www.sans.org/san-francisco-winter

The Most Trusted Source for Information Security Training, Certif ication, and Research

SAN FRANCISCO WINTER 2017November 27 – December 2

“Hands down, the BEST training I have ever attended.”

-RUSSELL BIXLER, SAIC

Protect Your Business and Advance Your CareerTen hands-on, immersion-style information security courses taught by real-world practitioners

CYBER DEFENSEETHICAL HACKINGPENETRATION TESTING

DIGITAL FORENSICSMANAGEMENTCYBER THREAT INTELLIGENCE

SAVE $400 Register and pay by October 4th – Use code EarlyBird17

Frank Kim Certified Instructor @fykim

Robert Kirtley Instructor @RobertNKirtley

Register today for SANS San Francisco Winter 2017! www.sans.org/san-francisco-winter

@SANSInstitute Join the conversation: #SANSSanFrancisco

Save $400 when you register and pay by October 4th using code EarlyBird17

SANS Instructors SANS instructors are real-world practitioners who specialize in the subjects they teach. All instructors undergo rigorous training and testing in order to teach SANS courses. This guarantees that what you learn in class will be up to date and relevant to your job. The SANS San Francisco Winter 2017 lineup of instructors includes:

Chris Christianson Certified Instructor @cchristianson

Je� McJunkin Instructor @je�mcjunkin

Heather Mahalik Senior Instructor @HeatherMahalik

John Strand Senior Instructor @strandjs

Russell Eubanks Certified Instructor @russelleubanks

James Leyte-Vidal Instructor @jamesleytevidal

Timothy McKenzie Instructor @timboloman

Scott Roberts Instructor @sroberts

MON 11-27

TUE 11-28

WED 11-29

THU 11-30

FRI 12-1

SAT 12-2

SEC401 Security Essentials Bootcamp StyleSEC504 Hacker Tools, Techniques, Exploits, and Incident HandlingSEC505 Securing Windows and PowerShell AutomationSEC542 Web App Penetration Testing and Ethical HackingSEC560 Network Penetration Testing and Ethical HackingFOR500 Windows Forensic Analysis (formerly FOR408)FOR578 Cyber Threat IntelligenceMGT512 SANS Security Leadership Essentials for Managers

with Knowledge Compression™MGT514 IT Security Strategic Planning, Policy, and LeadershipMGT517 Managing Security Operations: Detection, Response, and Intelligence

Page 1

Page 3 SIMULCAST

Page 4

Page 5

Page 6 SIMULCAST

Page 7

Page 2

Page 8

Page 9

NEW! Page 10

Courses at a Glance

Christopher Crowley Principal Instructor @CCrowMontance

Evening Bonus Sessions Take advantage of these extra evening presentations

and add more value to your training. Learn more on page 11.

KEYNOTE: Windows Exploratory Surgery with Process Hacker – Jason Fossen

Phoning It In: Heather Talks About Smartphone Forensics – Heather Mahalik

San Francisco WINTER 2017 NOV 27 - DEC 2

Jason Fossen Faculty Fellow @JasonFossen

For course updates, prerequisites, special notes, or laptop requirements, visit www.sans.org/event/san-francisco-winter-2017/courses 1

SEC401Security Essentials Bootcamp Style

GSEC CertificationSecurity Essentials

www.giac.org/gsec

“This course has been invaluable in refreshing my networking, Windows, and security knowledge.” -RON MASON, SLT EXPRESSWAY

Six-Day Program Mon, Nov 27 - Sat, Dec 2 9:00am - 7:00pm (Days 1-5) 9:00am - 5:00pm (Day 6) 46 CPEs Laptop Required Instructor: Chris Christianson

Who Should Attend Security professionals who want to fill the gaps in their understanding of technical information security

Managers who want to understand information security beyond simple terminology and concepts

Operations personnel who do not have security as their primary job function but need an understanding of security to be e�ective

IT engineers and supervisors who need to know how to build a defensible network against attacks

Administrators responsible for building and maintaining systems that are being targeted by attackers

Forensic specialists, penetration testers, and auditors who need a solid foundation of security principles to be as e�ective as possible at their jobs

Anyone new to information security with some background in information systems and networking

This course will teach you the most effective steps to prevent attacks and detect adversaries with actionable techniques you can directly apply when you get back to work. You’ll learn tips and tricks from the experts so you can win the battle against the wide range of cyber adversaries that want to harm your environment.STOP and ask yourself the following questions:

Do you fully understand why some organizations get compromised and others do not?

If there were compromised systems on your network, are you confident you would be able to find them?

Do you know the e�ectiveness of each security device and are you certain they are all configured correctly?

Are proper security metrics set up and communicated to your executives to drive security decisions?

If you do not know the answers to these questions, SEC401 will provide the information security training you need in a bootcamp-style format that is reinforced with hands-on labs.SEC401: Security Essentials Bootcamp Style is focused on teaching you the essential information security skills and techniques you need to protect and secure your organization’s critical information assets and business systems. Our course will show you how to prevent your organization’s security problems from being headline news in the Wall Street Journal!Prevention Is Ideal but Detection Is a Must

With the rise in advanced persistent threats, it is almost inevitable that organizations will be targeted. Whether the attacker is successful in penetrating an organization’s network depends on the effectiveness of the organization’s defense. Defending against attacks is an ongoing challenge, with new threats emerging all of the time, including the next generation of threats. Organizations need to understand what really works in cybersecurity. What has worked, and will always work, is taking a risk-based approach to cyber defense. Before your organization spends a dollar of its IT budget or allocates any resources or time to anything in the name of cybersecurity, three questions must be answered:

What is the risk? Is it the highest priority risk? What is the most cost-e�ective way to reduce the risk?

Security is all about making sure you focus on the right areas of defense. In SEC401 you will learn the language and underlying theory of computer and information security. You will gain the essential and effective security knowledge you will need if you are given the responsibility for securing systems and/or organizations. This course meets both of the key promises SANS makes to our students: (1) You will learn up-to-the-minute skills you can put into practice immediately upon returning to work; and (2) You will be taught by the best security instructors in the industry.

