Defences
                    essential for every security professional. SEC504 provides
                    additional “offence informs defence” knowledge, teaching
                    defence specialists how attacks occur and how to
                    respond. Students with existing core defence skills could          Penetration Testing                                Penetration Testing and Ethical Hacking
                    begin their training journey with SEC504.
                                                                                       and Vulnerability Analysis
                                                                                                                                              SEC550 Active Defence, Offensive Countermeasures                SEC642 Advanced Web App Penetration Testing
                                                                                             Network Penetration Testing                             and Cyber Deception                                             and Ethical Hacking
                              Security Essentials                                      SEC   and Ethical Hacking
                    SEC       Bootcamp Style                                                                                                  SEC561 Immersive Hands-On Hacking Techniques                    SEC660 Advanced Penetration Testing,
                    401                                                                560   GPEN - Penetration Tester                                                                                               Exploit Writing, and Ethical Hacking - GXPN
                              GSEC - Security Essentials                                                                                      SEC573 Python for Penetration Testers - GPYC
                                                                                             Web App Penetration Testing                      SEC575 Mobile Device Security                                   SEC760 Advanced Exploit Development
                              Hacker Tools, Techniques,                                SEC   and Ethical Hacking                                     and Ethical Hacking - GMOB                                      for Penetration Testers
                    SEC       Exploits, and Incident Handling                          542   GWAPT - Web Application Penetration Tester
                    504       GCIH - Certified Incident Handler                                                                               SEC617 Wireless Ethical Hacking,
                                                                                                                                                     Penetration Testing, and Defences - GAWN

                                                                                       Incident Response
                                                                                       and Enterprise Forensics                           Digital Forensics & Incident Response                            Software Security
                                                                                             Advanced Digital Forensics,                      FOR500   Windows Forensic Analysis - GCFE                       DEV522 Defending Web Applications
                                                                                       FOR   Incident Response, and Threat Hunting
                                                                                       508   GCFA - Forensic Analyst                          FOR518   Mac Forensic Analysis                                         Security Essentials - GWEB
                                                                                                                                              FOR526   Memory Forensics In-Depth                              DEV541 Secure Coding in Java/JEE: Developing
                              You will be responsible for                                    Advanced Network Forensics                                                                                              Defensible Applications - GSSP-JAVA
                    1B        managing security teams or                               FOR   and Analysis                                     FOR578   Cyber Threat Intelligence
                              implementations, but do not                              572                                                                                                                    DEV544 Secure Coding in .NET: Developing
                                                                                             GNFA - Network Forensic Analyst                  FOR585   Advanced Smartphone Forensics - GASF                          Defensible Applications - GSSP-.NET
                              require hands-on skills                                                                                         FOR610   Reverse-Engineering Malware: Malware
                                                                                                                                                       Analysis Tools and Techniques - GREM

                    Security Management
                              Securing The Human: How to Build, Maintain                                                                  Management                                                       Audit / Legal
                    MGT       & Measure a High-Impact Awareness Program
                    433       Security Leadership                                                                                                                                                             AUD507 Auditing & Monitoring Networks,
                                                                                                                                              MGT514 IT Security Strategic Planning,
                                                                                                                                                     Policy and Leadership                                           Perimeters & Systems - GSNA
                              SANS Security Leadership Essentials
                    MGT       For Managers (with Knowledge Compression™)                                                                      MGT525 IT Project Management, Effective                         SEC566 Implementing and Auditing the
                    512       GSLC - Security Leadership                                                                                             Communication, & PMP® Exam Prep - GCPM                          Critical Security Controls - In-Depth - GCCC
                                                                                                                                                                                                              LEG523 Law of Data Security & Investigations - GLEG
                              Implementing and Auditing
                    SEC       the Critical Security Controls - In-Depth
                    566       GCCC - Critical Security Controls

4   S A N S T R A I N I N G C ATA LO G U E , 2018                                                                                                                                                                                S A N S T R A I N I N G C ATA LO G U E , 2018   5
SANS Training Formats                                                                                   SANS high standards remain constant across all training delivery options, and all
                                                                                                            our classes adhere to The SANS Promise - that you will learn skills and techniques
                                                                                                                         that can be put to work immediately upon returning to the workplace.
      Established in 1989, SANS is the world’s largest and most trusted source of cyber security training

     SANS Training Events                                                                                                                                                           SANS On-Demand
     Instruction in a classroom setting from a qualified                                                                                                     SANS courses available anytime via E-learning. Includes
     SANS Instructor. These are multi-course events located                                                                                                     course books, CD/DVDs / Toolkits, as applicable, and
     centrally in major cities and hosted at quality hotels or                                                                                                    four months of online access to SANS’ OnDemand
     event centres with excellent facilities.                                                                                                                e-learning platform. For students who wish to study on
                                                                                                                                                                                         their own at their own pace.
     Training Events are a popular method for taking SANS                                                                                                                                  www.sans.org/ondemand
     training as they provide an opportunity to learn, network,
     and socialise with peers, colleagues, and SANS staff.

     Training fees also include break refreshments, lunch,                                                                                                                  SANS Private Training
     and evening functions (where advertised), but not                                                                                                        Training delivered directly to an organisation’s security
     accommodation.                                                                                                                                          team in a classroom setting at the employer’s premises
                                                                                                                                                                     or training facility. Private training is suitable for
     2017 EMEA region Training Events take place across                                                                                                      organisations that need to train 25 or more staff and/or
     Europe and the Gulf Region. Courses at Training Events                                                                                                       require an entirely confidential training experience.
     are led in English, French, German, Italian and Spanish.                                                                                                Private training allows a SANS Instructor to concentrate
                                                                                                                                                                   on areas directly relevant to that organisation and
     See the back cover of this brochure or                                                                                                                          provides financial advantages across staff travel,
     www.sans.org/emea for the latest schedule                                                                                                                                      subsistence, and accommodation.

