According to market data, more businesses than ever before are utilizing several cloud service providers. The first SANS Multicloud Survey, performed in 2022, indicated that the forces behind the tendency to adopt multiple cloud solutions was driven by a variety of factors, including mergers and acquisitions and concerns around ensuring business continuity. It is also clear that the major cloud service providers continue to innovate and differ...

As data volume increases and cyberattacks target smaller and smaller organizations, your company needs to determine what content requires the highest level of protection. Unfortunately, unstructured content such as product plans, customer data, and other intellectual property (IP) is extremely enticing to cyberattackers—and the most challenging to protect. In 2024, you need to look beyond traditional enterprise data protection, which is...

“IT heroism” can be defined as relying on “individuals taking upon themselves to make up for a systemic problem.” As those who have seen the inside of a SOC can attest, this is not entirely uncommon in many Security Operations Centers! Join Dr. Anton Chuvakin, Security Advisor at Office of the CISO, Google Cloud, and Jay Lillie, VP of Customer Success at CardinalOps, as they explore the concepts of SOC heroics. The prob...

Learn to combat the world’s latest cyber threats with up-to-the-minute training from real-world practitioners! Make new connections at one of the largest gatherings of professionals in the cyber community this year. Join us in Austin, TX, or Live Online for SANS Austin Fall 2023 (November 27 – December 2). SANS Austin Fall 2023 features: In-Person or Live Online training Tactical cyber security training taught by experts who...

It seems that every day cyber attackers come up with a new technique or tactic to breach victim organizations. It can seem daunting for security teams to keep up with the constant barrage of the latest threats and capabilities. Despite the best-laid plans, adversaries can still find a way in if security teams don’t prioritize their investments against the tech that protects against the threats targeting them. In this First Look, we look...

There are two cybersecurity truisms: You can’t prevent attacks you can’t detect; and attacks you can’t prevent turn into incidents you need to detect before you can respond to them. It takes skilled people, and effective, efficient tools to make sure you can create, validate, and maintain detection signatures that will provide full coverage of real-world attacks while minimizing false positives and false negatives. This SANS...

The Office of the DoD Chief Information Officer recently published two critical initiatives: the 2023-2027 DoD Cyber Workforce Strategy and DoD Manual 8140.03. The strategy establishes the direction for unified management of the cyber workforce and outlines a roadmap for its advancement while DoDM 8140 changes the way that we qualify our workforce. Through the DoD 8140 Cyber Workforce Qualification Program, DoD is expanding the qualification p...

The evolution of cloud technologies has ushered in a new era of opportunities, but with it comes a unique set of challenges, particularly in the realms of configuration and network security. This talk will shed light on the modern practices and strategies essential for safeguarding cloud environments against configuration missteps and network vulnerabilities. We'll dissect real-world scenarios where configuration errors led to breaches and del...

Identities are the foundational cornerstone of many environments. Identity is typically the front door for web, infrastructure portals, and VPN services. Most organizations should implement additional countermeasures to prevent attackers from breaking into an organization. The perimeter of many environments is de-facto users’ identities. How you protect those identities is critical. Understanding how to attack identities is crucial for t...

This is a 2-hour hands-on workshop. As with any enterprise environment, we can (and should) focus on hardening our defenses to keep the adversaries out, but these defenses may some day be evaded via a variety of methods. Cloud is no different. In this workshop, we will work through the process of creating a detection that we can use as defenders to spot an adversary performing attack techniques against our AWS environments. The overall process...