SEC504: Hacker Tools, Techniques, and Incident Handling is a comprehensive program that focuses on developing skills for incident response investigations. This course helps participants learn to respond effectively to evolving cyber threats, with a specific emphasis on cloud and on-premises platforms. Here are the key points:
- Course Overview: SEC504 is designed to teach incident response techniques and threat intelligence development. It addresses the latest threats, including watering hole attacks and cloud application service MFA bypass techniques.
- Hands-On Learning: The course strongly emphasizes hands-on learning, with 50% of class time dedicated to practical exercises. These exercises use visual association tools to break down complex topics.
- Course Authors: The course is authored by Joshua Wright also known as “HacksForSushi”
- What You Will Learn: The course covers a dynamic approach to incident response, indicators of compromise, responding to breaches on Windows, Linux, and cloud platforms, and understanding attacker tools and techniques. It provides practical experience through hands-on exercises.
- Certification: Successful completion of the course can lead to the GIAC Certified Incident Handler (GCIH) certification, which validates the ability to detect, respond to, and resolve computer security incidents.
- Course Syllabus: The course is divided into six sections, covering incident response, reconnaissance, scanning, enumeration attacks, password and access attacks, public-facing and drive-by attacks, evasion, post-exploitation attacks, and a Capture-the-Flag event.
- Ways to Learn: The course can be taken in multiple formats, including OnDemand (self-paced learning), Live Online (virtual, interactive sessions), and In Person (on-site classroom sessions).
SEC504 provides hands-on, practical training for those interested in incident handling and response, equipping participants with skills to identify and respond to security incidents across various platforms and attack vectors. Successful completion of the course occurs after the candidate passes an examination (hands-on and multiple choice) to achieve the GCIH (GIAC Certified Incident Handler) certification.
Difficulty: 3 out of 5.
Loved this course. Worst thing with this is a bit of information was outdated. I messaged Joshua (author) and he turned in tickets as I was sending him the information that was out of date and the few typos that I found. Joshua is very active in slack and will always get back with you (including on weekends). Having access to the SME is very helpful when you don't understand something and he is willing to jump on a call and walk you through the issues with no extra charge.
This course does lean heavily on older tools and vulnerabilities to showcase use, but the concepts are easy to grasp and fairly fun. Metasploit is used a fair bit and there is a lot of extra course material for download and use after the course ends.
I would\do recommend this course
Difficulty: 2 out of 5.
Among the large catalog of SANS courses, SEC504 (GCIH) is probably one of the most well-known. The course covers the incident response lifecycle and the various types of investigations that a cyber defender may be expected to handle. Whether on-demand, live online, or in-person, the course will help cyber defenders understand what is going on from the attacker's side and what can be done to detect/mitigate these attacks in the future. However, by breaking down each part into its barest essentials and simplifying how an attack is carried out, students miss out on the chance to actually deal with an incident, how it feels to handle one, and ways to improve their organization's security posture going forward. This course and exam do not prove that the student has the skills and abilities to perform incident handling, but the knowledge of the process. It is good knowledge, but it's only that.
Pros
- Drills a well-established Incident Response methodology into the student
- Introduces basic attacker techniques and how to detect them
- High-quality labs
- High-quality lecture material
- Covers Windows, Linux, and Cloud environments
Cons
- Practical application portion of the certification exam is lackluster and overly simplistic
- Drills down on subjects that don't require drilling down on
- Cost (The lowest cost option was $8,725 USD as of 19-Oct-2023)
- You don't actually handle any incidents
Difficulty: 2 out of 5.
This was my first SANS course so I was extremely excited. I couldn't wait to learn the most advanced threat response and incident handling techniques... and then I started the course.
It was a bit underwhelming. The material was useful but nothing I hadn't already seen before. We got into the attacker techniques section and I found myself skipping ahead because I already knew it from a $30 dollar TCM course.
There was a lot of useful material that you probably wouldn't have found in 2021. That said, in 2023 when I write this most of the core DFIR material is available free online. If someone told me this course was $200 dollars, I'd say it was a decent deal. I would not pay $8000 dollars for this.
I did appreciate that I was exposed to a few forensics tools that I otherwise never would have seen. It's not bad material but the value for the money just isn't there.
Difficulty: 2 out of 5
The SANS course SEC504: Hacker Tools, Techniques, Exploits, and Incident Handling (GCIH) is widely recognized and aims to cater to individuals with varying levels of experience, making it accessible for both newcomers and those with some background in the field. The course has a dual focus on offensive and defensive concepts, covering a broad range of topics, including network attacks, incident handling, memory analysis, malware investigations, web attacks, and network analysis. Despite its comprehensive scope, the course has undergone several revamps, now incorporating content related to cloud technology.
From my personal experience, however, I found the course to be lacking on the blue team side, particularly in the area of Incident Response and Investigations. The course structure devotes significant time to detailing various attacks and the tools attackers might employ, but it falls short in providing practical defensive strategies and response techniques. For instance, while the course dedicates the first day to Incident Response and Cyber Investigations, the subsequent days predominantly focus on carrying out attacks, leaving limited room for understanding how to defend against or respond to these attacks effectively.
In my opinion, the course would be more valuable if it emphasized a defensive perspective, including detection and response strategies for each attack or technique covered. This approach would be particularly relevant for SOC analysts, who are unlikely to regularly use tools like Metasploit and John the Ripper in their daily tasks. The course content could be enhanced by focusing on common attacks and teaching practical incident-handling skills, thereby better preparing individuals for real-world scenarios.
Regarding the exam, it closely resembled the practice exams, and the labs covered topics from the course. However, it's worth noting that some labs might encounter technical issues, so allocating ample time to complete them is advisable.
In summary, I do not recommend this course. While it provides insights into the tactics employed by malicious actors, it lacks depth in the area of incident response and may not significantly enhance one's skills as an incident handler. A more balanced approach, focusing on common attacks and robust incident handling techniques, would better serve the needs of aspiring security professionals.
I echo the sentiment that paying for SANS courses out of pocket might not be the most cost-effective option. There are other courses available that offer a more practical approach to learning blue team skills and understanding different attack techniques. Exploring these alternatives can provide a more well-rounded and budget-friendly education in the field of cybersecurity.
