designing implementing honeypot scada network 35252
TRANSCRIPT
-
7/24/2019 Designing Implementing Honeypot Scada Network 35252
1/39
Interested in learningmore about security?
SANS Institute
InfoSec Reading RoomThis paper is from the SANS Institute Reading Room site. Reposting is not permitted without express written permission.
Designing and Implementing a Honeypot for a SCADANetworkSupervisory Control and Data Acquisition (SCADA) networks are increasingly under attack. In a world ofwireless networks, removable media, and a desire to move to the Internet of Things, it is unrealistic tothink that these networks can be isolated from every threat. Devices on SCADA networks are often not designed
with security in mind, vendors are slow to create patches, and the systems usually are critical enough thatscheduling downtime is a problem. A layered approach to securing SCADA networks that includes bo...
Copyright SANS Institute
Author Retains Full Rights
AD
http://www.sans.org/info/36923http://www.sans.org/info/36923http://www.sans.org/info/36914http://www.sans.org/info/36914http://www.sans.org/reading-room/click/597http://www.sans.org/info/36914http://www.sans.org/info/36909http://www.sans.org/info/36923 -
7/24/2019 Designing Implementing Honeypot Scada Network 35252
2/39
"#$% &'() #%*+,
Designing and Implementing a Honeypot for aSCADA Network
GIAC (GCIA) Gold Certification
-'./012 3/4156) 780..9 8:80..;'.))1C ./1)4.$ D)>68): 0( 73-D- ().H01I: 41) 0L.)( (0. =):6J()= H6./ :)8'16.C
6( M6(=9 >)(=01: 41) :50H .0 81)4.) A4.8/):9 4(= ./) :C:.)M: ':'455C 41) 816.6845)(0'J/ ./4. :8/)='56(J =0H(.6M) 6: 4 A10@5)M$ - 54C)1)= 4AA1048/ .0 :)8'16(J
73-D- ().H01I: ./4. 6(85'=): @0./ A4.8/6(J 4(= M0(6.016(J 6: )::)(.645 .0 ./)
:4L).C 0L ./0:) :C:.)M:$ O/6: A4A)1 =6:8'::): 4 M)./0= 0L =6:80>)16(J 4..48I: 0( 4
73-D- ().H01I @C ':6(J 4 /0()CA0.$ -( 4(45C:6: 0L 4 L48656.6):Q@4:)= 73-D-().H01I H4: A)1L01M)=9 4 /0()CA0. =):6J()= 4(= @'65. .0 M6M68 ./) 80MM0(:)1>68): 0L ./6: ().H01I9 4(= M0(6.016(J H4: A'. 6( A548) .0 =).)8. H/)( ./)
/0()CA0. H4: .41J).)=$ O/6: 1):'5.)= 6( M01) 80MA1)/)(:6>) M0(6.016(J 0L ./)
73-D- ().H01I L01 4..48I: 4(= 4==)= 4(0./)1 54C)1 0L :)8'16.C .0 ./) )
-
7/24/2019 Designing Implementing Honeypot Scada Network 35252
3/39
Designing and Implementing a Honeypot for a SCADA Network 2
3/4156) 780..9 8:80..;'.)
-
7/24/2019 Designing Implementing Honeypot Scada Network 35252
4/39
Designing and Implementing a Honeypot for a SCADA Network 3
3/4156) 780..9 8:80..;'.)
-
7/24/2019 Designing Implementing Honeypot Scada Network 35252
5/39
Designing and Implementing a Honeypot for a SCADA Network 4
3/4156) 780..9 8:80..;'.)
-
7/24/2019 Designing Implementing Honeypot Scada Network 35252
6/39
Designing and Implementing a Honeypot for a SCADA Network 5
3/4156) 780..9 8:80..;'.)
-
7/24/2019 Designing Implementing Honeypot Scada Network 35252
7/39
Designing and Implementing a Honeypot for a SCADA Network 6
3/4156) 780..9 8:80..;'.)
-
7/24/2019 Designing Implementing Honeypot Scada Network 35252
8/39
Designing and Implementing a Honeypot for a SCADA Network 7
3/4156) 780..9 8:80..;'.)
