Blueprint: Build the Best in Cyber Defense
SANS Institute
Are you a cyber defender looking to keep up on the newest tools, technology, and security concepts? Then BLUEPRINT is the podcast for you! Tune in to hear the latest in cyber defense and security operations from blue team leaders and experts. With a focus on learning, BLUEPRINT includes interviews with today’s top security practitioners defending the world’s most respected brands, and in-depth explanations on the newest technologies, protocols, and defensive tools. BLUEPRINT, is a podcast hosted by John Hubbard and brought to you by the SANS Institute. BLUEPRINT - your one-stop shop for taking your defense skills to the next level!
1 Listener
All episodes
Best episodes
Seasons
Top 10 Blueprint: Build the Best in Cyber Defense Episodes
Goodpods has curated a list of the 10 best Blueprint: Build the Best in Cyber Defense episodes, ranked by the number of listens and likes each episode have garnered from our listeners. If you are listening to Blueprint: Build the Best in Cyber Defense for the first time, there's no better place to start than with one of these standout episodes. If you are a fan of the show, vote for your favorite Blueprint: Build the Best in Cyber Defense episode by adding your comments to the episode page.
Rob Lee: Training and Reskilling in Cyber Security
Blueprint: Build the Best in Cyber Defense
08/30/22 • 51 min
Click here to send us your ideas and feedback on Blueprint!
Many of us are either looking to start a cyber security career, improve our knowledge and skills to further our career, or hire a team that has the most skilled and promising candidates. In this special episode with Rob Lee, Chief Curriculum Director of the SANS Institute, we discuss strategies for building, improving, and testing your cyber security group’s skill levels, and working to keep our knowledge as current as possible - a critical skill for anyone in the fast moving world of cyber security.
Rob Lee
Rob Lee is the Chief Curriculum Director and Faculty Lead at SANS Institute and runs his own consulting business specializing in information security, incident response, threat hunting, and digital forensics. With more than 20 years of experience in digital forensics, vulnerability and exploit discovery, intrusion detection/prevention, and incident response, he is known as “The Godfather of DFIR”. Rob co-authored the book Know Your Enemy, 2nd Edition, and is course co-author of FOR500: Windows Forensic Analysis and FOR508: Advanced Incident Response, Threat Hunting, and Digital Forensics.
Sponsor's Note:
Support for the Blueprint podcast comes from the SANS Institute.
If you like the topics covered in this podcast and would like to learn more about blue team fundamentals such as host and network data collection, threat detection, alert triage, incident management, threat intelligence, and more, check out my new course SEC450: Blue Team Fundamentals.
This course is designed to bring attendees the information that every SOC analyst and blue team member needs to know to hit the ground running, including 15 labs that get you hands on with tools for threat intel, SIEM, incident management, automation and much more, this course has everything you need to launch your blue team career.
Check out the details at sansurl.com/450 Hope to see you in class!
Follow SANS Cyber Defense: Twitter | LinkedIn | YouTube
Follow John Hubbard: Twitter | LinkedIn
PRE-ROLL only! It says lets jump in at the end.
Check out John's SOC Training Courses for SOC Analysts and Leaders:
- SEC450: Blue Team Fundamentals - Security Operations and Analysis
- LDR551: Building and Leader Security Operations Centers
Follow and Connect with John: LinkedIn
1 Listener
Playbook for Security Onion
Blueprint: Build the Best in Cyber Defense
03/30/21 • 34 min
Click here to send us your ideas and feedback on Blueprint!
Driving consistency and maintaining a high standard for alert response is a problem all SOCs must face, but how? In this episode, Josh Brower describes his efforts to combine automated detection signature deployment and use case database management into a single, easy to use app for Security Onion. Whether you use Security Onion or not, this episode dives into the design principles and workflow Josh used when designing the new open-source Playbook app and there’s something to learn from it for everyone on the Blue Team.
