SANS AUD507 Web References
This page gives links to Internet resources commonly discussed in the course and given in the course book notes.
General Security Principles
Saltzer/Schroeder Protection of Information in Computer Systems
Sample Work Programs
Federal Financial Institution Examination Council (FFIEC) IT Handbook
CIS Benchmarks – These will be referenced throughout the week
Time-Based Security
CIS Measurement Companion for Version 6 of the Critical Controls
Measures and Metrics for Critical Controls v7
NMap
Windows
Microsoft Product Lifecycle Policy
Windows lifecycle fact sheet - Windows 10
Windows 10 Release Information
PowerShell
PowerShell 5.1 Online Documentation
PowerShell 6 Online Documentation
PowerShell GitHub Reference Repository
PowerShell Compatibility Matrix - contains Windows and Linux install files
Windows PowerShell cmdlets removed from PowerShell 7.x+
WMI
Patch Management
Microsoft Endpoint Configuration Manager (MECM)
Local Users/Active Directory
Microsoft Local Administrator Password Soultion (LAPS)
List of All AD Schema Attributes
Passwords
Dumping AD Hashes for Cracking
Permissions: Numeric Values for Windows File System Access Controls
User Rights
Microsoft Security Compliance Toolkit
File Integrity Assessment
Group Policy
Microsoft Security Compliance Toolkit
OSQuery/FleetDM
Accreditation Checklist References
File Integrity Monitoring
Linux/UNIX Patching
NFS
Systemd
Linux Training Academy Systemd Cheat Sheet
Fedora Magazine Seven-Part Series on Systemd
Loggly Article on Systemd Logging
Cloud and Containers Audit Resources
Amazon Shared Responsibility Model
Google document detailing shared responsibility for PCI compliance
AICPA Sample SOC2 Report Plus CCM
Cloud Security Alliance Cloud Controls Matrix (CSA CCM)
Cloud Security Alliance Security Guidance version 4
Cloud Security Alliance STAR certification program
ENISA Cloud Security Risk Assessment (Dated 2009 but still considered a definitive source)
ENISA Cloud Security for Healthcare Services
Amazon Web Services CSA Star questionnaire
Illustrated Children’s Guide to Kubernetes - Video
Illustrated Children’s Guide to Kubernetes - PDF
ISACA Container Auditing Guideline - (Costs USD 50 for non-members)
SANS Reading Room Paper on Docker Auditing
Cloud Security Alliance Container Working Group
General Cloud Guidance/Shared Responsibility
Amazon Shared Responsibility Model
AWS Compliance Resources
AWS Security Finding Format (ASFF)
Using Chef InSpec profiles with Systems Manager Compliance
AWS Access Analyzer User Guide
AWS Well-Architected Framework
Introduction to Auditing the Use of AWS
AWSLabs CIS Benchmark-related Github repo
Cloud Formation Drift Detection
AWS Pillars of the Well-Architected Framework
ToniBlyx Arsenal of AWS Security Tools
Cloud Provider CLI References
VMWare
VMWare Product Lifecycle Matrix
VMWare Hardware Compatibility Lookup
VMWare vSphere 6.7 Release Notes - (Note the discontinued support for many CPU series)
VMWare vSphere 7.0 Release Notes
RobWare RV Tools - VMWare/VCenter Info GUI
HTTP/HTML Intro
Web Services
RESTful APIs (Roy Fielding’s doctoral dissertation)
Cookies
Cookies - Mozilla Developer Network
Burp Proxy
PortSwigger Documentation - Trusting the Burp CA Certifciate
OWASP Controls
Netcraft
TLS
Qualys SSL Labs Server Rating Guide
Fuzzing
Framework/Library Testing
More Examples of Package Misuse/Abuse 2020
More Examples of Package Misuse/Abuse 2021
Wappalyzer browser plugins - Chrome
Wappalyzer browser plugins - Firefox
Business Logic and Application Testing
OWASP Application Security Verification Standard
Authentication
NIST Digital Identity Guidance
HaveIBeenPwned password checking API
Cross-Site Request Forgery (CSRF)
Cross-Site Request Forgery Intro
OWASP SameSite Cookie Attribute page
Script Injection (Cross-Site Scripting)
OWASP XSS Prevention Cheat Sheet
SQL Injection
OWASP SQL Injection Prevention Cheat Sheet
NetSparker SQL Injection Tutorial Cheat Sheet
GIAC Exam Resources
GIAC Proctored Exam Information