SEC541: Cloud Security Threat Detection
About This Course
While shifting to cloud infrastructure offers many benefits, it also exposes organizations to new and continuously evolving threats. Many organizations are unaware of the critical differences between on-premises and cloud environments, leading to challenges in understanding what to log and how to detect threats effectively. Unlike other, primarily theoretical courses, SEC541: Cloud Security Threat Detection provides hands-on-keyboard experience through 21 practical labs covering AWS, Azure, and Microsoft 365. This course empowers your team to master cloud-native logging, threat detection, and monitoring, solving hidden, low-hanging but high ROI issues. Equip your team with the skills necessary to enhance your organization's cloud security posture and stay ahead of potential breaches with SEC541.
What You'll Learn
• Understand how identities can be abused in cloud environments.
• Monitor threat actors using cloud-native logging tools.
• Define and understand compute resources such as virtual machines (VMs) and containers.
• Detect and address attacker pivots within your cloud infrastructure.
• Implement effective detection strategies using cloud provider tools.
• Investigate and analyze instances in your compute resources for suspicious activities.
• Perform detailed analysis and detection of threats in Microsoft 365 and Azure environments.
• Pivot between different log sources to uncover the full narrative of an attack.
• Build automation workflows to reduce repetitive security tasks.
• Centralize and normalize data from various sources to enhance analysis and threat detection.
Entry Requirements
Students should be familiar with AWS or Azure and have worked with them hands-on, especially security professionals working in the cloud security field who understand basic threats and attack vectors.
The course assumes that students can understand or do the following without help:
Understand basic cloud resources such as virtual machines, storage services, and Identity Access Management
Use the Linux command line console.
Understand how identity access roles/policies work in cloud environments
Understand basic cloud networking capabilities
Common prerequisite SANS courses for SEC541 are either:
SEC488: Cloud Security Essentials, or
SEC510: Cloud Security Controls and Mitigations
More information on the prerequisites can be found on our website here: https://www.sans.org/cyber-security-courses/cloud-security-threat-detection/