Our Guest - Josh Brower
Josh Brower has been crashing computers since his teens, and now feels fortunate to be doing it professionally. He has spent the last 12 years focusing on InfoSec, particularly network and endpoint detection. He also enjoys teaching around InfoSec issues, especially to non-technical learners - helping them to understand how their actions in the digital world have real-world consequences, as well as how to proactively reduce the risk.
Follow Josh
Twitter: @DefensiveDepth
LinkedIn: /in/joshbrower
Web: https://defensivedepth.com
Support for the Blueprint podcast comes from the SANS Institute
Are you looking for the best in-depth training for your cyber defense team? Look no further than SANS blue team curriculum courses!
Whether you focus on network or host data, Windows or Linux, or even specialize in open source intel, SIEM, SOC, or defensive architecture, the SANS Blue Team curriculum has the course for you. From long-time classics like SEC503 Network Intrusion Detection to the newer SEC530 Defensible Security Architecture and Engineering and SEC487 Open Source Intelligence Gathering - we've got you covered, no matter what your specialty.
With an extensive archive of free webcasts on the SANS site, and free online demos available for most courses, you can easily check out the SANS blue team catalog and see which course is the best fit for you and your team.
Check out the constantly growing list of available courses at sansurl.com/blueteamops
Follow SANS Cyber Defense: Twitter | LinkedIn | YouTube
Follow John Hubbard: Twitter | LinkedIn
PRE-ROLL only! It says lets jump in at the end.
Check out John's SOC Training Courses for SOC Analysts and Leaders:
- SEC450: Blue Team Fundamentals - Security Operations and Analysis
- LDR551: Building and Leader Security Operations Centers
Follow and Connect with John: LinkedIn
Understanding and Applying Threat Intelligence
Blueprint: Build the Best in Cyber Defense
07/07/20 • 40 min
Click here to send us your ideas and feedback on Blueprint!
Katie Nickels talks about what threat intelligence is, where to get it, what you should expect from it, and how the SOC should be using it.
Twitter Handles: @likethecoins | @SecHubb | @SANSDefense
All Blueprint Podcast Episodes: sans.org/blueprint-podcast
PRE-ROLL only! It says lets jump in at the end.
Check out John's SOC Training Courses for SOC Analysts and Leaders:
- SEC450: Blue Team Fundamentals - Security Operations and Analysis
- LDR551: Building and Leader Security Operations Centers
Follow and Connect with John: LinkedIn
Strategy 2: Give the SOC the Authority to Do Its Job
Blueprint: Build the Best in Cyber Defense
05/15/23 • 38 min
Click here to send us your ideas and feedback on Blueprint!
Though a SOC is responsible for protecting your organization's assets, it is not the owner of those systems. If the SOC is not established with a clear charter and authority to act, it may quickly become difficult to be effective. Who should the SOC report to, what should be in a SOC charter, and how can we make these tough decisions? Those are the questions covered in this episode of our special "11 Strategies" season. This episode covers chapter 2 of the book - "Give the SOC the Authority to Do Its Job".
This special season of the Blueprint Podcast is taking a deep dive into MITRE’s 11 Strategies of a World-Class Cyber Security Operations Center. Each episode John will break down a chapter of the book with the book’s authors Kathryn Knerler, Ingrid Parker, and Carson Zimmerman.
Visit Mitre's page for more information
-----------
Sponsor's Note
Support for the Blueprint podcast comes from the SANS Institute.
If you like the topics covered in this podcast and would like to learn more about blue team fundamentals such as host and network data collection, threat detection, alert triage, incident management, threat intelligence, and more, check out my new course SEC450: Blue Team Fundamentals.
This course is designed to bring attendees the information that every SOC analyst and blue team member needs to know to hit the ground running, including 15 labs that get you hands on with tools for threat intel, SIEM, incident management, automation and much more, this course has everything you need to launch your blue team career.
Check out the details at sansurl.com/450 Hope to see you in class!
Follow SANS Cyber Defense: Twitter | LinkedIn | YouTube
Follow John Hubbard: Twitter | LinkedIn
PRE-ROLL only! It says lets jump in at the end.
