The Internet Storm Center is all about "coloring your logs". Finding out what matters and doesn't matter by adding context to otherwise abstract datapoints like IP addresses and domain names. This free data is made available via our website and easy to use APIs. During this session, we will talk about some of the changes we have made to make the data more useful and more available. We will also illustrate how you can learn about ongoing trends...

Sliver is rising in popularity and is thought to be taking significant market share off other well known C2 frameworks. Corelight Content can better power your Sliver detections highlighting what's on your network to build a strategic data reserve when you need to investigate an incident. Come learn about Corelight Content, insightful community developed detections, and an open NDR that puts the power in your hands.

This webcast takes a deep dive into the threats highlighted during the annual SANS keynote panel discussion at the RSA® Conference 2023. This webcast will include insight from SANS instructors Ed Skoudis, Heather Mahalik, Dr. Johannes Ullrich, and Katie Nickels on the dangerous new attacks techniques they see emerging. You’ll get actionable advice on the critical skills, processes, and controls needed to protect enterprises from thes...

Operational technology (OT) cyber threats have evolved over the past decade. Combined with increased connectivity from digital transformation projects, it is more critical than ever to implement industrial control system (ICS)-specific visibility capabilities to quickly detect, respond, and recover from potential cyber incidents.To explore this topic, SANS conducted a survey to collect information around industry practices. In this webcast, Ce...

Security teams need to build consistent, reusable design patterns for cloud security controls that can be automated and maintained readily over time. Within cloud infrastructure, many controls can be provisioned and enabled ahead of time and operate autonomously in any deployment scenario. Commonly termed “guardrails,” these controls ensure that security capabilities are always enabled and operate within the context of deployments...

This two-hour workshop will introduce the student to Docker containers and images. During the workshop, we will create an image that contains the Command Line Interfaces for AWS, Azure, and Google Cloud as our example, but the same process would be followed for any Linux-based command line tool. During the session, we will build, test, and troubleshoot the creation of the Dockerfile and publish the image to Docker Hub. Next, we will set up Git...

Join us for a panel discussion presented by Emerson and Dragos, as they share their insights around OT cybersecurity as partners - while also depicting the unique expertise, experience, and responsibilities that they bring to the table to defend customer installations and environments together. Although the core focus of the conversation will be on DeltaV systems, a high-level overview of OT cybersecurity and the Industrial Control Systems (IC...

In its sixth year, the SANS 2023 SOC Survey explored SOC capabilities, deployment architecture, technology use and satisfaction, capabilities outsourced and satisfaction with outsourced providers. With survey data from active SOC managers and analysts, this webcast will cover the escalating movement to the cloud, orchestration, and tool changes. It explores the developing promise of deception, AI and machine learning. Key topics will include c...

Zero trust is a cybersecurity concept, and implementation architecture, that emphasizes the need for strict verification of all devices, users, and networks before granting access to sensitive data and systems. Security teams love the idea of zero trust, but what goes behind implementing and successfully maintaining zero trust architecture? During this event, we'll bring together experts and industry leaders to discuss the latest developments...

The castle model is dead, it's time to move on. Protecting our corporations primarily from the outside looking in is a naive and inefficient approach. Prevention is great, but inevitably the defenses will fail, and the attackers are on the inside. Threats attacking us from the inside are real, and we can neither avoid it nor can we "trust our employees". While it would be nice to trust employees, and we can trust most of them, we need to be vi...