                                                                                                                                                                                 Contact SANS for further information:
                                                                                                                                                                                                     emea@sans.org
     SANS
     Summits
     Summits are one- or two-day events that take the                                                                                                           Bespoke Training Solutions
     form of keynote speeches and panel sessions, led by                                                                                                              and Cyber Academy
     respected thought-leaders and industry practitioners.
                                                                                                                                                            SANS creates bespoke training programmes that answer
     A SANS Summit is an invaluable source of targeted                                                                                                       specific operational and organisational needs. Training
     learning and typically takes place before or after a SANS                                                                                                  content is drawn from across SANS’ Curriculum, and
     Training Event with attendance available at a discounted                                                                                                  programmes often include assessment phases using
     rate for those attending training.                                                                                                                                                           SANS CyberTalent.

                                                                                                                                                                SANS Cyber Academy identifies candidates with the
                                                                                                                                                               potential to succeed, then provides intensive training
     SANS Security                                                                                                                                            before deploying them as GIAC Certified professionals.
     Awareness Training
                                                                                                                                                                     To find out more about SANS partnerships email
     SANS’ Securing The Human provides computer-based                                                                                                                                              emea@sans.org
     security awareness training for end users, ICS engineers,
     developers, and the utilities and healthcare industries.
     Modular videos deliver expert and impactful training to
     large numbers of employees, with measurable results.                                                                                                                               SANS Residency
     STH goes beyond compliance and focuseson changing                                                                                                      A tailored programme of training for organisations that may
     behaviour.                                                                                                                                              require several courses to be run in succession, in order to
                                                                                                                                                                   quickly train large existing teams and/or new recruits.
     www.securingthehuman.org
                                                                                                                                                                                 Contact SANS for further information:
                                                                                                                                                                                                     emea@sans.org

6   S A N S T R A I N I N G C ATA LO G U E , 2018                                                                                                                               S A N S T R A I N I N G C ATA LO G U E , 2018   7
SEC
                Intro to
                Information Security                 SANS Cyber                                                                                                                                                                                    SEC
                                                                                                                                                                                                                                                              Web App Penetration
                                                                                                                                                                                                                                                              Testing and Ethical
                                                                                                                                                                                                                                                              Hacking
                                                     Defence Courses
    301         PA G E 1 4                                                                                                                                                                                                                         542
                                                                                                                                                                                                                                                              PA G E 2 6

    CORE        Security Essentials                  Learn the hands-on, practical skills needed                                                                                                                                                              Active Defense, Offensive
    SEC         Bootcamp Style                       to defend and protect networks, people, and                                                                                                                                                   SEC        Countermeasures, and
    401         PA G E 1 5                                                                                                                                                                                                                         550        Cyber Deception
                                                     infrastructure.                                                                                                                                                                                          PA G E 2 7

                Advanced Security                    SANS Cyber Defence curriculum teaches the        Equipped to defend                                                                                                                                      Advanced Penetration
    SEC         Essentials – Enterprise              cyber security skills necessary to prevent,      SANS training is hands-on. Rather than just                                                                                                  SEC        Testing, Exploit Writing,
    501         Defender                             detect, and respond to digital threats.          sharing well-known theories, SANS courses                                                                                                    660        and Ethical Hacking
                PA G E 1 6                           Two sub curricula comprise the full Cyber        place an emphasis on opening a command                                                                                                                  PA G E 2 8
                                                     Defence Curriculum: Core Security and            line prompt and working through an attack
                Intrusion Detection                  Network and Security Operations.                 or defence situation.                                                                                                                                   Immersive Hands-on
    SEC         In-Depth                                                                                                                                                                                                                           SEC        Hacking Techniques
    503         PA G E 1 7                           SANS Cyber Defence Curriculum explores           SANS’ success is rooted in the quality of                                                                                                    561        PA G E 2 9
                                                     how to perform the following core cyber          its people, specifically our Instructors’
                                                     defence duties:                                  experience.
                Hacker Tools, Techniques,                                                                                                                                                                                                                     Automating Information
    SEC         Exploits, and Incident               •   Detect, prevent and respond to attacks       SANS Instructors are experts in their                                                                                                        SEC        Security for Python
    504
                                                                                                                                                     SANS Penetration                                                                              573
                Handling                             •   Design and build secure business             respective fields. They are security                                                                                                                    PA G E 3 0
                PA G E 1 8                               procedures                                   practitioners who work on the frontline.