Chris Christianson SANS Certified InstructorChris Christianson is an information security consultant, based in Northern California, with 20 years of experience and many technical certifications including: GSEC, GCIH, GCIA, GREM, GPEN, GWAPT, GCCC, GISF, GCED, CISSP, CCSE, CCDP, CCNP, IAM, CEH, and IEM. He holds a Bachelor of Science in Management Information Systems from the University of Atlanta. Before starting his own information security consultant services, he worked at Travis Credit Union for 21 years; his last role there was Assistant Vice President of Information Technology (December 2012 – January 2016). Chris has also been an expert speaker at

conferences and a contributor to numerous industry articles. @cchristiansonconferences and a contributor to numerous industry articles.

www.sans.eduWITH THIS COURSE

www.sans.org/ondemandwww.sans.org/8140

Register at www.sans.org/san-francisco-winter | 301-654-SANS (7267) 2

“SEC504 is an excellent course that ties the pieces of the incident handling and penetration testing puzzles together.” -JONATHON C., CACI

SEC504Hacker Tools, Techniques, Exploits, and Incident Handling

GCIH CertificationIncident Handler

www.giac.org/gcih

Six-Day Program Mon, Nov 27 - Sat, Dec 2 9:00am - 7:15pm (Day 1) 9:00am - 5:00pm (Days 2-6) 37 CPEs Laptop Required (If your laptop supports only wireless, please bring a USB Ethernet adapter.) Instructors: John Strand

James Leyte-Vidal

Who Should Attend Incident handlers

Leaders of incident handling teams

System administrators who are on the front lines defending their systems and responding to attacks

Other security personnel who are first responders when systems come under attack

The Internet is full of powerful hacking tools and bad guys using them extensively. If your organization has an Internet connection and one or two disgruntled employees (and whose does not!), your computer systems will get attacked. From the five, ten, or even one hundred daily probes against your Internet infrastructure to the malicious insider slowly creeping through your most vital information assets, attackers are targeting your systems with increasing viciousness and stealth. As defenders, it is essential we understand these hacking tools and techniques.

This course enables you to turn the tables on computer attackers by helping you understand their tactics and strategies in detail, giving you hands-on experience in finding vulnerabilities and discovering intrusions, and equipping you with a comprehensive incident handling plan. It addresses the latest cutting-edge, insidious attack vectors, the “oldie-but-goodie” attacks that are still prevalent, and everything in between. Instead of merely teaching a few hack attack tricks, this course provides a time-tested, step-by-step process for responding to computer incidents and a detailed description of how attackers undermine systems so you can prepare for, detect, and respond to those attacks. In addition, the course explores the legal issues associated with responding to computer attacks, including employee monitoring, working with law enforcement, and handling evidence. Finally, students will participate in a hands-on workshop that focuses on scanning, exploiting, and defending systems. This course will enable you to discover the holes in your system before the bad guys do!

The course is particularly well-suited to individuals who lead or are a part of an incident handling team. General security practitioners, system administrators, and security architects will benefit by understanding how to design, build, and operate their systems to prevent, detect, and respond to attacks.

www.sans.eduWITH THIS COURSE

www.sans.org/ondemandwww.sans.org/cyber-guardian www.sans.org/8140

James Leyte-Vidal SANS InstructorJames Leyte-Vidal is a team lead in a Fortune 100 company that focuses on remediation e�orts and control monitoring. In his 12 years in information security, James has performed various InfoSec functions, including: penetration testing, security assessments, remediation, vulnerability management, security program development and management, and incident response. Prior to his work in security, James worked several years as a Windows sysadmin and in an application support role. James has spoken publicly and taught for over 20 years in college classrooms, his own company, and elsewhere. James holds the GCIH, GPEN,

GWAPT, GAWN, GXPN, GCIA, GCFA, GMOB, GSEC, CISSP, MCSE, and CISA certifications, as well as degrees in IT and psychology. When not teaching or helping to secure his own company, James can usually be found running or taking something apart. @jamesleytevidalGWAPT, GAWN, GXPN, GCIA, GCFA, GMOB, GSEC, CISSP, MCSE, and CISA certifications, as well as degrees in IT and psychology. When not

John Strand SANS Senior InstructorJohn Strand is the owner of Black Hills Information Security, a firm specializing in penetration testing, active defense and hunt teaming services. He is also the chief technology o°cer of O�ensive Countermeasures, a firm dedicated to tracking advanced attackers inside and outside your network. John is an experienced speaker, having made presentations to the FBI, NASA, the NSA, and at various industry conferences. He teaches SEC504, SEC560, SEC580, SEC550, and is the lead course author of SEC504. He also co-hosts Security Weekly, the world’s largest information security podcast, and O�ensive Countermeasures: The Art of Active Defense. In his free time, he writes loud rock music and makes various futile attempts at fly fishing. @strandjs

For course updates, prerequisites, special notes, or laptop requirements, visit www.sans.org/event/san-francisco-winter-2017/courses 3

“Learning to combine PowerShell with WMI, as well as security-required protocols, is invaluable knowledge to have.” -DAN CHRISTY,

INDIANA UNIVERSITY

SCHOOL OF PUBLIC HEALTH

SEC505Securing Windows and PowerShell Automation

GCWN CertificationWindows Security Administrator

www.giac.org/gcwn

Six-Day Program Mon, Nov 27 - Sat, Dec 2 9:00am - 5:00pm 36 CPEs Laptop Required Instructor: Jason Fossen

Who Should Attend Operation personnel in SecOps/DevOps

Blue Team players who were terrified by SEC504

Windows endpoint and server administrators

Anyone who wants to learn PowerShell automation

Anyone implementing the NSA Top 10 Mitigations

Anyone implementing the CIS Critical Security Controls

DoD admins applying the NSA/DISA Secure Host Baseline

Those deploying or managing a PKI or smart cards

Those wanting a more rugged Windows architecture

Hackers know how to use PowerShell for evil. Do you know how to use it for good? In SEC505 you will learn PowerShell and Windows security hardening at the same time. SecOps/DevOps requires automation, and Windows automation means PowerShell.

You’ve run a vulnerability scanner and applied patches – now what? A major theme of this course is defensible architecture: we have to assume that there will be a breach, so we need to build in damage control from the beginning. Whack-a-mole incident response cannot be our only defensive strategy – we’ll never win, and we’ll never get ahead of the game. By the time your monitoring system tells you a Domain Admin account has been compromised, IT’S TOO LATE.

For the assume-breach mindset, we must carefully delegate limited administrative powers so that the compromise of one administrator account is not a disaster across the board. Managing administrative privileges and credentials is a tough problem, so this course devotes an entire day to just this one critical task. Perhaps you’ve taken a hacking course at SANS and you now want to learn Windows mitigations: SEC505 is that course. SEC505 is the defense-only mirror image of SEC504 with regard to Windows and Active Directory.