-
7/24/2019 Designing Implementing Honeypot Scada Network 35252
9/39
Designing and Implementing a Honeypot for a SCADA Network 8
3/4156) 780..9 8:80..;'.)
-
7/24/2019 Designing Implementing Honeypot Scada Network 35252
10/39
Designing and Implementing a Honeypot for a SCADA Network 9
3/4156) 780..9 8:80..;'.)
-
7/24/2019 Designing Implementing Honeypot Scada Network 35252
11/39
Designing and Implementing a Honeypot for a SCADA Network 10
3/4156) 780..9 8:80..;'.)
-
7/24/2019 Designing Implementing Honeypot Scada Network 35252
12/39
Designing and Implementing a Honeypot for a SCADA Network 11
3/4156) 780..9 8:80..;'.)
-
7/24/2019 Designing Implementing Honeypot Scada Network 35252
13/39
Designing and Implementing a Honeypot for a SCADA Network 12
3/4156) 780..9 8:80..;'.)
-
7/24/2019 Designing Implementing Honeypot Scada Network 35252
14/39
Designing and Implementing a Honeypot for a SCADA Network 13
3/4156) 780..9 8:80..;'.)
-
7/24/2019 Designing Implementing Honeypot Scada Network 35252
15/39
Designing and Implementing a Honeypot for a SCADA Network 14
3/4156) 780..9 8:80..;'.)
-
7/24/2019 Designing Implementing Honeypot Scada Network 35252
16/39
Designing and Implementing a Honeypot for a SCADA Network 15
3/4156) 780..9 8:80..;'.)
-
7/24/2019 Designing Implementing Honeypot Scada Network 35252
17/39
Designing and Implementing a Honeypot for a SCADA Network 16
3/4156) 780..9 8:80..;'.)
-
7/24/2019 Designing Implementing Honeypot Scada Network 35252
18/39
Designing and Implementing a Honeypot for a SCADA Network 17
3/4156) 780..9 8:80..;'.)
-
7/24/2019 Designing Implementing Honeypot Scada Network 35252
19/39
Designing and Implementing a Honeypot for a SCADA Network 18
3/4156) 780..9 8:80..;'.)
-
7/24/2019 Designing Implementing Honeypot Scada Network 35252
20/39
Designing and Implementing a Honeypot for a SCADA Network 19
3/4156) 780..9 8:80..;'.)
-
7/24/2019 Designing Implementing Honeypot Scada Network 35252
21/39
Designing and Implementing a Honeypot for a SCADA Network 20
3/4156) 780..9 8:80..;'.)
-
7/24/2019 Designing Implementing Honeypot Scada Network 35252
22/39
Designing and Implementing a Honeypot for a SCADA Network 21
3/4156) 780..9 8:80..;'.)
-
7/24/2019 Designing Implementing Honeypot Scada Network 35252
23/39
Designing and Implementing a Honeypot for a SCADA Network 22
3/4156) 780..9 8:80..;'.)
-
7/24/2019 Designing Implementing Honeypot Scada Network 35252
24/39
Designing and Implementing a Honeypot for a SCADA Network 23
3/4156) 780..9 8:80..;'.)
-
7/24/2019 Designing Implementing Honeypot Scada Network 35252
25/39
Designing and Implementing a Honeypot for a SCADA Network 24
3/4156) 780..9 8:80..;'.)
-
7/24/2019 Designing Implementing Honeypot Scada Network 35252
26/39
Designing and Implementing a Honeypot for a SCADA Network 25
3/4156) 780..9 8:80..;'.)
-
7/24/2019 Designing Implementing Honeypot Scada Network 35252
27/39
Designing and Implementing a Honeypot for a SCADA Network 26
3/4156) 780..9 8:80..;'.)
-
7/24/2019 Designing Implementing Honeypot Scada Network 35252
28/39
Designing and Implementing a Honeypot for a SCADA Network 27
3/4156) 780..9 8:80..;'.)
