SEC504: Hacker Tools, Techniques, and Incident Handling

Experience SANS training through course previews.
Learn MoreLet us help.
Contact usConnect, learn, and share with other cybersecurity professionals
Engage, challenge, and network with fellow CISOs in this exclusive community of security leaders
Become a member for instant access to our free resources.
Sign UpMission-focused cybersecurity training for government, defense, and education
Explore industry-specific programming and customized training solutions
Sponsor a SANS event or research paper
We're here to help.
Contact UsUntil June 2019, Dr. Anton Chuvakin was a Research VP and Distinguished Analyst at Gartner for Technical Professionals (GTP) Security and Risk Management Strategies (SRMS) team. At Gartner he covered a broad range of security operations and detection and response topics, and is credited with inventing the term “EDR.”
He is a recognized security expert in the field of SIEM, log management and PCI DSS compliance. He is an author of books “Security Warrior”, “PCI Compliance”, “Logging and Log Management” and a contributor to “Know Your Enemy II”, “Information Security Management Handbook” and others. Anton has published dozens of papers on log management, SIEM, correlation, security data analysis, PCI DSS, honeypots, etc. His blog securitywarrior.org was one of the most popular in the industry.
In addition, Anton taught classes (including his own SANS SEC434 class on log management) and presented at many security conferences across the world; he recently addressed audiences in United States, UK, Singapore, Spain, Russia and other countries. He worked on emerging security standards and served on the advisory boards of several security start-ups.
Explore content featuring this instructor’s insights and expertise.
CISOs and security practitioners are now being bombarded by new acronyms such as XDR which seem to overlap with “older” acronyms like EDR, SIEM, and MDR.According to Gartner, XDR is mainly attractive to smaller security organizations that don’t currently have a SIEM, and it will likely not displace SIEM functionality in large and mature security operations. And according to Forrester, XDR is grounded in EDR and also on a collision course with SIEM and SOAR.
For many years, security professionals have advocated the approach of collecting logs from all the places where they’re generated and centralizing them into one or only a few places.
“IT heroism” can be defined as relying on “individuals taking upon themselves to make up for a systemic problem.” As those who have seen the inside of a SOC can attest, this is not entirely uncommon in many Security Operations Centers!
Part 4: Evolving Cloud Security with a Modern ApproachIn this session, we'll explore how organizations can adapt their security practices to fit the dynamic nature of cloud infrastructure. While the cloud isn't inherently insecure, traditional on-premises security techniques often fall short. We'll dive into the shared responsibility model between cloud providers and users, the advantages of cloud-native security controls, and how AI tools can aid automation and threat detection-without losing sight of the critical role of human analysts.
Part 5: Key Insights from Cloud Security Experts: Straight Talk on Cloud SecurityIn this final session, industry leaders reflect on key lessons from the series, highlighting critical aspects of cloud security, such as the shared responsibility model, evolving security architectures, and the role of continuous monitoring. As AI and advanced tools for threat detection continue to grow, the panelists share advice on staying ahead of the curve by focusing on long-term security strategies and fostering collaboration between security teams and cloud providers.
Prepare for the Next Era of Cloud Security