    SEC
                Securing Windows and
                PowerShell Automation
                                                     •   Identify, assess, and remediate
                                                         exposures in existing networks
                                                                                                      They’re acquainted with the dominant
                                                                                                      threats organisations face, and understand     Testing & Vulnerability                                                                       SEC
                                                                                                                                                                                                                                                              Mobile Device Security
                                                                                                                                                                                                                                                              and Ethical Hacking

                                                                                                                                                     Courses
                                                     •   Model a threat and plan a defence            the prevailing defences.
    505         PA G E 1 9                           •   Communicate a cyber attack - and its                                                                                                                                                      575        PA G E 31
                                                         ramifications - to managers                  SANS also equips students with a wealth of
                                                     •   Build security solutions that are scalable   supplementary learning resources. Students     Hands-on penetration testing security training
                Securing                             •   Secure and protect an organisation’s         are, for example, provided with a library of   that teaches how to think, work and attack like                                                          Wireless Ethical Hacking,
    SEC         Linux/Unix                               intellectual property                        textbooks. The books are created by the same                                                                                                 SEC        Penetration Testing, and
    506         PA G E 2 0                                                                            experts who created the course they support.
                                                                                                                                                     a hacker.                                                                                     617        Defenses
                                                     SANS Cyber Defence Curriculum teaches all        We also provide students with posters, cheat                                                                                                            PA G E 3 2
                                                     of these skills, and more.                       sheets and software tool kits. All of our      SANS Pen Test courses focus on equipping         Real World Experience
                Continuous Monitoring                                                                 training content is updated regularly.         students with the technical skills, knowledge    SANS Penetration Testing Instructors bring              Advanced Web App
    SEC         and Security Operations                                                                                                              and tools they need to make a difference, as     expert technical and industrial experience   SEC        Penetration Testing, Ethical
    511         PA G E 21                            “This was the best and                           “I got a real insight                          soon as they get back to the office.             into the classroom. Many Instructors         642        Hacking, and Exploitation
                                                                                                                                                                                                                                                              Techniques
                                                     most well-presented                              into the mind of the                                                                            hold prominent positions in high-profile,
                                                     course I ever attended.”                         adversary.”                                    SANS Pen Test training is hands on.              global organisations. Others run pen test               PA G E 3 3
                Cloud Security                       London                                           London                                         Students can expect in-depth lab exercises,      consultancies and work with prominent
    SEC         Architecture                         SEC401                                           SEC401                                         simulations, cryptographic challenges and        businesses. SANS Instructors bring this                 Advanced Penetration
    545         and Operations                                                                                                                       war games.                                       experience into the classroom.               SEC        Testing, Exploit Writing,
                PA G E 2 2                                                                                                                                                                                                                         660        and Ethical Hacking
                                                                                                                                                     At the heart of our penetration testing                                                                  PA G E 3 4
                SIEM with                                                                                                                            training curriculum is a belief in high-value
    SEC         Tactical Analytics                                                                                                                   testing. This encompasses:                                                                               Advanced Exploit
    555         PA G E 2 3                                                                                                                                                                                                                         SEC        Development for
                                                                                                                                                     •   Modelling the activities of real-world                                                    760        Penetration Testers
                                                                                                                                                         attackers.                                                                                           PA G E 3 5
                Virtualization and                                                                                                                   •   Finding vulnerabilities in target systems.
    SEC         Software Defined Security                                                                                                            •   Exploiting them under controlled
    579         PA G E 24                                                                                                                                circumstances.
                                                                                                                                                     •   Determining and documenting business
                                                                                                                                                         risk.                                         “Overall a well presented
                                                                                                                                                     •   Applying technical excellence.                and comprehensive course
                                                                                                                                                     •   Working in a professional, safe fashion       that I would recommend to
                                                                                                                                                         according to a carefully designed scope       any information security
                                                                                                                                                         and rules of engagement.                      professional.”
                                                                                                                                                     •   Helping an organisation prioritise its        London
                                                                                                                                                         resources to improve the security stance.     SEC560

8    S A N S T R A I N I N G C ATA LO G U E , 2018                                                                                                                                                                                                       S A N S T R A I N I N G C ATA LO G U E , 2018   9
“Valuable course for engineers, IT          “I think IT Security personnel                           ICS/SCADA
                                                                                                                                                       and physical security consultants           and engineers from any                        ICS        Security Essentials
                                                                                                                                                       for Industrial Control Systems.”            company using ICS should                      410        PA G E 57
                                                                                                                                                       London                                      attend this course.”
                                                                                                                                                       ICS410                                      London
                                                                                                                                                                                                   ICS410                                                   Essentials for NERC Critical
                                                                                                                                                                                                                                                 ICS        Infrastructure Protection
                                                                                                                                                                                                                                                 456        PA G E 5 8

                                                                                                                                                                                                                                                            ICS Active Defense
                                                                                                                                                                                                                                                 ICS        and Incident Response
                                                                                                                                                                                                                                                 515        PA G E 59

                                                                                                                                                       SANS Industrial Control
                                                                                                                                                       Systems Courses
                                                                                                                                                       Learn the skills and knowledge needed to defend
                                                                                                                                                       industrial control systems from cyber attack.

       FOR
       500
                    Windows Forensic
                    Analysis                         SANS Forensics and                                                                                SANS ICS Curriculum has been created
                                                                                                                                                       to assist two groups of professionals:
                                                                                                                                                                                                   SANS ICS training provides:
                                                                                                                                                                                                   • Real world training – A panel of experts

                                                     Incident Response
                    PA G E 3 6                                                                                                                         Control system engineers who need to           with an intimate understanding of ICS
                                                                                                                                                       learn more about security best practice        cyber security and SCADA principles