-
7/24/2019 Designing Implementing Honeypot Scada Network 35252
29/39
Designing and Implementing a Honeypot for a SCADA Network 28
3/4156) 780..9 8:80..;'.))= U418/ V9 #%*+9 L10M O0L6(0 7)8'16.C2
/..A:2WWHHH$.0L6(0:)8'[email protected]:84=4Q:)8'16.CQA4.8/QC0'1Q80(.105Q:C:.)MQ6:(XS#XV%XYY.QJ)..6(J
D6J6.45 R0(=9 K(8$ F#%*+9 U418/ *G$ BA1C1 F'"+;"+%$ ?).16)>)= U418/ *9 #%*+9 L10M
D6J6.45 R0(=2 /..A:2WWHHH$=6J6.45@0(=$80MW.005:W:84=4Q/0()C().W
Z01()19 S$9 [ U)6)= U4C #+9 #%*+9L10M a6./'@2 /..A:2WWJ6./'@$80MWJ54:.0ALW80(A0.W6::'):W*#b
]6JJ6(:9 c$ &$ F#%*+9 &4('41C *bG$ BA1C1 Q+.+#(2&+( C('4. R+('SC#;= :ABSAIQ0 :..$+.
1,?).'(;9?).16)>)= Z)@1'41C *9 #%*+9 L10M D41I ?)4=6(J2
/..A2WWHHH$=41I1)4=6(J$80MW4AA5684.60(:W:84=4Q1):)418/)1Q=10A:Qd)10Q=4CQ68:Q
8)1.W#+%*eb+#%
]6JJ6(:9 c$ &$ F#%*\9 &4('41C *bG$ 0&+ BA1C1 >#%2& >('8)= &4('41C *#9
#%*+9 L10M D41I ?)4=6(J2 /..A2WWHHH$=41I1)4=6(J$80MW>'5()[email protected]./)Q:84=4Q
A4.8/QA10@5)MW#+%*+e\bb
]1':I49 &$ F#%%Y9 U418/ #bG$ T:GBS)= U4C #V9 #%*+9 L10M -1: O)8/(6842
/..A2WW41:.)8/(684$80MWJ4=J).:W#%%YW%\W1):)418/)1:Q=)M0(:.14.)Q@60:Q5)>)5Q
100.I6.Q4..48IW
c(4AA9 S$ D$ F#%**G$ :",$.%()#< U+%5'(6 B+2$()%;9_45./4M9 U-9 ^7-2 7C(J1)::$
f'455)(9 U$ S$ F#%*\9 Z)@1'41C *G$ B1UB BA1C1 #", >('2+.. A'"%('< B+2$()%; B$(?+;9
?).16)>)= &4('41C *#9 #%*+9 L10M 7-g7 K(:.6.'.)2 /..A:2WWHHH$:4(:$01JW1)4=6(JQ
100MW4(45C:.:QA10J14MW:4(:Q:'1>)CQ:84=4Q#%*\
`0./4M).:C9 h$9 [ Z14(d9 U$ F#%%b9 &'5C *bG$ BA1C1 F'"+;U+% >('V+2%H T$)
-
7/24/2019 Designing Implementing Honeypot Scada Network 35252
30/39
Designing and Implementing a Honeypot for a SCADA Network 29
3/4156) 780..9 8:80..;'.)0:9 g$ F#%%V9 &'5C *bG$ C+?+)= U4C #V9 #%*+9 L10M 1:C:50J2
/..A2WWHHH$1:C:50J$80MW
78/(6)=)1 S5)8.168$ F#%*%9 &4('41C *G$ E#)" +"+(7; #", )".)7&% 5)%& >'5+( N'7)29
?).16)>)= U4C *+9 #%*+9 L10M 78/()6=)1 S5)8.168 301A014.)2/..A2WW=0H(504=$:8/()6=)1Q
)5)8.168$80MWL65):jAkZ65)kK=l#B+BYVBe[AkZ65)kg4M)l`f7SD*%e%*+Sg$A=L
7A5'(I9 K(8$ F#%*+9 U4C #YG$ Z% ). B4)= U4C #Y9 #%*+9
