I have a new course available on Pluralsight. It’s a security analyst focused tools on GNU Bash and scripting. It is the first in a series of courses on Bash.

Scripting for Security with Bash is a technical course for information security analysts that need to understand the UNIX and Linux environment and use Bash as their primary shell and scripting tool. It is designed to be a quick introduction and focused on demonstrating how to use Bash for security operations and automation. (Course overview video)

In addition to understanding the detailed tasks associated with security operations, security analysts need a solid technical foundation. The role requires knowledge of systems that exists in their organization’s IT environment from desktops in offices, servers in far-away data centers, pervasive and distributed operational technology devices, and virtual machines in the cloud. Many of these systems are Linux distributions with installed with the Bash shell.

GNU Bash is the Bourne-Again SHell, which has been the GNU Project’s shell since it was released in 1989. It was designed to replace the Bourne shell, which was released with Version 7 UNIX. Bash is the default shell for most Linux distributions. Scripting in Bash is a common way to automate tasks on UNIX and Linux systems.

My course describes how to use Bash for security operations as a security analyst. I also show how to configure file permissions and ACLs, manage users and groups, use Secure Shell, and handle some security concerns with scripting. The Windows Subsystem for Linux (WSL) is a Microsoft-supported way to get Linux and Bash on your Windows system, so I show how to install and use WSL. There are seven separate demos included to show how to use Bash. I also included several scripts as examples.

Table of Contents

• Bash Basics
• Using Linux and Bash on Windows
• Managing Security Concerns with Bash
• Managing File Permissions
• Managing Users and Groups
• Running Commands Remotely

Please take a look and let me know your thoughts on this new course.

I have a new course available on Pluralsight. It’s another Red Team Tools course focused course on Spiderfoot. It is part of the Pluralsight Red Team Tools learning path.

While my other courses are a couple hours of content, the Reconnaissance with Spiderfoot course is 38 minutes. It is designed to be a quick introduction and heavily focused on demonstrating how to use Spiderfoot for recon in red team engagements. (Course overview video)

Reconnaissance is the first step when starting a red team project. Information must be gathered for the the target organization, including specific details about its connected devices, network block assignments, domain names and subdomains, and even physical locations for some engagements.

Spiderfoot is an open source intelligence automation platform. It utilizes more than 200 modules to gather information about reconnaissance targets. It uses an active intelligence gathering to directly interact and probe the target’s infrastructure. However, it’s real value is in its passive information gathering using a large variety of online open source intelligence sources.

My course describes how to use Spiderfoot for the reconnaissance phase of a red team operation. There are five separate demos included to show how to use Spiderfoot.

Table of Contents

• Using Spiderfoot for Reconnaissance
• Access the Shodan Web Site
• Starting Spiderfoot
• Initiate a Scan
• Configure Modules
• Use the Command Line Interface
• Use Spiderfoot as a Red Team
• Resources

Please take a look and let me know your thoughts on this new course.

I have a new course available on Pluralsight. It’s a new type of course for me. My previous courses have been long-form courses. This one is shorter, tool-focused course on Shodan. It is part of the Pluralsight Red Team Tools learning path.

While my other courses are a couple hours of content, the Reconnaissance with Shodan course is 27 minutes. It is designed to be a quick introduction and heavily focused on demonstrating how to use Shodan for recon in red team engagements. (Course overview video)

Reconnaissance is the first step when starting a red team project. Information must be gathered for the the target organization, including specific details about its connected devices, network block assignments, domain names and subdomains, and even physical locations for some engagements.

Shodan is a search engine for internet-connected devices, not for human-oriented web pages. Shodan crawls the internet and indexes information about servers, desktops, printers, SCADA devices, mobiles devices, surveillance cameras, and many other systems with an IP address. It is an easy tool to use, with both web and command line interfaces available.

My course describes how to use Shodan for the reconnaissance phase of a red team operation. There are five separate demos included to show how to use Shodan.

Table of Contents

• Reconnaissance with Shodan
• Access the Shodan Web Site
• Utilize the Shodan Command Line Tool
• Use Plain Text Banner Searches
• Use Search Filters to Refine Results
• Explore Red Team Scenarios
• Resources

Please take a look and let me know your thoughts on this new course.

I have a new course available at Pluralsight. It’s an introduction to the Metasploit Framework. In it, I focus on getting started quickly with using the framework. It’s a relatively short course (for me) at approximately two hours of content, including demonstrations. The course is called Metasploit: Getting Started. (Course Overview video)

This new course takes some of the original concepts presented in my very first Pluralsight course, Introduction to Penetration Testing Using  Metasploit, and condenses it down to the essential information. It’s a style of course Pluralsight uses to get learners up to speed quickly on a new piece of software, platform, or service. Those type of courses focus on basic concepts and demonstrations to quick get the learner started. Later courses are used to expand their knowledge on more in-depth concepts and capabilities.