                                                     Courses
                                                                                                                                                       and securing their infrastructure, and IT      create course content.
                    Advanced Digital                                                                                                                   security practitioners who need a clearer   • Training for engineers – Specialised
       FOR          Forensics, Incident                                                                                                                understanding of ICS’ key technologies.        training is designed to help engineers
       508          Response, and Threat             Hands-on and intensive digital forensics and incident                                                                                            understand security.
                    Hunting
                                                     response training delivered by acknowledged security                                              SANS ICS training curriculum is hands-      • Training for security professionals –
                    PA G E 3 7                                                                                                                         on. Courses feature many live lab based        Training helps security staff understand
                                                     and forensics experts.                                                                            exercises and simulations. Students can,       SCADA security and embedded systems,
                    Mac Forensic                                                                                                                       for example, gain experience of network        their functions and their limitations.
       FOR          Analysis                         SANS Digital Forensic and Incident Response      blog, speak, and contribute to the global        capture forensics, spoofing Modbus-TCP      • Courses led by experts – Training classes
       518          PA G E 3 8                       curriculum (DFIR) helps organisations            consensus.                                       control signals, and finding passwords in      are taught by respected experts in
                                                     investigate and respond effectively to IT                                                         EEPROM dumps.                                  the ICS field.
                                                     security breaches.                               Along with their technical credentials, our                                                  • Extensive courseware –ICS students are
                    Memory Forensics                                                                  DFIR Instructors are skilled teachers. They                                                     equipped with a library of textbooks and
       FOR          In-Depth                         SANS DFIR Curriculum offers a great deal of      understand how to get the best from their                                                       extra material.
       526          PA G E 3 9                       scope for specialisation. SANS offers courses    students.
                                                     that hone in on Windows, smartphone,
                                                     Apple operating systems, network and             SANS supplies students with courseware
                    Advanced Network                 memory forensics, and more.                      and supplementary resources. We provide
       FOR          Forensics and Analysis                                                            every student with a library of textbooks that
       572          PA G E 4 0                       SANS DFIR Curriculum helps organisations         relate directly to the course – books that are
                                                     deploy the correct responses - responses         written by the course’s author.
                                                     designed to minimise financial and
                    Cyber Threat                     reputation loss, and to help businesses          SANS also supplies students with licences
       FOR          Intelligence                     recover strongly from an attack.                 for software tools explored in class. This
       578          PA G E 41                                                                         means students can deploy the skills
                                                     Resources                                        they’ve learned as soon as they get back
                                                     SANS DFIR Instructors are industry               to their desk.
                    Advanced                         practitioners who spend the majority of their
       FOR          Smartphone                       professional lives working on security’s front
       585          Forensics                        line. They bring this real-world experience      “Intense, nothing can prepare
                    PA G E 42                        into the classroom.                              you for learning from a true
                                                                                                      master of their art.”
                    Reverse-Engineering              Many SANS Instructors are prominent              London
       FOR          Malware: Malware                 members of the DFIR community. They write,       FOR508
       610          Analysis Tools and
                    Techniques
                    PA G E 43

10   S A N S T R A I N I N G C ATA LO G U E , 2018                                                                                                                                                                                                     S A N S T R A I N I N G C ATA LO G U E , 2018   11
CORE   Implementing and           “This course is excellent as it                                                                “A very knowledgeable instructor                                                                            Defending Web Applications
SEC    Auditing the Critical      covers most of the technical                                                                   who demonstrates very well the                                                                  DEV         Security Essentials
566    Security Controls          auditing techniques and tools                                                                  issues and solutions in modern                                                                  522         PA G E 5 3
       In-Depth
                                  used for the auditing.”                                                                        web apps security.”
       PA G E 4 4                 Dubai UAE                                                                                      London
                                  AUD507                                                                                         DEV522                                                                                                      Secure Coding in Java/JEE:
       SANS Training Program                                                                                                                                                                                                     DEV         Developing Defensible
MGT    for SS      ertification                                                                                                                                                                                                  541         Application
414    PA G E 4 5                                                                                                                                                                                                                            PA G E 5 4

                                                                                                                                                                                                                                             Secure Coding in .NET:

MGT
433
       Securing The Human: How
       to build, maintain, and
       measure a high-impact
                                  SANS Management                                                                                SANS Secure Software                                                                            DEV
                                                                                                                                                                                                                                 544
                                                                                                                                                                                                                                             Developing Defensible
                                                                                                                                                                                                                                             Applications

                                  and Audit Courses                                                                              Development Courses                                                                                         PA G E 5 5
       awareness programme
       PA G E 4 6