Learning PowerShell is also useful for another kind of security: job security. Employers are looking for people with these skills. You don’t have to know any PowerShell to attend the course; we will learn it together. About half the labs during the week are PowerShell, while the rest use graphical security tools. Many of the PowerShell scripts written by the course author are available to download from GitHub for free.

This course is not a vendor show to convince you to buy another security appliance or to install yet another endpoint agent. The idea is to use built-in or free Windows and Active Directory security tools when we can (especially PowerShell and Group Policy), and purchase commercial products only when absolutely necessary.

If you are an IT manager or CIO, the aim for this course is to have it pay for itself 10 times over within two years, because automation isn’t just good for SecOps/DevOps – it can save money, too.

This course is designed for systems engineers, security architects, and the Security Operations (SecOps) team. This course focuses on how to automate the NSA Top 10 Mitigations and the CIS Critical Security Controls related to Windows, especially the ones that are difficult to implement in large environments.

This is a fun course and a real eye-opener, even for Windows administrators with years of experience. We don’t cover patch management, share permissions, or other basics – the aim is to go far beyond that. Come have fun learning PowerShell and Windows security at the same time!

www.sans.edu www.sans.org/8140WITH THIS COURSE

www.sans.org/ondemandwww.sans.org/cyber-guardian

Jason Fossen SANS Faculty FellowJason Fossen is a principal security consultant at Enclave Consulting LLC, a published author, and a frequent public speaker on Microsoft security issues. Jason is the author of SANS SEC505: Securing Windows and PowerShell Automation, he maintains the Windows section (SEC401.5) of SEC401: Security Essentials Bootcamp Style, and he has been involved in numerous SANS projects since 1998. He graduated from the University of Virginia, received his master’s degree from the University of Texas at Austin, and holds a number of professional certifications. Jason currently lives in Dallas, Texas. @JasonFossen

See page 13 for details.See page 13 for details.

Register at www.sans.org/san-francisco-winter | 301-654-SANS (7267) 4

“As a non-penetration tester, I found SEC542 very informative and useful. The exercises proved invaluable to illustrating the topics.” -KEITH MCFARLAND, INTEL

“Every day of SEC542 gives you invaluable information from real-world testing you cannot find in a book.” -DAVID FAVA,

THE BOEING COMPANY

“Tim did a spectacular job of relating the information provided with his own personal knowledge.” -JULIO C. NUNEZ, JPMC

SEC542Web App Penetration Testing and Ethical Hacking

GWAPT CertificationWeb Application Penetration Tester

www.giac.org/gwapt

Six-Day Program Mon, Nov 27 - Sat, Dec 2 9:00am - 5:00pm 36 CPEs Laptop Required Instructor: Timothy McKenzie

Who Should Attend General security practitioners

Penetration testers

Ethical hackers

Web application developers

Website designers and architects

Web applications play a vital role in every modern organization. However, if your organization doesn’t properly test and secure its web apps, adversaries can compromise these applications, damage business functionality, and steal data. Unfortunately, many organizations operate under the mistaken impression that a web application security scanner will reliably discover flaws in their systems. SEC542 helps students move beyond push-button scanning to professional, thorough, and high-value web application penetration testing. Customers expect web applications to provide significant functionality and data access. Even beyond the importance of customer-facing web applications, internal web applications increasingly represent the most commonly used business tools within any organization. Unfortunately, there is no “patch Tuesday” for custom web applications, and major industry studies find that web application flaws play a major role in significant breaches and intrusions. Adversaries increasingly focus on these high-value targets either by directly abusing public-facing applications or by focusing on web apps as targets after an initial break-in. Modern cyber defense requires a realistic and thorough understanding of web application security issues. Anyone can learn to sling a few web hacks, but effective web application penetration testing requires something deeper. SEC542 enables students to assess a web application’s security posture and convincingly demonstrate the impact of inadequate security that plagues most organizations. In this course, students will come to understand major web application flaws and their exploitation. Most importantly, they’ll learn a field-tested and repeatable process to consistently find these flaws and convey what they have learned to their organizations. Even technically gifted security geeks often struggle with helping organizations understand risk in terms relatable to business. Much of the art of penetration testing has less to do with learning how adversaries are breaking in than it does with convincing an organization to take the risk seriously and employ appropriate countermeasures. The goal of SEC542 is to better secure organizations through penetration testing, and not just show off hacking skills. This course will help students demonstrate the true impact of web application flaws through exploitation.In addition to high-quality course content, SEC542 focuses heavily on in-depth, hands-on labs to ensure that students can immediately apply all they learn. In addition to having more than 30 formal, hands-on labs, the course culminates in a web application pen test tournament, powered by the SANS NetWars Cyber Range. This Capture-the-Flag event on the final day brings students into teams to apply their newly-acquired command of web application penetration testing techniques in a fun way that hammers home lessons learned.

Timothy McKenzie SANS InstructorTimothy McKenzie has almost 20 years of IT and Information Security experience working in financial, government, defense contractor, and service-related markets. He has been trained in malware research and exploit development, expert penetration, and forensics work. Timothy works for Dell SecureWorks as a red team penetration tester, focused primarily on network and web-based attacks. Timothy loves sharing the vast knowledge he has acquired to give back to the Information Security community. @timboloman

www.sans.eduWITH THIS COURSE

www.sans.org/ondemandwww.sans.org/cyber-guardian

For course updates, prerequisites, special notes, or laptop requirements, visit www.sans.org/event/san-francisco-winter-2017/courses 5

SEC560Network Penetration Testing and Ethical Hacking

GPEN CertificationPenetration Tester

www.giac.org/gpen

Six-Day Program Mon, Nov 27 - Sat, Dec 2 9:00am - 7:15pm (Day 1) 9:00am - 5:00pm (Days 2-6) 37 CPEs Laptop Required Instructor: Je£ McJunkin

Who Should Attend Security personnel whose jobs involve assessing networks and systems to find and remediate vulnerabilities

Penetration testers

Ethical hackers

Defenders who want to better understand o�ensive methodologies, tools, and techniques

Auditors who need to build deeper technical skills

Red and blue team members

Forensics specialists who want to better understand o�ensive tactics

As a cybersecurity professional, you have a unique responsibility to find and understand your organization’s vulnerabilities, and to work diligently to mitigate them before the bad guys pounce. Are you ready? SANS SEC560, our flagship course for penetration testing, fully arms you to address this task head-on.

