Original subtitles

So we're going to go through in day one or in book one.

We're going to go through step by step what we call the

pickerel framework that has learned recovery.

We're going to go through all of those steps

because when we're looking at it attack something like

Metasploit or

endpoint security Bypass or bypassing a firewall we have

to put that in a frame work context of how do you prepare

for that attack?

How do you identify that attack?

How do you contain that attack and so on

so this day becomes so important because Allows you

to start rationalizing the attack techniques and then

developing your preparation steps the policies processes

procedures training to get ready for that eventuality

tack and then also going through the steps for

identification and containment if we didn't have this day maybe

nothing but a whole bunch of different tools that may or

may not become outdated in a year or so.

So talking about this as a foundational framework and

then using the tools

gives you the mental framework to develop defenses regardless

of whatever.

Attack is coming at your organization.

So we're going to go through each one of these to these

different sections preparation identification containment

eradication recovery Lessons Learned and yes, there are a

whole bunch of labs throughout this day will be covering

Windows cheat sheet command line Kung Fu getting started

at the command line on Windows

is so in central essential because so many of the attacks

Target our Windows systems.

We're going to talk about enterprise-wide identification

and Analysis, which is a lab that's very very near and dear

to my heart specifically.

I'll explain that in a bit.

We'll talk about Espionage intellectual property attacks

legal issues in computer security.

And then finally we have an incident response tabletop lab

that it really think ties together the entire day and

the reason why this lab is so important to cap off this day

because it gives you a framework to very quickly

gamify tabletop exercises with your co-workers with your

employees

with your management at your organization to determine the

overall Readiness at your organization for an

Coming against your organization.

So let's go ahead and let's get started.

We're going to jump between the podium here

and live sessions at an undisclosed location.

So now let's jump over to one of those live sessions and

I'll see you in just a little bit for our next section here

at the podium.

Thank you so much.

Now as I mentioned today is all about those policies, right?

We're going to go through that pickerel framework for

Preparation identification containment eradication

recovery Lessons Learned going to do all of that today.

And for some people that's kind of tough,

right they come to a class.

It's called hacker techniques exploits and incident handling

and they somehow expect they're going to hit the ground

immediately and start talking about hacker tools and

techniques to breaking into things

and they're a little bit confused by all the policy

process and procedure that we cover in.

A what

but this day

without question is the most important day of sans 504.

This is the day that will help you contextualize and prepare

for a tax regardless of what those attacks actually are as

long as we know the techniques and the capabilities of

adversaries and we know what components we can work with we

can defend and reacts to a wide variety

of different times.

And as I mentioned earlier this day establishes the framework

for us going through and covering different.

At Trends and the different phases that an attacker will

go through to try to gain access to your network because

this framework is applicable to every single phase in the

entire attack methodology that is out there today.

Also as part of this Court's we have virtual machines

the virtual machines have every tool that you need for this

class built into them

also almost all of the labs except for day six

are able to be ran locally on your system and I want to

explain that a little bit.

There's a lot of classes and they have a lot of really

really cool things will bring in all kinds of gear the front

of the classroom for you to break into

and that's great.

The only problem I have with that.

It's for a foundational class like 504.

You can't take it home with you.

I wanted to have every single lab in this course

be able to run on a single machine.

So you could continue practicing the different

techniques that we cover in this course moving forward

into the future without needing to have a lab

now the Bible for VMS are 7-Zip compressed.

We have seven zipper windows

on the course USB.

If you're using a Mac, you have to go to the App Store and

download a 7 zip utility.

There's a bunch of them out there pick one install it and

run it I used to.

Hand out caki

the keka would work for one specific version of OS X and

it wouldn't work on anything else.

So it's better just to get it from the app store because it

gets you the right version of the tool that you need to

extract the virtual machines in this course.

Now whenever you open up the virtual machine, it's going to

say if you moved or copied, please select copy

that causes the virtual machine to generate a new Mac address.

So we don't have mac address collisions.

So we want to extract that now because it's going to take some

I'm the passwords in the user IDs for the virtual machines

are SEC 504 for the user ID and the password is SEC 504

and then for becoming root on the Linux machine it's to do

su space -

that - is incredibly important to make sure loads properly

and I wouldn't worry about this too much because in a lot

of our Labs we give you these exact commands.

You don't have to memorize them.

The only thing that you really need to memorize the user ID

and the password for logging in which is pretty

straightforward.

Forward it just so happens to be the class version as well.

If you're

from

another country and you have a different keyboard layout you

can go into the virtual machines and change your

keyboard layout from within the virtual machine as well.

All right, as I mentioned earlier in one of the earlier

videos a key component to being successful in Sands.

504 On Demand is actually doing the labs in order to do the

labs.

You've got to get the virtual machines extracted and we've

already talked about that

but the other key part is the awesome day six or books X

Capture the Flag event.

It's common for many students that are just getting started

with on-demand kind of put this part off until later you

need to do this right now

the capture the flag.

On Demand is special and the reason why it's special is you

get access to the on-demand VPN with a full capture-the-flag

experience

for months.

Whereas in a live setting

and set up for one day and that's it.

You need to get set up you need to get configured and on this

slide slide number eight.

We have step-by-step instructions on how you're

supposed to do that more importantly you're going to

receive an email from Sands.

And in that email it's going to give you step-by-step

instructions and And links to download specific

configuration files to do the capture the flag for Sands 504.

So when you get that email don't just ignore it or send

it to spam or send it to trash you want to pull that email up

you want to go through those Instructions?

Make sure the virtual machines can connect into the Sands VPN

so that you can enjoy the full Capture the Flag experience

when you do the capture the flag and I'll talk about this

more in book six.

Don't just do it.

Once you want to be able to go through that CTF almost as

though so it's cold like you can just do it without

thinking and you'll get that opportunity because you're

doing this on demand and you get access for this VPN

for months after you get started in this class.