Check out John's SOC Training Courses for SOC Analysts and Leaders:
- SEC450: Blue Team Fundamentals - Security Operations and Analysis
- LDR551: Building and Leader Security Operations Centers
Follow and Connect with John: LinkedIn
Strategy 7: Select and Collect the Right Data
Blueprint: Build the Best in Cyber Defense
06/19/23 • 64 min
Click here to send us your ideas and feedback on Blueprint!
There's no denying that the average security team is completely overwhelmed with options for data to collect. With a deluge of endpoint, network, and cloud data sources to collect, how to do we identify and collect the most useful data sources? That's the topic of this episode. Join Kathryn, Ingrid, Carson, and John in this episode for a discussion on tactical data collection that will ensure your team doesn't miss the signs of an impending incident!
This special season of the Blueprint Podcast is taking a deep dive into MITRE’s 11 Strategies of a World-Class Cyber Security Operations Center. Each episode John will break down a chapter of the book with the book’s authors Kathryn Knerler, Ingrid Parker, and Carson Zimmerman.
-----------
Support for the Blueprint podcast comes from the SANS Institute.
If you like the topics covered in this podcast and would like to learn more about blue team fundamentals such as host and network data collection, threat detection, alert triage, incident management, threat intelligence, and more, check out my new course SEC450: Blue Team Fundamentals.
This course is designed to bring attendees the information that every SOC analyst and blue team member needs to know to hit the ground running, including 15 labs that get you hands on with tools for threat intel, SIEM, incident management, automation and much more, this course has everything you need to launch your blue team career.
Check out the details at sansurl.com/450 Hope to see you in class!
Follow SANS Cyber Defense: Twitter | LinkedIn | YouTube
Follow John Hubbard: Twitter | LinkedIn
PRE-ROLL only! It says lets jump in at the end.
Check out John's SOC Training Courses for SOC Analysts and Leaders:
- SEC450: Blue Team Fundamentals - Security Operations and Analysis
- LDR551: Building and Leader Security Operations Centers
Follow and Connect with John: LinkedIn
Jamie Williams: Adversary Emulation
Blueprint: Build the Best in Cyber Defense
05/18/21 • 50 min
Click here to send us your ideas and feedback on Blueprint!
There are numerous ways to test your SOC's detection and prevention capabilities, but not all are created equal. Each has their own strengths and weaknesses, and can be done on a different time scale.This week, we focus on arguably one of the most important - adversary emulation. In this episode we speak with Jamie Williams from the MITRE ATT&CK team about why adversary emulation is important, how it works, how you can get started regardless of the size of your team, and how to track and run an adversary emulation test.
Our guest: Jamie Williams
Jamie Williams is a Principal Adversary Emulation Engineer for the MITRE Corporation where he works on various exciting efforts involving security operations and research, specializing in adversary emulation and behavior-based detections. He also leads teams that help shape and deliver the “adversary-touch” within ATT&CK® and ATT&CK Evaluations.
Follow Jamie Williams on Twitter (@jamieantisocial) and LinkedIn (/in/jamie-williams-108369190).
Sponsor's Note
Support for the Blueprint podcast comes from the SANS Institute.
Since the debut of SEC450, we’ve always had students interested in a matching course covering the management and leadership aspects of running a SOC. If you like the topics in this podcast and would like to learn more about Blue Team leadership and management, check out the new MGT551: Building and Leading Security Operations Centers. This new course is designed for Security Team leaders looking to build, grow and operate a security operation center with peak efficiency. It’s a hands-on technical leadership course, that takes you through everything from scoping threat groups to use case creation, threat hunting, planning, SOC maturity and detection assessment and much much more.
Check out the course syllabus, labs and a free demo at sansurl.com/551
Follow SANS Cyber Defense: Twitter | LinkedIn | YouTube
Follow John Hubbard: Twitter | LinkedIn
PRE-ROLL only! It says lets jump in at the end.