SEC560 is the must-have course for every well-rounded security professional.

With comprehensive coverage of tools, techniques, and methodologies for network penetration testing, SEC560 truly prepares you to conduct high-value penetration testing projects step-by-step and end-to-end. Every organization needs skilled information security personnel who can find vulnerabilities and mitigate their effects, and this entire course is specially designed to get you ready for that role. The course starts with proper planning, scoping and recon, then dives deep into scanning, target exploitation, password attacks, and web app manipulation, with more than 30 detailed, hands-on labs throughout. The course is chock-full of practical, real-world tips from some of the world’s best penetration testers to help you do your job safely, efficiently…and masterfully.

Learn the best ways to test your own systems before the bad guys attack.

SEC560 is designed to get you ready to conduct a full-scale, high-value penetration test – and on the last day of the course you’ll do just that. After building your skills in comprehensive and challenging labs over five days, the course culminates with a final full-day, real-world penetration test scenario. You’ll conduct an end-to-end pen test, applying knowledge, tools, and principles from throughout the course as you discover and exploit vulnerabilities in a realistic sample target organization, demonstrating the knowledge you’ve mastered in this course.

You will bring comprehensive penetration testing and ethical hacking know-how back to your organization.

You will learn how to perform detailed reconnaissance, studying a target’s infrastructure by mining blogs, search engines, social networking sites, and other Internet and intranet infrastructures. Our hands-on labs will equip you to scan target networks using best-of-breed tools. We won’t just cover run-of-the-mill options and configurations, we’ll also go over the lesser known, but super-useful capabilities of the best pen test toolsets available today. After scanning, you’ll learn dozens of methods for exploiting target systems to gain access and measure real business risk. You’ll dive deep into post-exploitation, password attacks, and web apps, pivoting through the target environment to model the attacks of real-world bad guys to emphasize the importance of defense in-depth.

www.sans.eduWITH THIS COURSE

www.sans.org/ondemandwww.sans.org/cyber-guardian

“I like that the labs in SEC560 provided clear, step-by-step guidance. The instructor’s level of knowledge and ability to relay information is fantastic.” - BRYAN BARNHART,

INFILTRATION LABS

“Je£ was an outstanding instructor. He really helped me increase my technical skills.” -JOHN SCHAB, MITRE

Jeff McJunkin SANS InstructorJe� McJunkin is a senior sta� member at Counter Hack Challenges with more than nine years of experience in systems and network administration and network security. His greatest strength is his breadth of experience, which includes network and web application penetration testing, digital/mobile forensics, technical training, and systems architecture. Je� is a computer security/information assurance graduate of Southern Oregon University and holds many professional certifications. He has also competed in many security competitions, including taking first place at a regional NetWars competition and a

U.S. Cyber Challenge capture-the-flag competition, as well as joining the Red Team for the Pacific Rim Collegiate Cyber Defense Competition. His personal blog can be found at http://je�mcjunkin.com/. @je�mcjunkinU.S. Cyber Challenge capture-the-flag competition, as well as joining the Red Team for the Pacific Rim Collegiate Cyber Defense

Register at www.sans.org/san-francisco-winter | 301-654-SANS (7267) 6

“My forensic knowledge increased more in the last five days than in the last year.” -VITO ROCCO,

UNIVERSITY OF NEVADA

FOR500 (formerly FOR408)Windows Forensic Analysis

GCFE CertificationForensic Examiner

www.giac.org/gcfe

Six-Day Program Mon, Nov 27 - Sat, Dec 2 9:00am - 5:00pm 36 CPEs Laptop Required Instructor: Heather Mahalik

Who Should Attend Information security professionals

Incident response team members

Law enforcement o°cers, federal agents, and detectives

Media exploitation analysts

Anyone interested in a deep understanding of Windows forensics

M A S T E R W I N D O W S F O R E N S I C S – YO U C A N ’ T P R O T E C T W H AT YO U D O N ’ T K N O W A B O U T

All organizations must prepare for cyber-crime occurring on their computer systems and within their networks. Demand has never been greater for analysts who can investigate crimes, such as fraud, insider threats, industrial espionage, employee misuse, and computer intrusions. Government agencies increasingly require trained media exploitation specialists to recover vital intelligence from Windows systems. To help solve these cases, SANS is training a new cadre of the world’s best digital forensic professionals, incident responders, and media exploitation experts capable of piecing together what happened on computer systems second by second.

FOR500: Windows Forensic Analysis focuses on building in-depth digital forensics knowledge of Microsoft Windows operating systems. You can’t protect what you don’t know about, and understanding forensic capabilities and artifacts is a core component of information security. You’ll learn how to recover, analyze, and authenticate forensic data on Windows systems, track particular user activity on your network, and organize findings for use in incident response, internal investigations, and civil/criminal litigation. You’ll be able to use your new skills to validate security tools, enhance vulnerability assessments, identify insider threats, track hackers, and improve security policies. Whether you know it or not, Windows is silently recording an unbelievable amount of data about you and your users. FOR500 teaches you how to mine this mountain of data.

Proper analysis requires real data for students to examine. The completely updated FOR500 course trains digital forensic analysts through a series of new, hands-on laboratory exercises that incorporate evidence found on the latest Microsoft technologies (Windows 7, Windows 8/8.1, Windows 10, Office and Office365, cloud storage, SharePoint, Exchange, Outlook). Students leave the course armed with the latest tools and techniques, prepared to investigate even the most complicated systems they might encounter. Nothing is left out – attendees learn to analyze everything from legacy Windows 7 systems to just-discovered Windows 10 artifacts.