L10M 7A5'(I2 /..A2WWHHH$:A5'(I$80MW>6)HW:A5'(IW7`Q3---abB
7.0'LL)19 c$9 Z45809 &$9 [ 7841L0()9 c$ F#%**9 &'() *G$ U:B0 B4+2)#< >$8WA'@5684.60(:W(6:.A'@:WV%%QV#W7`V%%QV#QL6(45$A=L
O)(4@5) g).H01I 7)8'16.C$ F#%*+9 %+ *\G$ >
-
7/24/2019 Designing Implementing Honeypot Scada Network 35252
31/39
Designing and Implementing a Honeypot for a SCADA Network 30
3/4156) 780..9 8:80..;'.))= &4('41C *#9 #%*+9 L10M _61)=2
/..A2WWHHH$H61)=$80MW./1)4.5)>)5W#%**W%BW/0HQ=6J6.45Q=).)8.6>):Q=)86A/)1)=Q:.')= U418/ V9 #%*+9 L10M D]- 7'LL4 ^(6>)1:6.C2
/..A2WWHHH$=:'$)='$AIW6(=)
-
7/24/2019 Designing Implementing Honeypot Scada Network 35252
32/39
Designing and Implementing a Honeypot for a SCADA Network 31
3/4156) 780..9 8:80..;'.))= L10M ./) =4.4@': @C I)C QQq
oI)Ck>45')kM4AA6(J:q
oI)C (4M)lpZ48656.Cg4M)pq
o>45') .CA)lp>45')pqpZ-3poW>45')q
oWI)CqoI)C (4M)lp7C:.)Mg4M)pq
o>45') .CA)lp>45')pqpZ-3 )U).)1poW>45')qoWI)Cq
oI)C (4M)lp7C:.)MD):816A.60(pq
o>45') .CA)lp>45')pqpKTg e#%% S**BepoW>45')qoWI)Cq
oI)C (4M)lp^A.6M)pqo>45') .CA)lpL'(8.60(pq80(A0.$)M'54.01:$M6:8$'A.6M)$^A.6M)oW>45')q
oWI)Cq
oI)C (4M)lp:C:T@i)8.KDpq
o>45') .CA)lp>45')pqp*$\$e$*$+$+\+e$**$*$#$*$*$*bpoW>45')qoWI)Cq
oI)C (4M)lp:C:30(.48.pq
o>45') .CA)lp>45')pqp3/4156) 780..poW>45')q
oWI)Cq
oI)C (4M)lp:C:g4M)pq
o>45') .CA)lp>45')pqpZ-3 )U).)1poW>45')q
oWI)CqoI)C (4M)lp:C:f084.60(pq
o>45') .CA)lp>45')pqpZ-3poW>45')qoWI)Cq
oI)C (4M)lp:C:7)1>68):pq
o>45') .CA)lp>45')pqp*#poW>45')qoWI)Cq
oI)C (4M)lpM)M01CU0=@':754>)*R508I-pq
o>45') .CA)lp>45')pq"14(=0M$14(=6(.F%9*G L01 @ 6(
14(J)F%9*#VG,oW>45')q
oWI)Cq
-
7/24/2019 Designing Implementing Honeypot Scada Network 35252
33/39
Designing and Implementing a Honeypot for a SCADA Network 32
3/4156) 780..9 8:80..;'.))*R508IRpq
o>45') .CA)lp>45')pq"14(=0M$14(=6(.F%9*G L01 @ 6( 14(J)F%9\#G,oW>45')qoWI)Cq
oI)C (4M)lpM)M01CU0=@':754>)*R508I3pq
o>45') .CA)lp>45')pq"14(=0M$14(=6(.F%9*G L01 @ 6( 14(J)F%9VG,oW>45')q
oWI)CqoI)C (4M)lpM)M01CU0=@':754>)*R508IDpq