CORE   SANS Security Leadership   Hands-on training designed to equip advancing                                                  Placing secure software development practice
MGT    Essentials For Managers    managers and auditors with the skills needed to                                                and principles at its heart, sans teaches how to
512    with Knowledge
       CompressionTM              build the right policies and processes, and to make                                            architect defensible applications.
       PA G E 47                  the best IT security decisions.
       IT Security Strategic
MGT    Planning, Policy, and      SANS Management Curriculum teaches              Training For Security Managers                 SANS Secure Software Development courses        Architect Securely
514    Leadership                 students how to manage security. Courses        Two SANS Management Courses that run           are built with two outcomes in mind: firstly,   SANS Secure Software Development is
       PA G E 4 8                 are ideal for newly appointed information       at Training Events in the EMEA region are      to equip programmers with the skills and        designed to foster safety by design. Our
                                  security officers, skilled administrators who   ‘MGT433: Securing the Human – How to           knowledge to write secure code; secondly,       developer security training courses teach
       IT Project Management,     are stepping up to a management role, and       Build, Maintain, and Measure a High-Impact     alumni are able to recognise the security       students to:
MGT    Effective Communication,   seasoned managers who find themselves           Awareness Program’, and ‘MGT512: SANS          shortcomings in existing code.
517    and PMP® Exam Prep         managing technical people.                      Security Leadership Essentials for Managers                                                    •   Build securely – Our courses teach
       PA G E 49                                                                  with Knowledge Compression™.                   The SANS Secure Software Development                development’s defining security
                                  Training for IT Security Auditors                                                              Curriculum covers secure coding across C            principles.
       IT Project Management,     SANS Audit training equips students to audit    MGT512 is a hands-on course designed to        and C#, .NET, Java/JEE and web applications.    •   Hunt for flaws – Learn to find security
MGT    Effective Communication,   many business critical technologies such        impart the skills and knowledge necessary      We also offer deep-dive courses that focus          issues in existing code.
525    and PMP® Exam Prep         as applications, databases, networks and        to lead a project or product’s security        on developing and architecting defensible       •   Secure across different languages –
       PA G E 5 0                 perimeter defences. Our curriculum teaches      components.                                    applications.                                       Courses address .NET, C & C++, JAVA/JEE.
                                  risk-based methodologies that yield far                                                                                                        •   Stay current - SANS Software Security
       Auditing & Monitoring      better enterprise security.                     The course empowers managers and               Organisations looking to further enhance            Curriculum exemplifies our drive to stay
AUD    Networks, Perimeters,                                                      auditors to speak the same language as         their software and product security can also        one step ahead of criminals.
507    and Systems                SANS Audit training also teaches the            technical staff, including system, security,   access SANS’ penetration testing curriculum.    •   Engineer with security in mind – SANS
       PA G E 51                  practical skills and techniques needed to       and network administrators.                    Specifically, SANS offers a course designed         Instructors are real-word practitioners
                                  perform a comprehensive IT audit. With                                                         to teach web application pen testing.               who specialise in architecting defensible
       Law of Data Security       a hands-on approach to training, SANS           MGT433 focusses on helping managers to                                                             applications.
LEG    and Investigations         exposes students to the best tools – and        create, deploy, and access the efficacy of     At the heart of SANS Secure Software            •   Be prepared – Students receive a
523    PA G E 52                  best practices – needed to add business         a high-impact security awareness campaign.     Development curriculum is a promise: as             wide selection of textbooks, tools, and
                                  value through their audits.                                                                    soon as students return to their team from          learning resources, all of which they can
                                                                                  All SANS Management Courses are taught         their training they’ll be able to deploy what       keep and refer back to.
                                  Our courses develop and expand students’        by SANS Instructors. Our Management            they’ve learned.
                                  knowledge of audit’s Critical Security          Instructors are, primarily, practicing cyber                                                   Outside of the classroom our Secure
                                  Controls.                                       security management professionals. They                                                        Software Development Instructors are
                                                                                  bring this real-world experience into the                                                      respected practitioners and proponents in
                                                                                  classroom.                                                                                     the field of defensive programming.
                                                                                                                                 “DEV522 really covers the
                                  “The course helped me sharpen                   Students are equipped with a wealth of         security aspects every web                      SANS training is designed to be hands-on.
                                  up my awareness programme                       courseware and resources to supplement         developer must know.”                           Expect a long list of live, code based lab
                                  planning for next year.”                        their learning. We supply, for example, a      London                                          exercises.
                                  London                                          library of expertly written textbooks.         DEV522
                                  MGT433

                                                                                                                                                                                                                                       S A N S T R A I N I N G C ATA LO G U E , 2018   13
P R I VAT E T R A I N I N G
                                                                                                         P R I VAT E T R A I N I N G

                                                                                                                                                                                                                                                                                     TRAINING EVENTS
                                                                                       TRAINING EVENTS
         SANS.ORG/301                                                                                                                              You will be able to...                     S A N S .O R G /4 01                                                                                                                               Who should attend?

         SEC                                                                                                                                                                                  SEC

                                                                                                                                                                                                                                                                                                                                     ON-DEMAND
                                                                                                                                       ON-DEMAND
                                                                                                                                                   •   Communicate with confidence                                                                                                                                                               •   Security professionals who
                                                                                                                                                       regarding information security                                                                                                                                                                want to fill the gaps in their

         301                                                                                                                                       •
                                                                                                                                                       topics, terms, and concepts
                                                                                                                                                       Understand and apply the
                                                                                                                                                       Principles of Least Privilege
                                                                                                                                                                                              401                                                                                                                                                •
                                                                                                                                                                                                                                                                                                                                                     understanding of technical
                                                                                                                                                                                                                                                                                                                                                     information security
                                                                                                                                                                                                                                                                                                                                                     Managers who want to
                                                                                                                                                   •   Understand and apply the                                                                                                                                                                      understand information security
     HANDS-ON          •   S I X D AYS     •   LAPTOP REQUIRED                                                                                         Confidentiality, Integrity, and      HANDS-ON         •   S I X D AYS     •   LAPTOP REQUIRED                                                                                                 beyond simple terminology and
                                                                                                                                                       Availability (CIA) Triad                                                                                                                                                                      concepts

     Intro to Information                                                                                                                          •   Build better passwords that are
                                                                                                                                                       more secure while also being         Security Essentials                                                                                                                                  •   Operations personnel who
                                                                                                                                                                                                                                                                                                                                                     do not have security as their

