Implementing AD/AAD Tiering & Privileged Access Workstations

~ October 24, 2023 ~

by Sami Laiho

Can you RDP into a server or a jump server from any computer in your network? Can you manage your Virtualization and Backups with your Domain Admin accounts? Can Domain Admins log on to normal workstations? If you answered “Yes” to any of these questions, oh boy you are in trouble…  

In this crucial AWSC module, our Expert Sami Laiho will show you why segregating potential access to sensitive data from administrative operations is a key. Sami will introduce the concept of Privileged Access Workstations (PAWs) as the missing component in creating a well-tiered, secure Active Directory (or Azure Active Directory) environment. 

The module is divided into 3 segments: 

Deploying Directory Tiering:
• On-Prem (AD),
• Cloud (AAD). 

Deploying Privileged Access Computers for on-prem:
• Different solutions for where to run PAWs,
• IPsec or something else?
• Controlling the network connections and access to malicious content. 

Deploying Privileged Access Computers for the Cloud:
• Different solutions for where to run PAWs,
• Conditional access or something else?
• Controlling the network connections and access to malicious content. 

Deploying Passkey Authentication with Microsoft Entra ID

~ October 26, 2023 ~

by Michael Grafnetter

This AWSC Module is designed to show you the planning process and implementation of a passwordless authentication deployment within the Microsoft Entra ID ecosystem. 

With the arrival of Passkey (formerly known as FIDO2) authentication support to Apple iOS, it is now finally possible to go fully passwordless, both in Active Directory and Entra ID (previously named Azure Active Directory). In this session, we are going to discuss the entire process of Passkey authentication deployment in hybrid and multi-platform environments, including the configuration options, identity lifecycle management, security considerations, and current limitations of this technology.

Modern EDR Evasion Techniques

~ October 31, 2023 ~

by Jan Marek

During this AWSC module, our Expert Jan Marek will lead an in-depth exploration of modern EDR circumvention options. The primary objective of this session is to provide you with a comprehensive understanding of the sophisticated techniques currently used by cyber attackers. You’ll understand the limitations of EDR as the only one defense mechanism for defending your endpoints. 

We will dive into strategies used by hackers to operate within the user space, often evading detection by traditional security measures. Participants will gain insight into kernel callbacks, Event Tracing for Windows (ETW), detailed examination of system calls (syscalls) and their role in advanced threat evasion. 

Keeping your Kubernetes Environments Safe and Stable

~ November 2, 2023 ~

by Ronald Harmsen

As containerization, especially through Kubernetes, continues its popularity for development teams, it’s crucial to understand the potential challenges and pitfalls that can arise in this dynamic environment. Join our Expert Ronald Harmsen in this insightful AWSC module as we delve into the complexity of running such practices securely. 

The session will address critical questions that every development team should consider: How can we ensure that our APIs are not exposed, potentially leading to security vulnerabilities? What measures can be implemented to prevent unintended connections to incorrect or even malicious containers within a Kubernetes cluster? Understanding exactly what is running and deciding if it should be running at all is crucial, and we’ll explore strategies to do so effectively. 

Microsoft SQL Server Encryption for Performance

~ November 7, 2023 ~

by Damian Widera

In this insightful AWSC module, our Expert Damian Widera will demonstrate the relationship between encryption techniques and SQL Server performance.  

Damian will guide you through the process of designing and developing a secure and high-performing solution within the SQL Server environment. Participants will gain hands-on experience in selecting encryption methods tailored to their specific business needs. Through practical demonstrations and in-depth discussions, you’ll gain a comprehensive understanding of how different encryption techniques impact SQL Server operations. 

Mastering the Log Files

~ November 9, 2023 ~.

by Paula Januszkiewicz & Mike Jankowski-Lorek, PhD

In this Module of the AWSC course, CQURE Academy Experts Paula J and Dr. Mike will show you in detail the power of logs within the area of cybersecurity, as it holds the key to understanding, detecting, and mitigating cyber threats. 

The session will cover exploration of the following points: Cyber Kill Chain and Cyber Kill Chain – Protection, providing attendees with the view on stages that attackers go during an attack and protection methods. You’ll gain hands-on experience and knowledge on a variety of useful tools. Last but not least, Paula and Dr. Mike will focus on Azure Sentinel – Cloude-native SIEM, that provides intelligent security analytics for enterprises. Our Experts, together with AWSC participants, will explore it from the general overview down to the deep details of the entity behavior and analytics. 

Hacking Zero Trust in the Windows Environment: Security Controls That Make Attacker’s Life Difficult

~ November 14, 2023 ~.

by Mike Jankowski-Lorek, PhD

In this AWSC module, Dr. Mike Jankowski-Lorek will get into the concept of the Zero Trust model. He’ll explain why this concept remains interesting, yet often challenging to adopt in practice. Participants will gain deep insights into the Zero Trust by using Microsoft products. 