Check out John's SOC Training Courses for SOC Analysts and Leaders:
- SEC450: Blue Team Fundamentals - Security Operations and Analysis
- LDR551: Building and Leader Security Operations Centers
Follow and Connect with John: LinkedIn
Strategy 11: Turn up the Volume by Expanding SOC Functionality
Blueprint: Build the Best in Cyber Defense
07/18/23 • 87 min
Click here to send us your ideas and feedback on Blueprint!
"This final chapter of the book is no simple closer! "Turn Up the Volume by Expanding SOC Functionality" covers testing that your SOC is functioning as intended through activities such as Threat Hunting, Red and Purple Teaming, Adversary Emulation, Breach and Attack Simulation, tabletop exercises and more. There's even a discussion of cyber deception types and tactics, and how it can be used to further frustrate attackers. Join John, Kathryn, Ingrid, and Carson in this final chapter episode for some not to be missed tips!
This special season of the Blueprint Podcast is taking a deep dive into MITRE’s 11 Strategies of a World-Class Cyber Security Operations Center. Each episode John will break down a chapter of the book with the book’s authors Kathryn Knerler, Ingrid Parker, and Carson Zimmerman.
Support for the Blueprint podcast comes from the SANS Institute.
If you like the topics covered in this podcast and would like to learn more about blue team fundamentals such as host and network data collection, threat detection, alert triage, incident management, threat intelligence, and more, check out my new course SEC450: Blue Team Fundamentals.
This course is designed to bring attendees the information that every SOC analyst and blue team member needs to know to hit the ground running, including 15 labs that get you hands on with tools for threat intel, SIEM, incident management, automation and much more, this course has everything you need to launch your blue team career.
Check out the details at sansurl.com/450 Hope to see you in class!
PRE-ROLL only! It says lets jump in at the end.
Check out John's SOC Training Courses for SOC Analysts and Leaders:
- SEC450: Blue Team Fundamentals - Security Operations and Analysis
- LDR551: Building and Leader Security Operations Centers
Follow and Connect with John: LinkedIn
Jaron Bradley: Securing Enterprise macOS
Blueprint: Build the Best in Cyber Defense
08/23/22 • 59 min
Click here to send us your ideas and feedback on Blueprint!
In this episode of the Blueprint Podcast, we cover monitoring and securing macOS in an enterprise environment at scale with Jaron Bradley, Threat Detection lead at Jamf. We discuss the ups and downs of Apple's approach to macOS data collection over the years, the data sources and types that are accessible to defenders, what 3rd party agents bring to the table for security monitoring, and much more. Plus, Jaron gives us some great bonus tips for finding persistence mechanisms and malicious processes in enterprise macOS devices.
Our Guest - Jaron Bradley
Jaron has a background in Incident Response, threat hunting, and detections development. After focusing on large scale APT attacks he developed an interest in the more niche spaces of lesser explored operating systems. He has experience as both a SOC analyst as well as detections engineering at the endpoint level.Jaron currently works as the macOS Detections Lead at Jamf Threat Labs and manages his own security tools and content for security researchers atthemittenmac.com. He is also the author of OS X Incident Response Scripting and Analysis. A book he claims is slightly outdated but still relevant to a lot of macOS analysis today.
Resources mentioned in this episode
Websites
- https://www.themittenmac.com (my website)
- objective-see.com (great mac security website)
- Major Blogs Referenced by Jamf Threat Labs
Conferences
- Jamf Nation User Conference -> https://www.jamf.com/events/jamf-nation-user-conference/2022/
- Objective by the sea 5.0 ->
PRE-ROLL only! It says lets jump in at the end.
Check out John's SOC Training Courses for SOC Analysts and Leaders:
- SEC450: Blue Team Fundamentals - Security Operations and Analysis
- LDR551: Building and Leader Security Operations Centers
Follow and Connect with John: LinkedIn
From Clues to Containment - Unraveling A Gift Card Fraud Scheme with Mark Jeanmougin
Blueprint: Build the Best in Cyber Defense
10/09/24 • 37 min
Click here to send us your ideas and feedback on Blueprint!
