ＨｉｄｅＺｅｒｏＯｎｅ

The world is changing and so is the data we need to conduct our investigations. Cloud platforms change how data is stored and accessed. They remove the examiner’s ability to put their hands directly on the systems. Many examiners are trying to force old methods for on-premise examination onto cloud hosted platforms. Rather than resisting change, examiners must learn to embrace the new opportunities presented to them in the form of new evidence sources. FOR509: Enterprise Cloud Forensics and Incident Response addresses today’s need to bring examiners up to speed with the rapidly changing world of enterprise cloud environments by uncovering the new evidence sources that only exist in the Cloud.

FOR509.1: Microsoft 365 and Graph API
FOR509.2: Microsoft Azure
FOR509.3: Amazon (AWS)
FOR509.4: Google Workspace
FOR509.5: Google Cloud
FOR509.6: Multi-Cloud Intrusion Challenge

FOR509: Enterprise Cloud Forensics and Incident Response

The rapid adoption of cloud services has created exciting new business capabilities and new cyber-attack opportunities. To detect these threats, companies require skilled security analysts who understand attack techniques, perform cloud security monitoring and investigations, and detection capabilities across the organization. The SEC541 course focuses on Cloud Threat Detection, covering various attack techniques used against cloud infrastructure and teaching the observation, detection, and analysis of cloud telemetry. With 20 hands-on labs and CTF, this course equips security analysts, detection engineers, and threat hunters with practical skills and knowledge to safeguard their organization’s cloud infrastructure against potential threats. Upon completion, you can apply these newfound skills to help keep your organization’s cloud infrastructure secure.

SEC541.1: Management Plane and Networking Logging
SEC541.2: Computer and Cloud Services Logging
SEC541.3: Cloud Services and Data Discovery
SEC541.4: Microsoft Ecosystem
SEC541.5: Automate Response Actions and CloudWars

SEC541: Cloud Security Attacker Techniques, Monitoring, and Threat Detection

Performing IT security audits at the enterprise level can be an overwhelming task. It is difficult to know where to start and which controls should be audited first. Audits often focus on things that are not as important, wasting precious time and resources. Management is left in the dark about the real risk to the organization’s mission. Operations staff can’t use the audit report to reproduce or remediate findings. AUD507 gives the student the tools, techniques and thought processes required to perform meaningful risk assessments and audits. Learn to use risk assessments to recommend which controls should be used and where they should be placed. Know which tools will help you focus your efforts and learn how to automate those tools for maximum effectiveness. 20 Hands-On Exercises

AUD507.1: Audit in the Enterprise and Cloud
AUD507.2: PowerShell, Windows System, and Domain Auditing
AUD507.3: Auditing Linux
AUD507.4: Auditing Cloud Infrastructure
AUD507.5: Auditing Web Applications
AUD507.6: Audit Wars

AUD507: Auditing Systems, Applications, and the Cloud