     Security                                                                                                                                      •
                                                                                                                                                       easier to remember and type
                                                                                                                                                       Grasp basic cryptographic
                                                                                                                                                       principles, processes,
                                                                                                                                                                                            Bootcamp Style                                                                                                                                           primary job function but need
                                                                                                                                                                                                                                                                                                                                                     an understanding of security to
                                                                                                                                                                                                                                                                                                                                                     be effective
                                                                                                                                                       procedures, and applications                                                                                                                                                              •   IT engineers and supervisors
                                                                                                                                                   •   Gain an understanding of                                                                                                                                                                      who need to know how to build
                                                                                                                                                       computer network basics                                                                                                                                                                       a defensible network against
     To determine if the SANS SEC301 course is right for you, ask yourself five simple questions:                                                  •   Have a fundamental grasp of          This course will teach you the most effective steps to prevent attacks and detect adversaries                                                            attacks
                                                                                                                                                       any number of critical technical     with actionable techniques you can directly apply when you get back to work. You’ll learn                                                            •   Administrators responsible
     •    Do you have basic computer knowledge, but are new to information security and in need                                                        networking acronyms: TCP/IP,         tips and tricks from the experts so you can win the battle against the wide range of cyber                                                               for building and maintaining
          of an introduction to the fundamentals?                                                                                                      IP, TCP, UDP, MAC, ARP, NAT, ICMP,   adversaries that want to harm your environment.                                                                                                          systems that are being targeted
     •    Are you bombarded with complex technical security terms that you don’t understand?                                                           and DNS                                                                                                                                                                                       by attackers
     •    Are you a non-IT security manager (with some technical knowledge) who lays awake at                                                      •   Utilise built-in Windows tools to    STOP and ask yourself the following questions:                                                                                                       •   Forensic specialists, penetration
          night worrying that your company will be the next mega-breach headline story on the 6                                                        see your network settings            • Do you fully understand why some Organisations get                     “It is making me question                                                       testers, and auditors who need
          o’clock news?                                                                                                                            •   Recognise and discuss various           compromised and others do not?                                        my own beliefs. I will be                                                       a solid foundation of security
     •    Do you need to be conversant in basic security concepts, principles, and terms, even if                                                      security technologies including      • If there were compromised systems on your network,                     challenging colleagues and                                                      principles to be as effective as
          you don’t need “deep in the weeds” detail?                                                                                                   anti-malware, firewalls, and            are you confident that you would be able to find them?                strategies when i return to                                                     possible at their jobs
     •    Have you decided to make a career change to take advantage of the job opportunities in                                                       intrusion detection systems          • Do you know the e‘ectiveness of each security device                   work. The course is full of                                                 •   Anyone new to information
          information security and need formal training/certification?                                                                             •   Determine your “Phishing IQ” to         and are you certain they are all configured correctly?                logical, workable solutions.”                                                   security with some background
                                                                                                                                                       more easily identify SPAM email      • Are proper security metrics set up and communicated                    Anthony Usher                                                                   in information systems and
     If you answer yes to any of these questions, the SEC301: Intro to Information Security training                                                   messages                                to your executives to drive security decisions?                       HMRC                                                                            networking
     course is for you. Jump-start your security knowledge by receiving insight and instruction                                                    •   Understand physical security
     from real-world security experts on critical introductory topics that are fundamental                                                             issues and how they support          If you do not know the answers to these questions, SEC401 will provide the information
     to information security. This completely revised, five-day comprehensive course covers                                                            cybersecurity                        security training you need in a bootcamp-style format that is reinforced with hands-on labs.                                                         You will be able to...
     everything from core terminology to the basics of computer networks, security policies,                                                       •   Understand incident response,                                                                                                                                                             •   Design and build a network
     incident response, passwords, and even an introduction to cryptographic principles.                                                               business continuity, and             SEC401: Security Essentials Bootcamp Style is focused on teaching you the essential                                                                      architecture using VLANs, NAC
                                                                                                                                                       disaster recovery planning at an     information security skills and techniques you need to protect and secure your Organisation’s                                                            and 802.1x based on an APT
     This course is designed for students who have a basic knowledge of computers and                                                                  introductory level                   critical information assets and business systems. Our course will show you how to prevent                                                                indicator of compromise
     technology but no prior knowledge of cybersecurity. The hands-on, step-by- step teaching                                                      •   Access a number of websites          your Organisation’s security problems from being headline news in the Wall Street Journal!                                                           •   Run Windows command line
     approach will enable you to grasp all of the information presented even if some of the topics                                                     to better understand password                                                                                                                                                                 tools to analyse the system
     are new to you. You’ll learn the fundamentals of information security that will serve as the                                                      security, encryption, phishing,      Prevention is ideal but detection is a must.                                                                                                             looking for high-risk items
     foundation of your InfoSec skills and knowledge for years to come.                                                                                browser security, etc.               With the rise in advanced persistent threats, it is almost inevitable that Organisations will                                                        •   Run Linux command line tools
                                                                                                                                                                                            be targeted. Whether the attacker is successful in penetrating an Organisation’s network                                                                 (ps, ls, netstat, etc.) and basic
     Written by a security professional with over 30 years of experience in both the public and                                                                                             depends on the effectiveness of the Organisation’s defence. Defending against attacks is an                                                              scripting to automate the
     private sectors, SEC301 provides uncompromising real-world insight from start to finish. The                                                                                           ongoing challenge, with new threats emerging all of the time, including the next generation                                                              running of programs to perform
     course prepares you for the Global Information Security Fundamentals (GISF) certification                                                                                              of threats. Organisations need to understand what really works in cybersecurity. What has                                                                continuous monitoring of
     test, as well as for the next course up the line, SEC401: Security Essentials Bootcamp Style.                                                                                          worked, and will always work, is taking a risk-based approach to cyber defence. Before your                                                              various tools
     It also delivers on the SANS promise: You will be able to use the knowledge and skills you                                                                                             Organisation spends a dollar of its IT budget or allocates any resources or time to anything in                                                      •   Install VMWare and create
     learn in SEC301 as soon as you return to work.                                                                                                                                         the name of cybersecurity, three questions must be answered:                                                                                             virtual machines to operate a
                                                                                                                                                                                            • What is the risk?                                                                                                                                      virtual lab to test and evaluate
                                                                                                                                                                                            • Is it the highest priority risk?                                                                                                                       the tools/security of systems
     “I very much appreciate the passion of the instructors.                                                                                                                                • What is the most cost-e‘ective way to reduce the risk?                                                                                             •   Create an effective policy that
     Their knowledge is incredible and the presentation of their                                                                                                                                                                                                                                                                                     can be enforced within an
     knowledge is down-to-earth and helpful. SANS training is                                                                                                                               Security is all about making sure you focus on the right areas of defence. In SEC401 you                                                                 Organisation and prepare a
     far etter t an ri acy re ated certification                                                                                                                                            will learn the language and underlying theory of computer and information security. You                                                                  checklist to validate security,
     Ron Hoffman,                                                                                                                                                                           will gain the essential and effective security knowledge you will need if you are given the                                                              creating metrics to tie into
     MUTUAL OF OMAHA                                                                                                                                                                        responsibility for securing systems and/or Organisations. This course meets both of the key                                                              training and awareness
                                                                                                                                                                                            promises SANS makes to our students: (1) You will learn up-to-the-minute skills you can                                                              •   Identify visible weaknesses
                                                                                                                                                                                            put into practice immediately upon returning to work; and (2) You will be taught by the best                                                             of a system utilising various
                                                                                                                                                                                            security instructors in the industry.                                                                                                                    tools including dumpsec
                                                                                                                                                                                                                                                                                                                                                     and OpenVAS, and once
                                                                                                                                                                                                                                                                                                                                                     vulnerabilities are discovered
                              G I AC C E RT: G I S F                                                                                                                                                                 G I AC C E RT: G S EC                                                                                                           cover ways to configure the
                              30 CPE/CMU CREDITS                                                                                                                                                                     46 CPE/CMU CREDITS                                                                                                              system to be more secure
                              WWW.GIAC.ORG/GISF                                                                                                                                                                      WWW.GIAC.ORG/GSEC