Dr. Mike’s extensive experience as a penetration tester and incident responder brings a unique perspective to the session. You’ll gain practical knowledge, complemented by a wide range of real-world examples and demonstrations, on how to secure your environment for the Zero Trust model. The module will also emphasize critical missteps to avoid during implementation.  

Mastering Active Directory Security Hardening

~ November 16, 2023 ~

by Michael Grafnetter

This AWSC Module, led by our Expert Michael Grafnetter, will guide you through the Active Directory security hardening, showing the expertise needed to secure environments against evolving threats. 

In IT there is a well-known concept called “Security by default”. Unfortunately, most Active Directory features were developed almost 30 years ago and to achieve backward compatibility with legacy systems, even the default configuration of a Windows Server 2022 domain controller is far from being as secure as possible. As a consequence, a freshly deployed Active Directory environment is relatively easy to compromise. That is why we will go through a checklist of both common and lesser-known Active Directory security settings, which should result in a very secure configuration.

We are also going to discuss various auditing tools which can be used to compare the current configuration against various security baselines

Mastering the Memory & Disc Forensics

~ November 21, 2023 ~

by Paula Januszkiewicz

During this insightful Module, our Expert Paula J will show her newest expertise on memory analysis techniques and disk storage acquisition and analysis. Forensics is a constantly evolving and crucial topic in cybersecurity. To stay on top attackers, the knowledge of Individuals and Teams responsible for collecting digital evidence and handling the incidents must be constantly enhanced and updated. 

Paula will guide you through the secrets of memory dumping and show you how to use advanced tools. After that, participants will explore volatility to analyze Windows memory images and system memory dump. This Module will develop your skills in Storage Acquisition and Analysis as well: among others, we will focus on methods and technologies that enable reviving, extracting and recovering partitions and… juicy information. You can expect a deep dive into the detailed analysis and a guide on how to create a full incident timeline! 

Kerberos Authentication Security

~ November 23, 2023 ~

by Michael Grafnetter

In this AWSC Module, Michael Grafnetter will dive deep into the secrets of Kerberos authentication. The session will cover many different types of attacks against the Kerberos protocol, including the roasting, forging, and relaying techniques. You will also be provided with hands-on insights on securing your systems.

Securing your Endpoint with Windows Firewall and IPsec

~ November 28, 2023 ~

by Sami Laiho

Every computer, whether in a corporate LAN or a public network, needs to be protected with a firewall. This also applies to all servers! And this means the device itself and not a firewall on the perimeter. Zero Trust means that those protections are in place wherever you might take your computer, and that we can identify the computer and user, not just the address where it claims to be. With Windows Firewall you can block pass-the-hash and other lateral movement techniques. By adding IPsec, you can enjoy all the benefits of 802.1x authenticated networks – only better, more granular and for free! 

Join Sami Laiho, our Expert, in this Module and learn how he manages different sized environments and deploys the concept of Client Firewalls. 

1. Windows Defender Firewall with Advanced Security 
• Managing Windows Firewall 
• Managing policies via GPO 
• Managing policies via Intune 
2: Deploying IPsec 
• AH, ESP, and IKE protocols 
• Domain Isolation – prevent unauthorized computers from communicate with you 
• Creating firewall rules for computer or user accounts, not IP/SUBNETs 
3: Troubleshooting 
• Troubleshooting the Firewall 
• Troubleshooting IPsec 

Adopting MDTI and Build Integration with Sentinel

~ November 30, 2023 ~

by Piotr Pawlik

Unlock the potential of Microsoft’s Threat Intelligence platform in this dynamic AWSC Module. Join our Expert Piotr Pawlik and learn how to operationalize Microsoft’s Threat Intelligence articles and Intel Profiles in MDTI to revolutionize your security approach. We’ll start with an introduction to MDTI and its crucial role in constructing an Early Warning System for Threats. Next, we’ll dive into the world of interoperability, bridging Microsoft 365 Defender and Microsoft Sentinel for a unified defense strategy. In this technically-rich session, we’ll explore Intel Profiles, present real-world analyst case studies, and establish seamless integration with Microsoft Sentinel to thwart APT actor tactics. 

Timeline: 

• Intro to MDTI and Microsoft Defender 
• Microsoft Defender Threat Intelligence as an Early Warning System for Threats 
• Intel Profiles 
• Integration and Interop with Microsoft 365 Defender 
• Case study: APT attacks on Teams – used techniques and tactics. How MDTI could help here? 
• Attack demos – MDTI integration with Sentinel and Defender. 
• Summary & Conclusions 

BONUS Module – Security Active Directory Advanced – GOD MODE

~ December 5, 2023 ~

by Andy Wendel

The active directory is your crown jewels. Nearly everybody has it in place and every is using but not protecting it.

The last years in experience with APT-groups and ransomware gave us a picture of how attackers crawl through your networks and how they work.

So – within these 2 hours of training, you will see, understand, and train yourself how attackers work, understand their toolsets, and then, learn how to securely protect your active directory the master way.

Learn about Tier-models, ESAE (it is deprecated but fully supported), pingcastle, the protected user group, ReCoBS and immutable-backup, and a lot more.