o>45') .CA)lp>45')pq"% L01 @ 6( 14(J)F%9\#G,oW>45')q
oWI)Cq
oI)C (4M)lp30AC16J/.pq
o>45') .CA)lp>45')pqppoW>45')q
oWI)Cq
oI)C (4M)lp:Bk6=pq
o>45') .CA)lp>45')pqppoW>45')q
oWI)Cq
oI)C (4M)lp:BkM0='5)k.CA)pq
o>45') .CA)lp>45')pqppoW>45')q
oWI)CqoI)C (4M)lp)MA.Cpq
o>45') .CA)lp>45')pqppoW>45')q
oWI)CqoWI)Ck>45')kM4AA6(J:q
oW=4.4@':qoW801)q
oA10.0805:q
o:(MA )(4@5)=lpO1')p /0:.lp%$%$%$%p A01.lp*e*pq
o80(L6Jq
orQQ 30(L6J'1) 6(=6>6='45 =)54C: L01 7gU` 80MM4(=: QQq
o)(.6.C (4M)lp.41A6.p 80MM4(=lpJ).pq%$*s%$#oW)(.6.Cq
o)(.6.C (4M)lp.41A6.p 80MM4(=lp:).pq%$*s%$#oW)(.6.Cq
o)(.6.C (4M)lp.41A6.p 80MM4(=lp()4:60( ./1):/05=:F1)EkA)1k6AWM6('.)s1)Ek0>)1455WM6('.)G QQq
o)(.6.C (4M)lp)>4:60(p 80MM4(=lpJ).pq*#%s#+%oW)(.6.Cq
o)(.6.C (4M)lp)>4:60(p 80MM4(=lp:).pq*#%s#+%oW)(.6.Cq
o)(.6.C (4M)lp)>4:60(p 80MM4(=lp()4:60(p 80MM4(=lp@'5Ipq*#%s#+%oW)(.6.CqoW80(L6Jq
oM6@:qoM6@ (4M)lp7gU`>#QUKRpq
o:CM@05 (4M)lp:C:D):81pq
orQQ h45') 6: I)C 6( =4.4@': QQq
o>45')q7C:.)MD):816A.60(oW>45')q
-
7/24/2019 Designing Implementing Honeypot Scada Network 35252
34/39
Designing and Implementing a Honeypot for a SCADA Network 33
3/4156) 780..9 8:80..;'.)45')q
oW:CM@05q
o:CM@05 (4M)lp:C:30(.48.pq
o>45')q:C:30(.48.oW>45')qoW:CM@05qo:CM@05 (4M)lp:C:g4M)pq
o>45')q:C:g4M)oW>45')q
oW:CM@05q
o:CM@05 (4M)lp:C:f084.60(pq
o>45')q:C:f084.60(oW>45')q
oW:CM@05q
o:CM@05 (4M)lp:C:7)1>68):pq
o>45')q:C:7)1>68):oW>45')q
oW:CM@05q
oWM6@q
oWM6@:qoW:(MAq
oM0=@': )(4@5)=lpO1')p /0:.lp%$%$%$%p A01.lpb%#pq
o=)>68)k6(L0qoh)(=01g4M)q78/()6=)1 S5)8.168oWh)(=01g4M)q
o`10='8.30=)q`0H)1f0J68oW`10='8.30=)qoU4i01U6(01?)>6:60(qKTge#%%oWU4i01U6(01?)>6:60(q
oW=)>68)k6(L0q
o:54>):q
o:54>) 6=lp*pq
o@508I:q
o@508I (4M)lpM)M01CU0=@':754>)*R508I-pq
orQQ 3TKf7WDK73?SOSkT^O`^O7 4I4$ @6(41C 0'.A'.9 A0H)1 0(WA0H)1
0LL
])1) H) M4A M0=@': 4==1)::): * .0 *#B .0 7BQ#%% `f3 -==1)::):
t%$% .0 t*b$B QQq
o.CA)q3TKf7oW.CA)qo:.41.6(Jk4==1)::q*oW:.41.6(Jk4==1)::q
o:6d)q*#VoW:6d)q
o80(.)(.qM)M01CU0=@':754>)*R508I-oW80(.)(.q
