Detection engineering has evolved into an art, contributing to the success rates of endpoint and network detection and response tooling capabilities. Used to effectively counter the increasing complexity of today’s cyber threat actors, high-fidelity detections can help an organization discover threats earlier, neutralizing them before further damage can occur. Not all detections are created equally, however, and neither are detection opp...

Successful phishing attacks on end users and system administrators continue to be the factor that enables nearly 80% of damaging security incidents. Many companies are spending on user awareness and education programs but find it is hard to sustain initial gains in phishing awareness, recognition, and resilience and are lacking the data needed to develop and track meaningful awareness metrics. During this SANS WhatWorks webcast, SANS Director...

For many years, security professionals have advocated the approach of collecting logs from all the places where they’re generated and centralizing them into one or only a few places.But now, we have much more data and many more sources of security telemetry, including from endpoints, networks, email, IAM, SaaS applications, and cloud assets in multi-cloud infrastructures.Does centralizing log data still make sense, or should we be thinki...

In this talk, Ahmed Abugharbia and Abdul Kittana will deep dive into various methodologies and options for developing applications using generative AI technologies. They will discuss the process of building ASecureCloud’s AI-powered features, lessons learned, and demonstrate how you can apply similar principles in your own environments. Objectives: Learn capabilites of current generative AI technologies Different options for building app...

Where can you find leaders from Amazon Web Services (AWS), Google Cloud, Microsoft Azure, and SANS Institute, together on one virtual stage? It's happening for the first time ever at the SANS Cloud Security Exchange 2023. At the inaugural event in 2022, thousands of attendees from across the globe enjoyed learning from independent cloud security experts from SANS Institute who were paired with leaders from the cloud security providers. It work...

During the past decade, increasing numbers of organizations have transformed their applications to be cloud native, building workloads based on multicloud architecture. Connecting and securing these cloud workloads has not been effective for many reasons and today, there are many benefits to a converged workload communication architecture that unifies security and operations. SANS tested the new Zscaler Zero Trust platform for cloud workloads,...

A large majority of ransomware incidents involve both obfuscated scripts and Cobalt Strike. PowerShell reigns supreme as the most common type of obfuscated script found in ransomware cases. Do you know what to do should you find an obfuscated PowerShell script during response? What if you run into an obfuscated, PowerShell-based Cobalt Strike downloader? Do you know how to decode the downloader? Do you know how to review the shellcode found mu...

Investigation is often considered both an art and a science, and practitioners merge these disciplines in the search for the facts in their investigations. While the best tool in both art and science is the amazing capacity of the human brain, and this is especially apparent in the field of digital forensics and incident response, where we match ourselves against the creative ingenuity of committed and capable threat actors; we do need other t...

Technology has done wonders for productivity over the past 20 years, but cybercriminals have improved their own efficiency using the same tools. In just the past three years, attackers have cut the time needed to deploy an attack from months to days using automation and as-a-service technologies. Meanwhile, cybersecurity teams have never had more data to find patterns and stop attacks — yet the time to detect and respond is still measure...

Securing a cloud environment can be challenging and time consuming, especially if you don't know where to start. This Workshop will scrutinize a common cloud service: Virtual Machines, and focus on the secure implementation of that service. We'll discuss Operating Systems (and why it matters from a cloud perspective), as well as security groups, remote access, system and network hardening as well as how mature organizations handle deployments....