In this episode, we take you behind the scenes of a complex gift card fraud investigation. Join host John Hubbard and guest Mark Jeanmougin as they explore the intricate details of uncovering and combating a clever case of cyber fraud. In this episode Mark discusses how the incident was identified, investigated, contained, and what lessons were learned along the way.
Episode Links:
- Mark's LinkedIn Profile: https://www.linkedin.com/in/markjx/
- Mark's Teaching Schedule: https://www.sans.org/profiles/mark-jeanmougin/
PRE-ROLL only! It says lets jump in at the end.
Check out John's SOC Training Courses for SOC Analysts and Leaders:
- SEC450: Blue Team Fundamentals - Security Operations and Analysis
- LDR551: Building and Leader Security Operations Centers
Follow and Connect with John: LinkedIn
Joe Lykowski: Building a Transparent, Data-Driven SOC
Blueprint: Build the Best in Cyber Defense
09/06/22 • 56 min
Click here to send us your ideas and feedback on Blueprint!
In this episode we speak with Joe Lykowski - Cyber Defense Lead at a major manufacturing company on what it takes to build a mature, transparent, and effective SOC. Joe brings years of experience to the table in running a large organization’s security team and in this interview he draws out some of his favorite tips, strategies and more on metrics, building the right team, and what to prioritize as you build up a SOC for an org of any size.
Our Guest - Joe Lykowski
A graduate of Western Michigan University, Joe has 19 years of professional IT experience ranging from academia, industrial control systems and manufacturing IT, mobile device service management, telepresence services, endpoint protection, and cyber security operations. His current role focused on leading a global team of cyber defenders with the core goal of protecting Dow from the growing cybersecurity threats.
Follow Joe on Twitter: @JosephLykowski
Sponsor's Note:
Support for the Blueprint podcast comes from the SANS Institute.
If you like the topics covered in this podcast and would like to learn more about blue team fundamentals such as host and network data collection, threat detection, alert triage, incident management, threat intelligence, and more, check out my new course SEC450: Blue Team Fundamentals.
This course is designed to bring attendees the information that every SOC analyst and blue team member needs to know to hit the ground running, including 15 labs that get you hands on with tools for threat intel, SIEM, incident management, automation and much more, this course has everything you need to launch your blue team career.
Check out the details at sansurl.com/450 Hope to see you in class!
Follow SANS Cyber Defense: Twitter | LinkedIn | YouTube
Follow John Hubbard: Twitter | LinkedIn
PRE-ROLL only! It says lets jump in at the end.
Check out John's SOC Training Courses for SOC Analysts and Leaders:
- SEC450: Blue Team Fundamentals - Security Operations and Analysis
- LDR551: Building and Leader Security Operations Centers
Follow and Connect with John: LinkedIn
Show more best episodes
Show more best episodes
FAQ
How many episodes does Blueprint: Build the Best in Cyber Defense have?
Blueprint: Build the Best in Cyber Defense currently has 59 episodes available.
What topics does Blueprint: Build the Best in Cyber Defense cover?
The podcast is about Podcasts and Technology.
What is the most popular episode on Blueprint: Build the Best in Cyber Defense?
The episode title 'Rob Lee: Training and Reskilling in Cyber Security' is the most popular.
What is the average episode length on Blueprint: Build the Best in Cyber Defense?
The average episode length on Blueprint: Build the Best in Cyber Defense is 51 minutes.
How often are episodes of Blueprint: Build the Best in Cyber Defense released?
Episodes of Blueprint: Build the Best in Cyber Defense are typically released every 7 days.
When was the first episode of Blueprint: Build the Best in Cyber Defense?
The first episode of Blueprint: Build the Best in Cyber Defense was released on Jun 9, 2020.
Show more FAQ
Show more FAQ