oW@508Iqo@508I (4M)lpM)M01CU0=@':754>)*R508IRpqorQQ 3TgO-3O7WDK73?SOSkKg`^O7 4I4$ @6(41C 6(A'.$
U4A M0=@': 4==1)::): *%%%*Q*%%\# .0 7BQ#%% `f3 6(A'.::.41.6(J L10M K%$% QQq
o.CA)qDK73?SOSkKg`^O7oW.CA)q
o:.41.6(Jk4==1)::q*%%%*oW:.41.6(Jk4==1)::q
o:6d)q\#oW:6d)q
-
7/24/2019 Designing Implementing Honeypot Scada Network 35252
35/39
Designing and Implementing a Honeypot for a SCADA Network 34
3/4156) 780..9 8:80..;'.))*R508IRoW80(.)(.q
oW@508IqoW@508I:q
oW:54>)q
o:54>) 6=lp#pq
orQQ O/6: :54>) =0): :0M) M)4:'16(J$ F4(450J 6(A'.:G$U4A M0=@': 4==1)::): \%%%*Q\%%%Y .0 7B `f3 4(450J 6(A'. @6.:
-K_%Q-K_V QQq
o@508I:q
o@508I (4M)lpM)M01CU0=@':754>)*R508I3pq
orQQ _655 @) A41:)= H6./ )>45FG QQq
o.CA)q-g-fTakKg`^O7oW.CA)q
o:.41.6(Jk4==1)::q\%%%*oW:.41.6(Jk4==1)::q
o:6d)qVoW:6d)q
o80(.)(.qM)M01CU0=@':754>)*R508I3oW80(.)(.q
oW@508Iq
o@508I (4M)lpM)M01CU0=@':754>)*R508IDpq
orQQ U4A: .0 7BQ#%% `f3 4==1)::): ]05=7.41.uV QQqo.CA)q]TfDKgak?SaK7OS?7oW.CA)q
o:.41.6(Jk4==1)::q+%%%*oW:.41.6(Jk4==1)::q
o:6d)qVoW:6d)qo80(.)(.qM)M01CU0=@':754>)*R508IDoW80(.)(.q
oW@508IqoW@508I:q
oW:54>)q
oW:54>):q
oWM0=@':q
o:B80MM )(4@5)=lpZ45:)p /0:.lp%$%$%%p A01.lp*%#pq
o:C:.)Mk:.4.':k56:.:q
o::5 6=lp_v*ev
-
7/24/2019 Designing Implementing Honeypot Scada Network 35252
36/39
Designing and Implementing a Honeypot for a SCADA Network 35
3/4156) 780..9 8:80..;'.)) QQq
o)(.6.C (4M)lpD4.)pq74.9 #V -A1 *YV+ %B2\%2%% aUOoW)(.6.Cq
oW/)4=)1:q
oWJ50@45q
orQQ /0H :/0'5= ./) =6LL)1)(. ^?K 1)E'):.: @) /4(=5)= QQqo/.=08:q
o(0=) (4M)lpWpq
orQQ L018) 1):A0(:) :.4.': 80=) .0 \%# QQq
o:.4.':q\%#oW:.4.':qo/)4=)1:qorQQ ./):) /)4=)1: H655 @) :)(. 450(J H6./ ./6: 1):A0(:) QQq
o)(.6.C (4M)lp30(.)(.QOCA)pq.)
-
7/24/2019 Designing Implementing Honeypot Scada Network 35252
37/39
Designing and Implementing a Honeypot for a SCADA Network 36
3/4156) 780..9 8:80..;'.))= L01
A10='8.60( QQq
o(0=) (4M)lpW.):.:W'(6..):.k@4:)$/.M5pqo/)4=)1:q
o)(.6.C (4M)lpf4:.QU0=6L6)=pqO')9 *Y U4C *YY\ %Y2%%2%%
aUOoW)(.6.Cqo)(.6.C (4M)lp30(.)(.QOCA)pq.)