FOR500: Windows Forensic Analysis will teach you to: Conduct in-depth forensic analysis of Windows operating systems and media exploitation focusing on Windows 7, Windows 8/8.1, Windows 10, and Windows Server 2008/2012/2016 Identify artifact and evidence locations to answer critical questions, including application execution, file access, data theft, external device usage, cloud services, geolocation, file download, anti-forensics, and detailed system usage Focus your capabilities on analysis instead of on how to use a particular tool Extract critical answers and build an in-house forensic capability via a variety of free, open-source, and commercial tools provided within the SANS Windows SIFT Workstation

www.sans.edu

WITH THIS COURSE www.sans.org/ondemand

Heather Mahalik SANS Senior InstructorHeather has worked on high-stress and high-profile cases, investigating everything from child exploitation to Osama Bin Laden’s media. She has helped law enforcement, eDiscovery firms, and the federal government extract and manually decode artifacts used in solving investigations around the world. All told she has more than 14 years of experience in digital forensics, including eight years focused on mobile forensics – there’s hardly a device or platform she hasn’t researched or examined or a commercial tool she hasn’t used. These days Heather is the Director of Forensic Engineering at ManTech CARD. Heather

previously led the mobile device team for Basis Technology, where she focused on mobile device exploitation in support of the federal government. She also worked as a forensic examiner at Stroz Friedberg and the U.S. State Department Computer Investigations and Forensics Lab, where she handled a number of high-profile cases. She has also developed and implemented forensic training programs and standard operating procedures. @HeatherMahalik

previously led the mobile device team for Basis Technology, where she focused on mobile device exploitation in support of

See page 13 for details.See page 13 for details.

For course updates, prerequisites, special notes, or laptop requirements, visit www.sans.org/event/san-francisco-winter-2017/courses 7

“This is the perfect course for all members of a cyber threat intel team.” -SCOTT R., U.S. MARINE CORPS

Scott Roberts SANS InstructorScott Roberts is an incident responder, manager, and developer at GitHub, the world’s code collaborative development platform. Scott has worked major investigations involving criminal fraud and abuse and nation-state espionage while with Symantec, Mandiant, and others. He is a sought-after speaker, having presented on threat intelligence and incident response for SANS, Silicon Valley, and various BSides events. He is an author of O’Reilly’s upcoming Intelligence Driven Incident Response. Scott is also a member of the SANS CTI Summit and NYU Poly CSAW advisory boards. @sroberts

GCTI CertificationAvailable Late 2017

WITH THIS COURSE www.sans.org/ondemand

FOR578Cyber Threat Intelligence

Five-Day Program Mon, Nov 27 - Fri, Dec 1 9:00am - 5:00pm 30 CPEs Laptop Required Instructor: Scott Roberts

Who Should Attend Incident response team members

Threat hunters

Experienced digital forensic analysts

Security Operations Center personnel and information security practitioners

Federal agents and law enforcement o°cials

SANS FOR500 (formerly FOR408), FOR572, FOR508, or FOR610 graduates looking to take their skills to the next level

Make no mistake: current network defense, threat hunting, and incident response practices contain a strong element of intelligence and counterintelligence that cyber analysts must understand and leverage in order to defend their networks, proprietary data, and organizations.

FOR578: Cyber Threat Intelligence will help network defenders, threat hunting teams, and incident responders to:

Understand and develop skills in tactical, operational, and strategic-level threat intelligence Generate threat intelligence to detect, respond to, and defeat advanced persistent threats (APTs) Validate information received from other organizations to minimize resource expenditures on bad intelligence Leverage open-source intelligence to complement a security team of any size Create Indicators of Compromise (IOCs) in formats such as YARA, OpenIOC, and STIX

The collection, classification, and exploitation of knowledge about adversaries – collectively known as cyber threat intelligence – gives network defenders information superiority that is used to reduce the adversary’s likelihood of success with each subsequent intrusion attempt. Responders need accurate, timely, and detailed information to monitor new and evolving attacks, as well as methods to exploit this information to put in place an improved defensive posture.

Cyber threat intelligence thus represents a force multiplier for organizations looking to update their response and detection programs to deal with increasingly sophisticated advanced persistent threats. Malware is an adversary’s tool, but the real threat is the human one, and cyber threat intelligence focuses on countering those flexible and persistent human threats with empowered and trained human defenders.

During a targeted attack, an organization needs a top-notch, cutting-edge threat hunting or incident response team armed with the threat intelligence necessary to understand how adversaries operate and to counter the threat. FOR578: Cyber Threat Intelligence will train you and your team in the tactical, operational, and strategic-level cyber threat intelligence skills and tradecraft required to make security teams better, threat hunting more accurate, incident response more effective, and organizations more aware of the evolving threat landscape.

T H E R E I S N O T E A C H E R B U T T H E E N E M Y !

“This course gives a very smart and structured approach to cyber threat intelligence, something that the global community has been lacking to date.”

-JOHN GEARY, CITIGROUP

Register at www.sans.org/san-francisco-winter | 301-654-SANS (7267) 8

MGT512SANS Security Leadership Essentials for Managers with Knowledge Compression™

GSLC CertificationSecurity Leadership

www.giac.org/gslc

Five-Day Program Mon, Nov 27 - Fri, Dec 1 9:00am - 6:00pm (Days 1-4) 9:00am - 4:00pm (Day 5) 33 CPEs Laptop Recommended Instructor: Robert Kirtley

Who Should Attend All newly appointed information security o°cers

Technically skilled administrators who have recently been given leadership responsibilities

Seasoned managers who want to understand what their technical people are telling them

This completely updated course is designed to empower advancing managers who want to get up to speed quickly on information security issues and terminology. You won’t just learn about security, you will learn how to manage security. Lecture sections are intense; the most common student comment is that it’s like drinking from a fire hose. The diligent manager will gain the vital, up-to-date knowledge and skills required to supervise the security component of any information technology project. Additionally, the course has been engineered to incorporate the NIST Special Publication 800 (series) guidance so that it can be particularly useful to U.S. government managers and supporting contractors.

Essential security topics covered in this management track include network fundamentals and applications, power, cooling and safety, architectural approaches to defense in-depth, cyber attacks, vulnerability assessment and management, security policies, contingency and continuity planning, awareness management, risk management analysis, incident handling, web application security, and offensive and defensive information warfare, culminating with our management practicum. The material uses Knowledge Compression,™ special charts, and other proprietary SANS techniques to help convey the key points of critical slides and keep the information flow rate at a pace senior executives demand every teaching hour of the course. The course has been evaluated and approved by CompTIA’s CAQC program for Security+ 2008 to ensure that managers and their direct reports have a common baseline for security terminology and concepts. You will be able to put what you learn into practice the day you get back into the office.