14                            S A N S T R A I N I N G C ATA LO G U E , 2018                                                                                                                                          S A N S T R A I N I N G C ATA LO G U E , 2018                                                                                                                       15
P R I VAT E T R A I N I N G

                                                                                                                                                                                                                                                                                                 P R I VAT E T R A I N I N G
                                                                                       TRAINING EVENTS

                                                                                                                                                                                                                                                                               TRAINING EVENTS
       SANS.ORG/501                                                                                                                                                                          SANS.ORG/503

       SEC                                                                                                                                                                                   SEC

                                                                                                                                       ON-DEMAND

                                                                                                                                                                                                                                                                                                                               ON-DEMAND
                                                                                                                                                   Who should attend?                                                                                                                                                                      Who should attend?
                                                                                                                                                   •   Incident response and                                                                                                                                                               •   Intrusion detection (all levels),

       501                                                                                                                                         •
                                                                                                                                                       penetration testers
                                                                                                                                                       Security Operations Center
                                                                                                                                                       engineers and analysts
                                                                                                                                                                                             503                                                                                                                                           •
                                                                                                                                                                                                                                                                                                                                               system, and security analysts
                                                                                                                                                                                                                                                                                                                                               Network engineers/
                                                                                                                                                                                                                                                                                                                                               administrators Hands-on
                                                                                                                                                   •   Network security professionals                                                                                                                                                          security managers
     HANDS-ON         •   S I X D AYS      •   LAPTOP REQUIRED                                                                                     •   Anyone who seeks technical          S I X D AYS    •   LAPTOP REQUIRED
                                                                                                                                                       in-depth knowledge about                                                                                                                                                            You will be able to...

     Advanced Security                                                                                                                                 implementing comprehensive
                                                                                                                                                       security solutions                  Intrusion Detection                                                                                                                             •   Configure and run open-source
                                                                                                                                                                                                                                                                                                                                               Snort and write Snort signatures

     Essentials – Enterprise                                                                                                                       •
                                                                                                                                                   You will be able to...                  In-Depth                                                                                                                                        •   Configure and run open-source
                                                                                                                                                                                                                                                                                                                                               Bro to provide a hybrid traffic