Table of Contents

• Penetration Testing Ethics and Processes
• Metasploit Framework Capabilities
• Metasploit Framework Architecture
• Installing and Configuring the Metasploit Framework
• Preparing an Attack
• Launching an Attack
• Working with the Metasploit Framework
• Summary and Next Steps

I hope you will check it out. I look forward to feedback on it.

Future Work

Since I left out a lot of information to keep the total length around two hours and the content focused on the primary subject matter, I am creating supplementary videos to address some of the missing topics and even cover some of the content in more depth. It will be similar to end notes and footnotes for a nonfiction book. Unfortunately, that type of content may be interesting to only 4 or 5 people in the world. However, I am creating it as something that I would love to have if I were the learner.

There are a couple more courses on Metasploit and Meterpreter in the works, so stay tuned for details.

I completed and published another course with Pluralsight. This time I was asked to create an introductory course for information security. It had to be high level. It had to be accessible to beginners that have little to no background in information security.

It is the lead course in the Survey of Information Security learning path. This path also contains my second penetration testing course, Penetration Testing: The Big Picture.

The objective of this course is to assist learners in understanding the foundational principles and the key concepts in security. I describe most of the program and management approaches from an organizational perspective. I used this method specifically so that learners can apply this knowledge to their current job and their organization.

Course Description

There are many components to an organization’s information security program. If you are new to cybersecurity or interested in getting started, it can be difficult to identify and understand all of the facets of protecting an organization’s information assets. In this course, you will learn about the information security programs used by organizations. First, you’ll learn about the foundational principles of security, such as confidentiality, integrity, governance, risk management, and compliance. Next, you will learn about organizational assets and how they are protected through the use of security controls. Then, you will learn about how auditing, monitoring, and testing is used to review and evaluate the effectiveness of those security controls. Finally, you will explore how organizations manage and prepare for security incidents, disruptions, and disasters and how they manage the day-to-day operations of a program. When you finish this course, you will have the knowledge and understanding of the bigger picture of information security.

Table of Contents

• Course Overview
• Security Principles, Governance, Risk, and Compliance
• Protecting and Defending Assets
• Auditing and Monitoring
• Managing Incidents and Operations

What is the Learning Path?

This learning path is a specific set of Pluralsight courses on information security. These are Big Picture courses since they provide a wide survey (i.e. “big picture”) of relevant content in security. They are not in-depth courses but introductory ones.

Links

• Pluralsight
• Introduction to Information Security (Pluralsight course)

I have another Pluralsight course published. Still focusing on penetration testing, I was asked to create a high level overview course on the subject. Penetration Testing: The Big Picture was published on October 6, 2017 and looks at a wide variety of topics on penetration testing.

The focus in this course is to present information about pen testing that would be useful to those interested in learning more about it as a career option or training direction. It can also be useful for individuals and organizations interested in hiring pen testers or organizations seeking pen testing services.

This course is more more of an overview than my first course Introduction to Penetration Testing Using Metasploit.

Course Description

As more businesses create, collect, and manage large volumes of customer data and provide access to that data through mobile apps, the Web, and IoT devices, there are more opportunities for that data to be compromised and stolen by nefarious individuals, criminal groups, and even governments. Organizations are struggling to improve the accessibility to and increase the value of their intellectual property while simultaneously protecting it from unauthorized exposure. As news in the past few years has shown, this is a significant challenge and many organizations lost control over their customer’s data and their own intellectual property. Penetration testing is one technique that organizations use to find and correct weaknesses in their network and systems before someone else does. First, you will learn how penetration testing serves as key component in an organization’s information security management program. Next, you will learn about the penetration testing process and techniques used to discover and exploit vulnerabilities. Finally, you will have a good understanding of the software tools, certifications, and other courses that can help you build your technical skills. When you finish this course, you will have the knowledge of how penetration testing is used to improve the security of a network and the techniques and tools used to conduct the testing.

Table of Contents

• Course Overview
• The Role of Penetration Testing in Security Testing
• Penetration Tests
• Penetration Testing Execution Standard (PTES)
• Penetration Testers and Their Tools

Why Another Penetration Testing Course?

Most pen testing courses that I have reviewed focus on specific tools or a very narrow aspect of penetration testing. This course is intended to provide a wide overview of penetration testing showing how it is a part of security testing and how that applies to an organization’s information security management program. We also dive into the various types of tests from network focused testing to social engineering and up to physical testing (i.e. red teams).

Why the Penetration Testing Execution Standard?

This maybe a little more controversial. However, there isn’t a formal standard on penetration testing. There several documents describing pen testing in standards such as the PCI-DSS and NIST Special Publications 800-115. The Penetration Testing Execution Standard (or PTES) is an informal document, or more accurately a wiki page, that describes a lot of the aspects of a consulting engagement from starting the business relationship to the actual testing phases and final reporting. The PTES serves as a living document that can change over time as the field changes.

The PTES certainly needs some work in terms of organization of topics and editing. However, it serves as a good foundational document for the field to build on.

Links

• Pluralsight
• Penetration Testing: The Big Picture (Pluralsight course)