Knowledge Compression™Maximize your learning potential!Knowledge Compression™ is an optional add-on feature to a SANS class that aims to maximize the absorption and long-term retention of large amounts of data over a relatively short period of time. Through the use of specialized training materials, in-class reviews, examinations and test-taking instruction, Knowledge Compression™ ensures students have a solid understanding of the information presented to them. By attending classes that feature this advanced training product, you will experience some of the most intense and rewarding training programs SANS has to o�er, in ways that you never thought possible!

www.sans.edu

“I have some very specific, achievable things I can do right away suggested by the course that will benefit my organization and me. That’s valuable training.” -WILLIAM E. WEYANDT,

AMERICAN ORTHODONTICS

www.sans.org/8140

Robert Kirtley SANS InstructorRobert Kirtley has over 20 years of management consulting experience with a focus on providing strategy, operations, and technology infrastructure services in the areas of compliance, operations, information governance, and security. Robert has managed hundreds of client engagements, with teams ranging from two people to more than 100. Robert has focused his career on creating consulting practices that serve law firms and corporate legal clients. With Deloitte, he created the Strategic Legal Solutions practice to enable the firm to have a comprehensive practice focused on serving the needs of attorneys with a broad array

of strategy, operations and technology services. With Du� & Phelps, Robert started and built the Legal Management Consulting practice with an emphasis on supporting corporate legal groups and law firm clients. Robert also created the Information Security, Governance and Computer Forensics practices for Kraft Kennedy, a law firm and legal department consulting firm. Robert is currently consulting on a range of information governance, information management, security and compliance issues with a range of corporate, government and law firm clients. @RobertNKirtley

of strategy, operations and technology services. With Du� & Phelps, Robert started and built the Legal Management Consulting

WITH THIS COURSE www.sans.org/ondemand

For course updates, prerequisites, special notes, or laptop requirements, visit www.sans.org/event/san-francisco-winter-2017/courses 9

GSTRT CertificationStrategic Policy, Planning, and LeadershipMGT514

IT Security Strategic Planning, Policy, and Leadership

Five-Day Program Mon, Nov 27 - Fri, Dec 1 9:00am - 5:00pm 30 CPEs Laptop NOT Needed Instructors: Frank Kim,

Russell Eubanks

Who Should Attend Chief Information Security O°cers (CISOs)

Information security o°cers

Security directors

Security managers

Aspiring security leaders

Other security personnel who have team lead or management responsibilities

As security professionals, we have seen the landscape change. Cybersecurity is now more vital and relevant to the growth of organizations than ever before. As a result, information security teams have more visibility, more budget, and more opportunity. However, with this increased responsibility comes more scrutiny.

This course teaches security professionals how to handle three critical tasks:

• Develop Strategic Plans Strategic planning is hard for people in IT and IT security, because we spend so much time responding and reacting. We almost never get to practice until we get promoted to a senior position, and then we are not equipped with the skills we need to run with the pack. Learn how to develop strategic plans that resonate with other IT and business leaders.

• Create Effective Information Security Policy Policy is a manager’s opportunity to express expectations for the workforce, set the boundaries of acceptable behavior, and empower people to do what they ought to be doing. It is easy to get wrong. Have you ever seen a policy and your response was, “No way, I am not going to do that!”? Policy must be aligned with an organization’s culture. We will break down the steps to policy development so that you have the ability to develop and assess policy to successfully guide your organization.

• Develop Management and Leadership Skills Leadership is a capability that must be learned, exercised, and developed to better ensure organizational success. Strong leadership is brought about primarily through selfless devotion to the organization and staff, tireless effort in setting the example, and the vision to see and effectively use available resources toward the end goal. Effective leadership entails persuading team members to accomplish their objectives while removing obstacles and maintaining the well-being of the team in support of the organization’s mission. Learn to utilize management tools and frameworks to better lead, inspire, and motivate your teams.

www.sans.edu

WITH THIS COURSE www.sans.org/ondemand

Frank Kim SANS Certified InstructorFrank leads the security risk function for the most trusted source of computer security training, certification, and research in the world. He also helps shape, develop, and support the next generation of security leaders by teaching, developing courseware, and leading the management and software security curricula. Prior to the SANS Institute, Frank was Executive Director of Cyber Security at Kaiser Permanente with responsibility for delivering innovative security solutions to meet the unique needs of the nation’s largest not-for-profit health plan and integrated health care provider with annual revenue of $55 billion,

9.5 million members, and 175,000 employees. In recognition of his work, Frank was a two-time recipient of the CIO Achievement Award for business-enabling thought leadership. Frank holds degrees from the University of California at Berkeley and is the author of popular SANS courseware on strategic planning, leadership, and application security. @fykim

Russell Eubanks SANS Certified InstructorRussell Eubanks is vice president and CISO for the Federal Reserve Bank of Atlanta. He is responsible for developing and executing the information security strategy for both the Retail Payments O°ce and the Atlanta Reserve Bank. Russell has developed information security programs from the ground up and actively seeks opportunities to measurably increase their overall security posture. Russell is a handler for the SANS Internet Storm Center, serves on the editorial panel for the Critical Security Controls, and maintains securityeverafter.com. He holds a bachelor’s degree in computer science from the University of

Tennessee at Chattanooga. @russelleubanks

9.5 million members, and 175,000 employees. In recognition of his work, Frank was a two-time recipient of the CIO Achievement

Tennessee at Chattanooga.

“Frank is an excellent instructor who had a solid grasp of the material and provided unique insight into real-world scenarios and practices.” -DAVE ODOM, BECHTEL

www.giac.org/gstrt

10 Register at www.sans.org/san-francisco-winter | 301-654-SANS (7267)

MGT517Managing Security Operations: Detection, Response, and Intelligence NEW!

Five-Day Program Mon, Nov 27 - Fri, Dec 1 9:00am - 5:00pm 30 CPEs Laptop Required Instructor: Christopher Crowley

Who Should Attend Information security managers

Security Operations Center managers, analysts, and engineers

Information security architects

IT managers

Operations managers

Risk management professionals

IT/system administration/network administration professionals

IT auditors

Business continuity and disaster recovery sta�

This course covers the design, operation, and ongoing growth of all facets of the security operations capabilities in an organization. An effective Security Operations Center (SOC) has many moving parts and must be designed to have the ability to adjust and work within the context and constraints of an organization. To run a successful SOC, managers need to provide tactical and strategic direction and inform staff of the changing threat environment, as well as provide guidance and training for employees. This course covers design, deployment, and operation of the security program to empower leadership through technical excellence.