     Defender
                                                                                                                                                   •   Identify the threats against                                                                                                                                                            analysis framework
                                                                                                                                                       network infrastructures and                                                                                                                                                         •   Understand TCP/IP component
                                                                                                                                                       build defensible networks that                                                                                                                                                          layers to identify normal and
                                                                                                                                                       minimize the impact of attacks                                                                                                                                                          abnormal traffic
     Effective cybersecurity is more important than ever as attacks become stealthier, have                                                        •   Access tools that can be used       Reports of prominent Organisations being hacked and suffering irreparable reputational                                                          •   Use open-source traffic analysis
     a greater financial impact, and cause broad reputational damage.                                                                                  to analyse a network to prevent     damage have become all too common. How can you prevent your company from becoming                                                                   tools to identify signs of an
                                                                                                                                                       attacks and detect the adversary    the next victim of a major cyber attack?                                                                                                            intrusion
     SEC501: Advanced Security Essentials – Enterprise Defender builds on a solid foundation                                                       •   Decode and analyse packets                                                                                                                                                          •   Comprehend the need to
     of core policies and practices to enable security teams to defend their enterprise.                                                               using various tools to identify     Preserving the security of your site in today’s threat environment is more challenging                                                              employ network forensics to
                                                                                                                                                       anomalies and improve network       than ever before. The security landscape is continually changing from what was once only                                                            investigate traffic to identify and
     It has been said of security that “prevention is ideal, but detection is a must.” However,                                                        defences                            perimeter protection to protecting exposed and mobile systems that are almost always                                                                investigate a possible intrusion
     detection without response has little value. Network security needs to be constantly                                                          •   Understand how the adversary        connected and sometimes vulnerable. Security-savvy employees who can help detect and                                                            •   Use Wireshark to carve out
     improved to prevent as many attacks as possible and to swiftly detect and respond                                                                 compromises networks and how        prevent intrusions are therefore in great demand. Our goal in SEC503: Intrusion Detection                                                           suspicious file attachments
     appropriately to any breach that does occur. This PREVENT - DETECT - RESPONSE strategy                                                            to respond to attacks               In-Depth is to acquaint you with the core knowledge, tools, and techniques to defend your                                                       •   Write tcpdump filters to
     must be in place both externally and internally. As data become more portable and networks                                                    •   Perform penetration testing         networks with insight and awareness. The training will prepare you to put your new skills and                                                       selectively examine a particular
     continue to be porous, there needs to be an increased focus on data protection. Critical                                                          against an Organisation to          knowledge to work immediately upon returning to a live environment.                                                                                 traffic trait
     information must be secured regardless of whether it resides on a server, in a robust network                                                     determine vulnerabilities and                                                                                                                                                       •   Craft packets with Scapy
     architecture, or on a portable device.                                                                                                            points of compromise                Mark Twain said, “It is easier to fool people than to convince them that they’ve been fooled.”                                                  •   Use the open-source network
                                                                                                                                                   •   Apply the six-step incident         Too many IDS/IPS solutions provide a simplistic red/green, good/ bad assessment of traffic                                                          flow tool SiLK to find network
     Despite an Organisation’s best efforts to prevent network attacks and protect its critical                                                        handling process                    and too many untrained analysts accept that feedback as the absolute truth. This course                                                             behavior anomalies
     data, some attacks will still be successful. Therefore, Organisations need to be able to detect                                               •   Use various tools to identify and   emphasises the theory that a properly trained analyst uses an IDS alert as a starting point                                                     •   Use your knowledge of network
     attacks in a timely fashion. This is accomplished by understanding the traffic that is flowing                                                    remediate malware across your       for examination of traffic, not as a final assessment. SEC503 imparts the philosophy that the                                                       architecture and hardware to
     on your networks, looking for indications of an attack, and performing penetration testing                                                        Organisation                        analyst must have access and the ability to examine the alerts to give them meaning and                                                             customise placement of IDS
     and vulnerability analysis against your Organisation to identify problems and issues before                                                   •   Create a data classification        context. You will learn to investigate and reconstruct activity to deem if it is noteworthy or a                                                    sensors and sniff traffic off
     a compromise occurs.                                                                                                                              program and deploy data loss        false indication.                                                                                                                                   the wire
                                                                                                                                                       prevention solutions at both a
     Finally, once an attack is detected we must react quickly and effectively and perform the                                                         host and network level              SEC503: Intrusion Detection In-Depth delivers the technical knowledge, insight, and hands-
     forensics required. Knowledge gained by understanding how the attacker broke in can be                                                                                                on training you need to defend your network with confidence. You will learn about the
     fed back into more effective and robust preventive and detective measures, completing the                                                                                             underlying theory of TCP/IP and the most used application protocols, such as DNS and
     security lifecycle.                                                                                                                                                                   HTTP, so that you can intelligently examine network traffic for signs of an intrusion. You
                                                                                                                                                                                           will get plenty of practice learning to master different open-source tools like tcpdump,                                                        “I loved the course. I had
                                                                                                                                                                                           Wireshark, Snort, Bro, tshark, and SiLK. Daily hands-on exercises suitable for all experience                                                   big expectations, because
                                                                                                                                                                                           levels reinforce the course book material so that you can transfer knowledge to execution.                                                      I have also taken the 401
                                                                                                                                                                                           Basic exercises include assistive hints while advanced options provide a more challenging                                                       security essentials course
                                                                                                                                                                                           experience for students who may already know the material or who have quickly mastered                                                          and it was amazing too. All
                                                                                                                                                                                           new material.                                                                                                                                   my expectations have been
                                                                                                                                                                                                                                                                                                                                           completed. I had great
      “By far the best course I have                      “Great course content                                                                                                                                                                                                                                                            classmates and we had a
      ever attended. Every day I                          very interesting and                                                                                                             “In order to defend a network you need to understand how                                                                                        lot of fun during the day
      have learnt things that can be                      comprehensive.”                                                                                                                  it works, this course is both enjoyable and challenging”                                                                                        and the evenings.”
      applied at work”                                    John O’brien,                                                                                                                    Holly C                                                                                                                                         Diana Moldovan
      Stuart Long,                                        AIRBUS DEFENCE & SPACE                                                                                                           MOD UK                                                                                                                                          BETFAIR
      BANK OF ENGLAND

                              G I AC C E RT: G C E D                                                                                                                                                                G I AC C E RT: G C I A
                              36 CPE/CMU CREDITS                                                                                                                                                                    36 CPE/CMU CREDITS
                              WWW.GIAC.ORG/GCED                                                                                                                                                                     WWW.GIAC.ORG/GCIA

16                            S A N S T R A I N I N G C ATA LO G U E , 2018                                                                                                                                         S A N S T R A I N I N G C ATA LO G U E , 2018                                                                                                                    17
You can also read