-
7/24/2019 Designing Implementing Honeypot Scada Network 35252
38/39
Designing and Implementing a Honeypot for a SCADA Network 37
3/4156) 780..9 8:80..;'.)) QQq
o.41A6.q%oW.41A6.q
o)(.6.C (4M)lp30(.)(.QOCA)pq.)) QQq
o.41A6.q%oW.41A6.qo)(.6.C (4M)lp30(.)(.QOCA)pq.)) QQqo.41A6.q%oW.41A6.q
o)(.6.C (4M)lp30(.)(.QOCA)pq.)
-
7/24/2019 Designing Implementing Honeypot Scada Network 35252
39/39
Last Updated: February 23rd, 2016
Upcoming SANS TrainingClick Here for a full list of all Upcoming SANS Events by Location
SANS Philadelphia 2016 Philadelphia, PAUS Feb 29, 2016 - Mar 05, 2016 Live Event
SANS London Spring 2016 London, GB Feb 29, 2016 - Mar 05, 2016 Live Event
HIMSS Las Vegas, NVUS Mar 03, 2016 - Mar 03, 2016 Live Event
SANS Abu Dhabi 2016 Abu Dhabi, AE Mar 05, 2016 - Mar 10, 2016 Live Event
SANS 2016 Orlando, FLUS Mar 12, 2016 - Mar 21, 2016 Live Event
ICS410 Dubai 2016 Dubai, AE Mar 13, 2016 - Mar 17, 2016 Live Event
NetWars @ NSM Conference '16 Oslo, NO Mar 16, 2016 - Mar 17, 2016 Live Event
SANS Secure Singapore 2016 Singapore, SG Mar 28, 2016 - Apr 09, 2016 Live Event
SANS Northern Virginia - Reston 2016 Reston, VAUS Apr 04, 2016 - Apr 09, 2016 Live Event
SANS Secure Europe 2016 Amsterdam, NL Apr 04, 2016 - Apr 16, 2016 Live Event
SANS Atlanta 2016 Atlanta, GAUS Apr 04, 2016 - Apr 09, 2016 Live Event
Threat Hunting and Incident Response Summit New Orleans, LAUS Apr 12, 2016 - Apr 19, 2016 Live Event
ICS Amsterdam 2016 Amsterdam, NL Apr 18, 2016 - Apr 23, 2016 Live Event
SANS Pen Test Austin Austin, TXUS Apr 18, 2016 - Apr 23, 2016 Live Event
SANS Secure Canberra 2016 Canberra, AU Apr 18, 2016 - Apr 23, 2016 Live Event
SANS Copenhagen 2016 Copenhagen, DK Apr 25, 2016 - Apr 30, 2016 Live Event
SANS Security West 2016 San Diego, CAUS Apr 29, 2016 - May 06, 2016 Live Event
SANS SEC542 Budapest Budapest, HU May 02, 2016 - May 07, 2016 Live Event
SANS Houston 2016 Houston, TXUS May 09, 2016 - May 14, 2016 Live Event
SANS Baltimore Spring 2016 Baltimore, MDUS May 09, 2016 - May 14, 2016 Live Event
SANS Stockholm 2016 Stockholm, SE May 09, 2016 - May 14, 2016 Live Event
SANS Prague 2016 Prague, CZ May 09, 2016 - May 14, 2016 Live Event
SANS Melbourne 2016 Melbourne, AU May 16, 2016 - May 21, 2016 Live Event
Security Operations Center Summit & Training Crystal City, VAUS May 19, 2016 - May 26, 2016 Live Event
RSA Conference 2016 OnlineCAUS Feb 28, 2016 - Feb 29, 2016 Live Event
SANS OnDemand Books & MP3s OnlyUS Anytime Self Paced
http://www.sans.org/info/36919http://www.sans.org/info/36919http://www.sans.org/link.php?id=40922http://www.sans.org/philadelphia-2016http://www.sans.org/link.php?id=40947http://www.sans.org/london-in-the-spring-2016http://www.sans.org/link.php?id=44415http://www.sans.org/himss-2016http://www.sans.org/link.php?id=41225http://www.sans.org/abu-dhabi-2016http://www.sans.org/link.php?id=27559http://www.sans.org/sans-2016http://www.sans.org/link.php?id=44047http://www.sans.org/ics410-dubai-2016http://www.sans.org/link.php?id=44430http://www.sans.org/netwars-at-nsm-annual-security-conference-2016http://www.sans.org/link.php?id=40932http://www.sans.org/secure-singapore-2016http://www.sans.org/link.php?id=41542http://www.sans.org/reston-2016http://www.sans.org/link.php?id=40985http://www.sans