The course covers the functional areas of Communications, Network Security Monitoring, Threat Intelligence, Incident Response, Forensics, and Self-Assessment. We discuss establishing security operations governance for:

Business alignment and ongoing adjustment of capabilities and objectives

Designing the SOC and the associated objectives of functional areas

Software and hardware technology required for performance of functions

Knowledge, skills, and abilities of sta�, as well as sta� hiring and training

Execution of ongoing operations

You will walk out of this course armed with a roadmap to design and operate an effective SOC tailored to the needs of your organization.

Course Author Statement“The inclusion of all functional areas of security operations is intended to develop a standardized program for an organization and express all necessary capabilities. Admittedly ambitious, the intention of the class is to provide a unified picture of coordination among teams with di�erent skillsets to help the business prevent loss due to poor security practices. I have encountered detrimental compartmentalization in most organizations. There is a tendency for specialists to look only at their piece of the problem, without understanding the larger scope of information security within an organization. Organizations are likely to perceive a Security Operations Center (SOC) as a tool, and not as the unification of people, processes, and technologies.

This course provides a comprehensive picture of a Cybersecurity Operations Center. Discussion on the technology needed to run a SOC is handled in a vendor-agnostic way. In addition, technology is addressed in a way that attempts to address both minimal budgets as well as budgets with global scope. The course outlines sta� roles, addresses sta� training through internal training and information-sharing, and examines the interaction between functional areas and data exchange.

After attending this class, the participant will have a roadmap for what needs to be done in an organization seeking to implement security operations.”

-Christopher Crowley

Christopher Crowley SANS Principal InstructorChristopher has 15 years of industry experience managing and securing networks. He currently works as an independent consultant in the Washington, D.C. area. His work experience includes penetration testing, computer network defense, incident response, and forensic analysis. He is the course author for SANS MGT535: Incident Response Team Management and holds the GSEC, GCIA, GCIH (gold), GCFA, GPEN, GREM, GMOB, and CISSP certifications. His teaching experience includes SEC401, SEC503, SEC504, SEC560, SEC575, SEC580, FOR585, and MGT535; Apache web server administration and configuration; and shell

programming. He was awarded the SANS 2009 Local Mentor of the Year Award, which is given to SANS Mentors who excel in leading SANS Mentor Training classes in their local communities. @CCrowMontanceprogramming. He was awarded the SANS 2009 Local Mentor of the Year Award, which is given to SANS Mentors who excel in leading

“Wow! Chris is wicked smart, knows this space, and is a real expert. It would be very hard to do better or have a more solid presentation.” -MICHAEL CARTER, LDS CHURCH

Bonus SessionsEnrich your SANS training experience! Evening talks led by our instructors and selected subject-matter experts help you broaden your knowledge, hear from the voices that matter in computer security, and get the most for your training dollar.

KEYNOTE: Windows Exploratory Surgery with Process HackerJason FossenIn this talk we’ll rummage around inside the guts of Windows, while on the lookout for malware, using a free tool named Process Hacker (similar to Process Explorer). Understanding processes, threads, drivers, handles, and other OS internals is important for analyzing malware, performing forensics, troubleshooting, and hardening the OS. If you have a laptop, get Process Hacker from SourceForge.net, and together we’ll take a peek under the graphical user interface to learn about Windows internals and how to use Process Hacker for combating malware.

Phoning It In: Heather Talks About Smartphone ForensicsHeather MahalikSmartphone forensics is complicated. The most common thing you will hear when asked if data can be extracted is, “ it depends.” It depends on the state of the phone--if it’s locked, encrypted, etc. Additionally, it depends on your forensic tools and if they are capable of decoding the smartphone data. What if the tools fail you? Will you know how to hunt the data and uncover the artifacts that support your investigation? In this webcast, we will discuss common smartphone security trends, acquisition and analysis hurdles, and methods for ensuring your forensic tools are presenting the data correctly.

• Let employees train on their own schedule

• Tailor modules to address specific audiences

• Courses translated into many languages

• Test learner comprehension through module quizzes

• Track training completion for compliance reporting purposes

End UserCIP v5/6

ICS EngineersDevelopersHealthcare

Visit SANS Securing The Human atsecuringthehuman.sans.org

Security Awareness Training by the Most Trusted Source

Computer-based Training for Your Employees

Change Human Behavior | Manage Risk | Maintain Compliance | Protect Your Brand

Security Awareness Training by the Most Trusted Source

Protect Your EmployeesKeep your organization safe with flexible, computer-based training.

End UserCIP

ICS EngineersDevelopersHealthcare

• Train employees on their own schedule• Modify modules to address specific audiences• Increase comprehension – courses translated into many languages• Test learner comprehension through module quizzes• Track training completion for compliance reporting purposes

Learn more about SANS Security Awareness at:securingthehuman.sans.org

Change Human Behavior | Manage Risk | Maintain Compliance | Protect Your Brand

11

Future Training Events

Future Community SANS Events

Network Security Las Vegas, NV Sep 10-17

Baltimore Fall . . . . . . . . . . . . . . Baltimore, MD . . . . . . . . Sep 25-30Rocky Mountain Fall . . . . . . . . . Denver, CO . . . . . . . . . . .Sep 25-30Phoenix-Mesa . . . . . . . . . . . . . . Mesa, AZ . . . . . . . . . . . . . . Oct 9-14Tysons Corner Fall . . . . . . . . . . McLean, VA . . . . . . . . . . . Oct 14-21San Diego . . . . . . . . . . . . . . . . . San Diego, CA . . . . . . Oct 30 - Nov 4Seattle . . . . . . . . . . . . . . . . . . . . Seattle, WA . . . . . . . . Oct 30 - Nov 4Miami . . . . . . . . . . . . . . . . . . . . Miami, FL . . . . . . . . . . . . . Nov 6-11San Francisco Winter . . . . . . . . San Francisco, CA . . .Nov 27 - Dec 2Austin Winter . . . . . . . . . . . . . . Austin, TX . . . . . . . . . . . . . .Dec 4-9

