This is an advanced course that assumes the attendee is a qualified security professional with experience using security tools and understands the concepts behind penetration testing. Courses that build up the expertise that enables a student to succeed in this course is Security+, CEH, CISSP, and any of the GIAC certifications. This course is completely hands-on and utilizes the BackTrack tool suite from backtrack-linux.org. The course covers, in detail, various attacks and tools that are contained in the BackTrack tool suite.
Attendees to TN-335: Advanced Penetration Testing Using Open Source Tools will receive TechNow approved course materials and expert instruction.
Dates/Locations:
No Events
Duration: 5 days
Course Objectives:
Information Security and Open Source Software
Operating System Tools
Firewalls
Scanners
Vulnerability Scanners
Network Sniffers
Intrusion Detection Systems
Analysis and Management Tools
Encryption Tools
Wireless Tools
Forensic Tools
More on Open Source Software
Prerequisites:
Experience in IT Security
Solid basic knowledge of networks and TCP/IP
Experience in command line under Linux and Windows is required
AWS System Operations begins with a one day introduction to AWS products, services, and common solutions. It provides you with fundamentals to become more proficient in identifying AWS services so that you can make informed decisions about IT solutions based on your business requirements and get started working on AWS.
The AWS course continues to flow with teaching those in a Systems Administrator or Developer Operations (DevOps) role how to create automatable and repeatable deployments of networks and systems on the AWS platform. The course covers the specific AWS features and tools related to configuration and deployment, as well as common techniques used throughout the industry for configuring and deploying systems.
To continue to learn more about AWS, TechNow has the following course:
Attendees to CL-415: AWS System Operations will receive TechNow approved course materials and expert instruction.
Duration: 5 Days
Audience:
This course is intended for:
• System Administrators
• Software Developers, especially those in a Developer Operations (DevOps) role
DoD 8140: Not Mandated
Course Prerequisites:
We recommend that attendees of this course have the following prerequisites:
• Background in either software development or systems administration
• Some experience with maintaining operating systems at the command line (shell scripting in Linux environments, cmd or PowerShell in Windows)
• Basic knowledge of networking protocols (TCP/IP, HTTP)
Course Objectives:
This course is designed to teach you how to:
• Understand basic data center design concepts.
• Recognize terminology and concepts as they relate to the AWS platform and navigate the AWS Management Console.
• Understand the foundational infrastructure services, including Amazon Virtual Private Cloud (VPC), Amazon Elastic Compute Cloud (EC2), Amazon Elastic Block Store (EBS), Amazon Simple Storage Service (S3), Auto Scaling, and Elastic Load Balancing (ELB).
• Understand the security measures AWS provides and key concepts of AWS Identity and Access Management (IAM).
• Understand AWS database services, including Amazon DynamoDB and Amazon Relational Database Service (RDS).
• Understand AWS management tools, including Amazon CloudWatch and AWS Trusted Advisor.
• Use standard AWS infrastructure features such as Amazon Virtual Private Cloud (VPC), Amazon Elastic Compute Cloud (EC2), Elastic Load Balancing, and Auto Scaling from the command line
• Use AWS CloudFormation and other automation technologies to produce stacks of AWS resources that can be deployed in an automated, repeatable fashion
• Build functioning virtual private networks with Amazon VPC from the ground up using the AWS Management Console
• Deploy Amazon EC2 instances using command line calls and troubleshoot the most common problems with instances
• Monitor the health of Amazon EC2 instances and other AWS services
• Manage user identity, AWS permissions, and security in the cloud
• Manage resource consumption in an AWS account using tools such as Amazon CloudWatch, tagging, and Trusted Advisor
• Select and implement the best strategy for creating reusable Amazon EC2 instances
• Configure a set of Amazon EC2 instances that launch behind a load balancer, with the system scaling up and down in response to demand
• Edit and troubleshoot a basic AWS CloudFormation stack definition
Dates/Locations: No Events
Course Outline:
Day 1
• Introduction and History of AWS
• AWS Infrastructure: Compute, Storage, and Networking
• AWS Security, Identity, and Access Management
• AWS Databases
• AWS Management Tools
Day 2
• System Operations on AWS Overview
• Networking in the Cloud
• Computing in the Cloud Day 3
• Storage and Archiving in the Cloud
• Monitoring in the Cloud
• Managing Resource Consumption in the Cloud Day 4
• Configuration Management in the Cloud
• Creating Scalable Deployments in the Cloud
• Creating Automated and Repeatable Deployments Day 5 Full Day Lab
• Select the appropriate AWS service based on compute, data, or security requirements
• Execute steps required to provision cloud resources for selected deployment
• Identify and implement data protection, encryption, and capacity planning
• Implement and manage security policies, access controls, and role
• Implement Automation
Windows Security Automation and Threat Hunting with PowerShell Seminar
Location: 400 W Wisconsin Ave, Milwaukee, WI 53203, USA
Date: October 10, 2018 8:00am – 4:00pm
Duration: 8 hours
Audience: Cyber Security professionals and Windows administrators
Attendees Environment: Laptops not required, but suggested to have better hands-on absorption of subject matter.