.org/secure-europe-2016http://www.sans.org/link.php?id=41557http://www.sans.org/atlanta-2016http://www.sans.org/link.php?id=41307http://www.sans.org/threat-hunting-and-incident-response-summit-2016http://www.sans.org/link.php?id=41230http://www.sans.org/ics-amsterdam-2016http://www.sans.org/link.php?id=41562http://www.sans.org/pentest2016http://www.sans.org/link.php?id=41592http://www.sans.org/secure-canberra-2016http://www.sans.org/link.php?id=41220http://www.sans.org/copenhagen-2016http://www.sans.org/link.php?id=41547http://www.sans.org/sans-security-west-2016http://www.sans.org/link.php?id=44435http://www.sans.org/sec542-budapest-2016http://www.sans.org/link.php?id=41572http://www.sans.org/houston-2016http://www.sans.org/link.php?id=41567http://www.sans.org/baltimore-spring-2016http://www.sans.org/link.php?id=41240http://www.sans.org/stockholm-2016http://www.sans.org/link.php?id=41235http://www.sans.org/prague-2016http://www.sans.org/link.php?id=41602http://www.sans.org/melbourne-2016http://www.sans.org/link.php?id=43422http://www.sans.org/security-operations-center-summit-2016http://www.sans.org/link.php?id=43567http://www.sans.org/rsa-conference-2016http://www.sans.org/link.php?id=1032http://www.sans.org/ondemand/about.phphttp://www.sans.org/ondemand/about.phphttp://www.sans.org/link.php?id=1032http://www.sans.org/rsa-conference-2016http://www.sans.org/link.php?id=43567http://www.sans.org/security-operations-center-summit-2016http://www.sans.org/link.php?id=43422http://www.sans.org/melbourne-2016http://www.sans.org/link.php?id=41602http://www.sans.org/prague-2016http://www.sans.org/link.php?id=41235http://www.sans.org/stockholm-2016http://www.sans.org/link.php?id=41240http://www.sans.org/baltimore-spring-2016http://www.sans.org/link.php?id=41567http://www.sans.org/houston-2016http://www.sans.org/link.php?id=41572http://www.sans.org/sec542-budapest-2016http://www.sans.org/link.php?id=44435http://www.sans.org/sans-security-west-2016http://www.sans.org/link.php?id=41547http://www.sans.org/copenhagen-2016http://www.sans.org/link.php?id=41220http://www.sans.org/secure-canberra-2016http://www.sans.org/link.php?id=41592http://www.sans.org/pentest2016http://www.sans.org/link.php?id=41562http://www.sans.org/ics-amsterdam-2016http://www.sans.org/link.php?id=41230http://www.sans.org/threat-hunting-and-incident-response-summit-2016http://www.sans.org/link.php?id=41307http://www.sans.org/atlanta-2016http://www.sans.org/link.php?id=41557http://www.sans.org/secure-europe-2016http://www.sans.org/link.php?id=40985http://www.sans.org/reston-2016http://www.sans.org/link.php?id=41542http://www.sans.org/secure-singapore-2016http://www.sans.org/link.php?id=40932http://www.sans.org/netwars-at-nsm-annual-security-conference-2016http://www.sans.org/link.php?id=44430http://www.sans.org/ics410-dubai-2016http://www.sans.org/link.php?id=44047http://www.sans.org/sans-2016http://www.sans.org/link.php?id=27559http://www.sans.org/abu-dhabi-2016http://www.sans.org/link.php?id=41225http://www.sans.org/himss-2016http://www.sans.org/link.php?id=44415http://www.sans.org/london-in-the-spring-2016http://www.sans.org/link.php?id=40947http://www.sans.org/philadelphia-2016http://www.sans.org/link.php?id=40922http://www.sans.org/info/36919