Cyber Defense Washington, DC Dec 12-19 Initiative

Security East New Orleans, LA Jan 8-13, 2018

Northern VA Winter – Reston . . Reston, VA . . . . . . . . . . . . Jan 15-20Las Vegas . . . . . . . . . . . . . . . . . Las Vegas, NV . . . . . .Jan 28 - Feb 2Miami . . . . . . . . . . . . . . . . . . . . Miami, FL . . . . . . . . .Jan 29 - Feb 3Scottsdale . . . . . . . . . . . . . . . . . Scottsdale, AZ . . . . . . . . . . Feb 5-10Anaheim . . . . . . . . . . . . . . . . . . Anaheim, CA . . . . . . . . . . Feb 12-17Dallas . . . . . . . . . . . . . . . . . . . . Dallas, TX . . . . . . . . . . . . Feb 19-24New York City Winter . . . . . . . . New York, NY . . . . . . Feb 26 - Mar 3San Francisco Spring . . . . . . . . San Francisco, CA . . . . . . Mar 12-17Pen Test Austin . . . . . . . . . . . . . Austin, TX . . . . . . . . . . . . Mar 17-24Northern VA Spring – Tysons . . McLean, VA . . . . . . . . . . .Mar 19-24

Future Summit EventsSecure DevOps . . . . . . . . . . . . . Denver, CO . . . . . . . . . . . .Oct 10-17SIEM & Tactical Analytics . . . . . Scottsdale, AZ . . . . . Nov 28 - Dec 5Cyber Threat Intelligence . . . . . Bethesda, MD . . Jan 29 - Feb 5, 2018Cloud Security . . . . . . . . . . . . . San Diego, CA . . . . . . . . . . Feb 19-26ICS Security . . . . . . . . . . . . . . . . Orlando, FL. . . . . . . . . . . . Mar 19-26

Local, single-course events are also offered throughout the year via SANS Community. Visit www.sans.org/community for up-to-date Community course information.12

Registration Information

Cancellation & Access PolicyIf an attendee must cancel, a substitute may attend instead. Substitution requests can be made at any time prior to the event start date. Processing fees will apply. All substitution requests must be submitted by email to registration@sans.org. If an attendee must cancel and no substitute is available, a refund can be issued for any received payments by November 8, 2017. A credit memo can be requested up to the event start date. All cancellation requests must be submitted in writing by mail or fax and received by the stated deadlines. Payments will be refunded by the method that they were submitted. Processing fees will apply.

SANS Voucher ProgramExpand your training budget! Extend your fiscal year. The SANS Voucher Program provides flexibility and may earn you bonus funds for training.

www.sans.org/vouchers

Pay Early and Save*

DATE DISCOUNT DATE DISCOUNT

Pay & enter code by 10-4-17 $400.00 10-25-17 $200.00

*Some restrictions apply. Early bird discounts do not apply to Hosted courses.

Use code EarlyBird17 when registering early

REGISTER ONLINE AT www.sans.org/san-francisco-winterwww.sans.org/san-francisco-winter

WE RECOMMEND YOU REGISTER EARLY TO ENSURE WE RECOMMEND YOU REGISTER EARLY TO ENSURE YOU GET YOUR FIRST CHOICE OF COURSES.YOU GET YOUR FIRST CHOICE OF COURSES.Select your course and indicate whether you plan to test for Select your course and indicate whether you plan to test for GIAC certification. If the course is still open, the secure, online registration server will accept your registration. Sold-out courses will be removed from the online registration. Everyone with Internet access must complete the online registration form. We do not take registrations by phone.

SANS SimulcastTo register for a

SANS San Francisco Winter 2017 Simulcast course, please visit

www.sans.org/event/ san-francisco-winter-2017/

attend-remotely

Top 5 reasons to stay at the Hilton San Francisco Union Square1 All SANS attendees receive complimentary high-

speed Internet when booking in the SANS block.2 No need to factor in daily cab fees and the time

associated with travel to alternate hotels.3 By staying at the Hilton San Francisco Union

Square, you gain the opportunity to further network with your industry peers and remain in the center of the activity surrounding the training event.

4 SANS schedules morning and evening events at the Hilton San Francisco Union Square that you won’t want to miss!

5 Everything is in one convenient location!

The Hilton San Francisco Union Square boasts an ideal location in the heart of downtown San Francisco with easy access to Nob Hill, Chinatown, and fantastic shopping, dining, and entertainment in and around Union Square. Enjoy proximity to attractions such as the Golden Gate Bridge, Fisherman’s Wharf and the Marina, and easy access to public transportation such as MUNI, BART, and the city’s famous cable cars.

Special Hotel Rates AvailableA special discounted rate of $239.00 S/D will be honored based on space availability. Government per diem rooms are available with proper ID; you will need to call reservations and ask for the SANS government rate. These rates include high-speed Internet in your room and are only available through November 4, 2017.

Hilton San Francisco Union Square 333 O’Farrell Street San Francisco, CA 94102 Phone: 415-771-1400 www.sans.org/event/san-francisco-winter-2017/location

Hotel Information

13

5705 Salem Run Blvd.Suite 105Fredericksburg, VA 22407

B R O C H U R E C O D E

Save $400 when you pay for any 4-, 5-, or 6-day course and enter the code “EarlyBird17” before January 4th.

www.sans.org/dallas

To be removed from future mailings, please contact unsubscribe@sans.org or (301) 654-SANS (7267). Please include name and complete address. NALT-BRO-DALLAS17

Open a SANS Account todayto enjoy these FREE resources:

W E B C A S T SAsk The Expert Webcasts – SANS experts bring current and timely information on relevant topics in IT Security.

Analyst Webcasts – A follow-on to the SANS Analyst Program, Analyst Webcasts provide key information from our whitepapers and surveys.

WhatWorks Webcasts – The SANS WhatWorks webcasts bring powerful customer experiences showing how end users resolved specific IT Security issues.

Tool Talks – Tool Talks are designed to give you a solid understanding of a problem, and to show how a vendor’s commercial tool can be used to solve or mitigate that problem.

N E W S L E T T E R SNewsBites – Twice-weekly high-level executive summary of the most important news relevant to cybersecurity professionals

OUCH! – The world’s leading monthly free security-awareness newsletter designed for the common computer user

@RISK: The Consensus Security Alert – A reliable weekly summary of (1) newly discovered attack vectors, (2) vulnerabilities with active new exploits, (3) how recent attacks worked, and (4) other valuable data

OT H E R F R E E R E S O U R C E S InfoSec Reading Room

Top 25 Software Errors

20 Critical Controls

Security Policies

Intrusion Detection FAQs

Tip of the Day

Security Posters

Thought Leaders

20 Coolest Careers

Security Glossary

SCORE (Security Consensus Operational Readiness Evaluation)

www.sans.org/account