Showing posts with label SANS. Show all posts
Showing posts with label SANS. Show all posts

Oct 28, 2021

Enhancing Cloud Security Operations : Visibility

Visibility is a key element to identify and respond to cloud security incidents. This session explores how we can leverage native offerings to help solve the visibility problem.

In this webinar, Roger shares the following topics with us, and helps us to keep up with the ever-changing threat landscape.

  • Cloud adoption
  • Security concerns
  • How do we solve the problems
  • Native tools
  • Gaps
  • 3rd party tools
  • Automation

Links:

  • https://www.youtube.com/watch?v=rEP53j60QXQ

Oct 25, 2021

Defending Public Cloud for Enterprise Tricks and Tips!

 

The public cloud expansion is a reality and maintaining fences up is not easy. Come learn about AWS/Azure/GCP organization rules, policies and best practices to avoid potential threats that help to enforce good practices and avoid potential issues and misconfigurations. 

In this webcast, Moises will cover how to: 

  • - Allow new accounts, subscriptions, or project to start with security practices in place 
  • - Reduce the risk that shadow IT could grow without security policies and good practices 
  • - Enforce security good practices even if users try to resist it 
  • - Maintain cloud environments aligned with legal and privacy requirement

 Final Thoughts - Toolbox !

  1. Prowler - github.com/toniblyx/prowler
  2. Cloud Custodian -  cloudcustodian.io
  3. CheckOV - checkov.io
  4. CloudSploit - cloudsploit.com
  5. rcentry - arcentry.com
  6. Falco - falco.org
  7. ScoutSuite - github.com/nccgroup/ScoutSuite

Final Thoughts - References!

  1. CIS Benchmarks - cisecurity.org
  2. Cloud Security Alliance - cloudsecurityalliance.org
  3. OWASP - owasp.org
  4. NIST - nist.gov
  5. ENISA - www.enisa.europe.eu
  6. Each cloud provider has well-architecture guide

Jun 24, 2021

The Threat Detection with Cloud API Logs: A Case Study from Capital One

 

My notes:

  • Methodologies for Cyber Threat Intelligence: [06:00]
    • Blacklist - hashes, IP, ports, 
    • Statistical Analysis
    • Behavior Analysis - Mitre Att&ck (intention/tactics) [06:55]
  • Case Study : Capital One Attack [08:58]
    • T1595: Active scanning
    • T1190: Exploit webap (SSRF) [13:25]  
    • T1552: Access EC2 metadata service [14:14]
    • T1526: Discover Token to access to all S3 bucket [15:20] 
    • T1530: Data exfil from S3 cloud storage
  • The Cloud API Service [18:50]
  • CloudTrail - for threat hunting using API calls [20:00]  
  • Azure Resource Provider Operations [30:00]
    • Portal
    • CLI: az privoder operation list
  • Azure Activity Log [33:13]
    • only provides Create, Update, Delete (no Read)
    • Grouped by correlation ID
  • Azure IMDSv1 Vs IMDSv2

Feb 18, 2021

Threat Intel for Everyone: Writing Like A Journalist To Produce Clear, Concise Reports | CTI Summit

 

Threat intelligence reporting is only useful if people read, comprehend, and take action on it. Because threat intelligence can be distributed and operationalized across an entire organization, from SOC analysts to the C-suite, it should be written for a broad audience. 

In this SANS talk, Selena will take applications of journalism -- like the Inverted Pyramid style of news reporting, importance of a nutgraf, and killing passive voice -- to show attendees how she crafts clear, concise, and actionable threat intelligence reports.

Jan 27, 2021

SANS Faculty Free Tools

SANS instructors have built more than 150 open source tools that support our work to implement better security. Below is the link to the list for the free tools.

https://blog.deurainfosec.com/sans-faculty-free-tools/

Nov 28, 2020

New Tools for your Threat Hunting Toolbox

Just finished watching the Youtube video on Mark's presentation. He has introduced 2 of the tools that he created for threat hunting. 


First, he introduces APIify that make anything query-able by SEIM, which used to automate the first few steps in every investigation.Second, is the Domain Stats 2.0 which helps to cache those whois requests for SIEM.

Links:

  • https://github.com/MarkBaggett/apiify



Jan 6, 2011

GREM Certificate

Thanks a lot, I received my GREM certificate from SANS today. ;-)

Jul 17, 2009

HTTPS, SANS, FireStats, MySQL and Table Name

Ever wonder what are the engines powering SANS - Security Leadership Blog? An error message found while browsing to blogs.sans.org today. You can see MySQL is used and the table name.

And HTTPS never prevent information leakage error. :-)

Apr 3, 2009

SANS Consensus Audit Guidelines (Draft 1.0)

On Feb 23, 2009 SANS publishes the first draft of the Consensus Audit Guidelines (CAG). As represented in the press release, the CAG includes 20 controls, 15 of which can be automated and 5 are not.

The 20 Critical Controls subject to automated measurement and validation (AMV):
  1. Inventory of Authorized and Unauthorized Hardware.
  2. Inventory of Authorized and Unauthorized Software.
  3. Secure Configurations for Hardware and Software For Which Such Configurations Are Available.
  4. Secure Configurations of Network Devices Such as Firewalls And Routers.
  5. Boundary Defense
  6. Maintenance and Analysis of Complete Security Audit Logs
  7. Application Software Security ***
  8. Controlled Use of Administrative Privileges
  9. Controlled Access Based On Need to Know
  10. Continuous Vulnerability Testing and Remediation
  11. Dormant Account Monitoring and Control
  12. Anti-Malware Defenses
  13. Limitation and Control of Ports, Protocols and Services
  14. Wireless Device Control
  15. Data Leakage Protection
  16. Secure Network Engineering (not AMV)
  17. Red Team Exercises (not AMV)
  18. Incident Response Capability (not AMV)
  19. Assured Data Back-Ups (not AMV)
  20. Security Skills Assessment and Training to Fill Gaps (not AMV)
Two (2) points I would like to make here:
  • When your only tool is hammer (For*ify), you tend to see every problem as a nail. Hey dude, *** is only 1/20 of the entire infosec.
  • RedTeam Exercise isn't an automated measurement and validation.