Description:
PowerShell is both a command-line shell and scripting language. Fight fires quickly using existing or custom PowerShell commands or scripts at the shell. PowerShell is made for Security Operations (SecOps) automation on Windows. This seminar does not require prior programming skills. The seminar focuses on PowerShell programming, giving a beginner skills to be productive in windows scripting to automate tasks and also remediate problems.
Cyber Security is the objective of this seminar, and the PowerShell examples will demonstrate PowerShell capabilities that help lock down a Windows system and also report security status.
Objectives:
PowerShell Overview
Getting started running commands
Security cmdlets
Using and updating the built-in help
Execution policies
Fun tricks with the ISE graphical editor
Piping .NET and COM objects, not text
Using properties and methods of objects
Helping Linux admins feel more at home
Aliases, cmdlets, functions, modules, etc.
PowerShell Utilities and Tips
Customizing your profile script
PowerShell remote command execution
Security setting across the network
File copy via PowerShell remoting
Capturing the output of commands
Parsing text files and logs with regex patterns
Parsing Security Logs
Searching remote event logs
Mounting the registry as a drive
Security settings in the Registry
Exporting data to CSV, HTML and JSON files
Running scripts as scheduled jobs
Continued Security Compliance
Pushing out scripts through Group Policy
Importing modules and dot-sourcing functions
http://www.PowerShellGallery.com
PowerShell Scripting
PowerShell Scripting to implement Security Practices
Writing your own functions to automate security status and settings
Passing arguments into your scripts
Function parameters and returning output
Flow control: if-then, foreach, that make security decisions
How to pipe data in/out of your scripts for security compliance and reporting
Attendees to this seminar, Windows Security Automation and Threat Hunting with PowerShell, will receive TechNow approved course materials and expert instruction.[/wr_text][/wr_column][/wr_row]
PowerShell is made for Security Operations (SecOps) automation on Windows. SecOps requires automation in order to scale out security changes and monitoring beyond a handful of hosts. For example, when a vulnerability must be remediated but there is no patch for it yet, automation is needed to quickly and consistently enact the changes necessary. PowerShell “remoting” is encrypted remote command execution of PowerShell scripts in a way that can scale to thousands of endpoints and servers.
Imagine being able to hunt for indicators of compromise across thousands of machines with just a few lines of PowerShell code. Or imagine having the local Administrator account password reset every night on thousands of endpoints in a secure way, and being able to retrieve that password securely too.
We will show you to do these tasks and more. Transcription logging for forensics, strong encryption code signing, application whitelisting of scripts, IPSec port control, and Just Enough Admin (JEA).
As more and more of our systems are moved up to the cloud, PowerShell will become even more important. Amazon Web Services, Microsoft Azure, Office 365, Hyper-V and VMware already support PowerShell administration for many tasks.
Attendees to TN-965: Windows Security Automation with PowerShell will receive TechNow approved course materials and expert instruction.
Date/Locations:
No Events
Duration: 5 days
Intended Audience This course is intended for IT Professionals already experienced in general Windows Server and Windows Client administration or already experienced in administering and supporting Application servers and services including applications like Exchange, SharePoint, and SQL. It is broadly intended for students who want to use Windows PowerShell to automate administrative tasks from the command line, using any Microsoft or independent software vendor (ISV) product that supports Windows PowerShell manageability.
Course Objectives:
PowerShell Overview and Tips
Getting started running commands
Using and updating the built-in help
Execution policies
Fun tricks with the ISE graphical editor
Piping .NET and COM objects, not text
Using properties and methods of objects
Helping Linux admins feel more at home
Aliases, cmdlets, functions, modules, etc.
Customizing your profile script
What Can We Do With PowerShell
PowerShell remote command execution
Fan-out remoting and security
File copy via PowerShell remoting
Capturing the output of commands
Parsing text files and logs with regex patterns
Searching remote event logs faster with XPath
Mounting the registry as a drive
Exporting data to CSV, HTML and JSON files
Parsing and mining nmap port scanner XML output
Running scripts as scheduled jobs
Pushing out scripts through Group Policy
Importing modules and dot-sourcing functions
http://www.PowerShellGallery.com
Write your own scripts
Writing your own functions
Passing arguments into your scripts
Function parameters and returning output
Flow control: if-then, do-while, foreach, switch
The .NET Framework class library: a playground
How to pipe data in/out of your scripts
Continuous Secure Configuration Enforcement
How to use Group Policy and PowerShell together
Automate with INF security templates
How to customize INF templates
Microsoft Security Compliance Manager (SCM)
SECEDIT.EXE scripting
Building an in-house security repository for SecOps/DevOps
NSA’s Secure Host Baseline GPOs
Group Policy Precision Targeting
Managing Group Policy Objects (GPOs) with PowerShell
LSDOU, Block Inheritance, Enforced GPOs
Group Policy permissions for targeting changes
ADMX templates for mass registry editing
Deploying PowerShell startup and logon scripts
WMI item-level targeting of GPO preferences
GPO scheduled tasks to run PowerShell scripts
Remote command execution via GPO (not remoting)
Empowering the Hunt Team to fight back!
