معماری و مهندسی امنیت | SANS SEC530: Defensible Security Architecture and Engineering

SEC530.1: معماری و مهندسی امنیت دفاعی

• Traditional Security Architecture Deficiencies
• Emphasis on Perimeter/Exploitation
• Lack of a True Perimeter (“De-perimeterization” as a Result of Cloud/Mobile)
• The Internet of Things
• Predominantly Network-centric
• Defensible Security Architecture
• Mindset
• Presumption of Compromise
• De-perimeterization
• Predominantly Network-centric
• Models
• Zero-Trust Model (Kindervag – Forrester)
• Intrusion Kill Chain
• Diamond Model of Intrusion Analysis
• Software-defined Networking and Virtual Networking
• Micro-Segmentation
• Threat, Vulnerability, and Data Flow Analysis
• Threat Vector Analysis
• Data Ingress Mapping
• Data Exfiltration Analysis
• Data Egress Mapping
• Detection Dominant Design
• Attack Surface Analysis
• Visibility Analysis
• Layer 1 Best Practices
• Network Closets
• Penetration Testing Dropboxes
• USB Keyboard Attacks (Rubber Ducky)
• Layer 2 Best Practices
• VLANs
• Hardening
• Private VLANs
• Layer 2 Attacks and Mitigation
• NetFlow
• Layer 2 and 3 NetFlow
• NetFlow, Sflow, Jflow, VPC Flow, Suricata and Endpoint Flow

SEC530.2: معماری و مهندسی امنیت شبکه

• Layer 3: Router Best Practices
• CIDR and Subnetting
• Layer 3 Attacks and Mitigation
• IP Source Routing
• ICMP Attacks
• Unauthorized Routing Updates
• Securing Routing Protocols
• Unauthorized Tunneling (Wormhole Attack)
• Layer 2 and 3 Benchmarks and Auditing Tools
• Baselines
• CISecurity
• Cisco’s Best Practices
• Cisco Autosecure
• DISA STIGs
• Nipper-ng
• Securing SNMP
• SNMP Community String Guessing
• Downloading the Cisco IOS Config via SNMP
• Hardening SNMP
• SNMPv3
• Securing NTP
• NTP Authentication
• NTP Amplification Attacks
• Bogon Filtering, Blackholes, and Darknets
• Bogon Filtering
• Monitoring Darknet Traffic
• Building an IP Blackhole Packet Vacuum
• IPv6
• Dual-Stack Systems and Happy Eyeballs
• IPv6 Extension Headers
• IPv6 Addressing and Address Assignment
• Securing IPv6
• IPv6 Firewall Support
• Scanning IPv6
• IPv6 Tunneling
• IPv6 Router Advertisement Attacks and Mitigation
• VPN
• Path MTU Issues
• Fragmentation Issues Commonly Caused by VPN
• Layer 3/4 Stateful Firewalls
• Router ACLs
• Linux and BSD Firewalls
• pfSense
• Stateful
• Proxy
• Web Proxy
• SMTP Proxy
• Augmenting with Phishing Protection and Detection Mechanisms
• Explicit vs. Transparent
• Forward vs. Reverse

SEC530.3: امنیت بر محوریت شبکه

• NGFW
• Application Filtering
• Implementation Strategies
• NIDS/NIPS
• IDS/IPS Rule Writing
• Snort
• Suricata
• Bro
• Network Security Monitoring
• Power of Network Metadata
• Know Thy Network
• Sandboxing
• Beyond Inline
• Integration with Endpoint
• Feeding the Sandbox Potential Specimens
• Malware Detonation Devices
• Encryption
• The “Encrypt Everything” Mindset
• Internal and External
• Free SSL/TLS Certificate Providers
• SSL/SSH Inspection
• SSL/SSH Decrypt Dumps
• SSL Decrypt Mirroring
• Certificate Pinning
• Malware Pins
• HSTS
• Crypto Suite Support
• Qualys SSL Labs
• Secure Remote Access
• Access into Organization
• Dual Factor for All Remote Access (and More)
• Google Authenticator/TOTP: Open Authentication
• IPSec VPNs
• SSH VPNs
• SSL/TLS VPN
• Jump Boxes
• Distributed Denial-of-Service
• Impact of Internet of Things
• Types of Attacks
• Mitigation Techniques

SEC530.4: امنیت با محوریت داده

• Application (Reverse) Proxies
• Full Stack Security Design
• Web Server
• App Server
• DB Server
• Web Application Firewalls
• Whitelisting and Blacklisting
• WAF Bypass
• Normalization
• Dynamic Content Routing
• Database Firewalls/Database Activity Monitoring
• Data Masking
• Advanced Access Controls
• Exfiltration Monitoring
• File Classification
• Data Discovery
• Scripts vs. Software Solutions
• Find Sensitive Data in Databases or Files/Folders
• Advanced Discovery Techniques such as Optical Character Recognition Scanning of Pictures and Saved Scan Files
• Methods of Classification
• Dynamic Access Control
• Data Loss Prevention (DLP)
• Network-based
• Endpoint-base
• Cloud Application Implementations
• Data Governance
• Policy Implementation and Enforcement
• Access Controls vs. Application Enforcement and Encryption
• Auditing and Restrictions
• Mobile Device Management (MDM) and Mobile Application Management (MAM)
• Security Policies
• Methods for Enforcement
• End-user Experience and Impact
• Private Cloud Security
• Securing On-premise Hypervisors (vSphere, Xen, Hyper-V)
• Network Segmentation (Logical and Physical)
• VM Escape
• Surface Reduction
• Visibility Advantages
• Public Cloud Security
• SaaS vs. PaaS vs. IaaS
• Shared Responsibility Implications
• Cloud Strengths and Weaknesses
• Data Remanence and Lack of Network Visibility
• Container Security
• Impact of Containers on On-premise or Cloud Architectures
• Security Concerns
• Protecting against Container Escape

SEC530.5: معماری زیرو-تراست: حل مشکل مهاجمانی که از قبل در شبکه حضور دارند

• Zero Trust Architecture
• Why Perimeter Security Is Insufficient
• What Zero Trust Architecture Means
• “Trust but Verify” vs. “Verify then Trust”
• Implementing Variable Access
• Logging and Inspection
• Network Agent-based Identity Controls
• Credential Rotation
• Certificates
• Passwords and Impact of Rotation
• Endpoints
• Compromised Internal Assets
• Pivoting Adversaries
• Insider Threat
• Securing the Network
• Authenticating and Encrypting Endpoint Traffic
• Domain Isolation (Making Endpoint Invisible to Unauthorized Parties)
• Mutual TLS
• Single Packet Authorization
• Tripwire and Red Herring Defenses
• Honeynets, Honeypots, and Honeytokens
• Single Access Detection Techniques
• Proactive Defenses to Change Attacker Tool Behaviors
• Increasing Prevention Capabilities while Adding Solid Detection
• Patching
• Automation via Scripts
• Deputizing Endpoints as Hardened Security Sensors
• End-user Privilege Reduction
• Application Whitelisting
• Host Hardening
• EMET
• Host-based IDS/IPS
• As Tripwires
• Endpoint Firewalls
• Pivot Detection
• Scaling Endpoint Log Collection/Storage/Analysis
• How to Enable Logs that Matter
• Designing for Analysis Rather than Log Collectio