Server Hardening for SecOps/DevOps
Server Manager scripting with PowerShell
Adding and removing roles and feature
Remotely inventory roles, features, and apps
Why Server Nano or Server Core
Running PowerShell automatically after service failure
Service account identities, passwords, and risks
Tools to reset service account passwords securely
PowerShell Desired State Configuration (DSC)
DSC is Configuration Management built in for free
Using DSC for continuous reinforcement of settings
Examples: sync files, install roles, manage groups
Auditing a remote target against a DSC MOF template
“ApplyAndAutoCorrect” mode for continuous enforcement
PowerShell Just Enough Admin (JEA)
JEA is Windows sudo, like on Linux
JEA is Windows setuid root, like on Linux
Restricting commands and arguments
Verbose transcription logging
How to set up and configure JEA
Privilege Access Workstations (PAWs)
PowerShell and WMI
Windows Management Instrumentation (WMI) service
What is WMI and why do hackers abuse it so much?
Using PowerShell to query WMI CIM classes
WMI authentication and traffic encryption
Inventory operating system versions and installed software
WMI remote command execution versus PowerShell remoting
PowerShell security best practices
PowerShell transcription logging to catch hackers
Prerequisites:
Previous Windows Server and Windows Client management knowledge and hands on experience.
Experience installing and configuring Windows Server into existing enterprise environments, or as standalone installations.
Knowledge and experience of network adapter configuration, basic Active Directory user administration, and basic disk configuration.
Knowledge and hands on experience specifically with Windows Server 2012/Windows Server 2012 R2 and Windows 8/Windows 8.1 would be of benefit but is not essential.
PowerShell is made for Security Operations (SecOps) automation on Windows. SecOps requires automation in order to scale out security changes and monitoring beyond a handful of hosts. For example, when a vulnerability must be remediated but there is no patch for it yet, automation is needed to quickly and consistently enact the changes necessary. PowerShell “remoting” is encrypted remote command execution of PowerShell scripts in a way that can scale to thousands of endpoints and servers.
Imagine being able to hunt for indicators of compromise across thousands of machines with just a few lines of PowerShell code. Or imagine having the local Administrator account password reset every night on thousands of endpoints in a secure way, and being able to retrieve that password securely too.
We will show you to do these tasks and more. Transcription logging for forensics, strong encryption code signing, application whitelisting of scripts, IPSec port control, and Just Enough Admin (JEA).
As more and more of our systems are moved up to the cloud, PowerShell will become even more important. Amazon Web Services, Microsoft Azure, Office 365, Hyper-V and VMware already support PowerShell administration for many tasks.
Attendees to TN-963: Windows Security Automation with PowerShell will receive TechNow approved course materials and expert instruction.
Date/Locations:
No Events
Duration: 3 days
Course Objectives:
Day One PowerShell Overview and Tips
Getting started running commands
Using and updating the built-in help
Execution policies
Fun tricks with the ISE graphical editor
Piping .NET and COM objects, not text
Using properties and methods of objects
Helping Linux admins feel more at home
Aliases, cmdlets, functions, modules, etc.
Customizing your profile script
What Can We Do With PowerShell
PowerShell remote command execution
Fan-out remoting and security
File copy via PowerShell remoting
Capturing the output of commands
Parsing text files and logs with regex patterns
Searching remote event logs faster with XPath
Mounting the registry as a drive
Exporting data to CSV, HTML and JSON files
Parsing and mining nmap port scanner XML output
Running scripts as scheduled jobs
Pushing out scripts through Group Policy
Importing modules and dot-sourcing functions
http://www.PowerShellGallery.com
Write your own scripts
Writing your own functions
Passing arguments into your scripts
Function parameters and returning output
Flow control: if-then, do-while, foreach, switch
The .NET Framework class library: a playground
How to pipe data in/out of your scripts
Day Two Continuous Secure Configuration Enforcement
How to use Group Policy and PowerShell together
Automate with INF security templates
How to customize INF templates
Microsoft Security Compliance Manager (SCM)
SECEDIT.EXE scripting
Building an in-house security repository for SecOps/DevOps
NSA’s Secure Host Baseline GPOs
Group Policy Precision Targeting
Managing Group Policy Objects (GPOs) with PowerShell
LSDOU, Block Inheritance, Enforced GPOs
Group Policy permissions for targeting changes
ADMX templates for mass registry editing
Deploying PowerShell startup and logon scripts
WMI item-level targeting of GPO preferences
GPO scheduled tasks to run PowerShell scripts
Remote command execution via GPO (not remoting)
Empowering the Hunt Team to fight back!
Server Hardening for SecOps/DevOps
Server Manager scripting with PowerShell
Adding and removing roles and feature
Remotely inventory roles, features, and apps
Why Server Nano or Server Core
Running PowerShell automatically after service failure
Service account identities, passwords, and risks
Tools to reset service account passwords securely
Day Three PowerShell Desired State Configuration (DSC)
DSC is Configuration Management built in for free
Using DSC for continuous reinforcement of settings