applied security conferences and training: CanSecWest | PacSec |

Security Masters Dojo

Advanced and intermediate security training and technology enhancement for information security professionals.

CanSecWest: Security Masters Dojo Vancouver

Hunting the Adversary: Applying Cyber Threat Intelligence

Register for the March 16-17, 2020 (2-day course)

John Bambenek


Traditional security defence tools are increasingly unable to protect against emerging and current attacks. The modern attacker has adopted advanced tools and techniques that are unable to be stopped with traditional firewalls, intrusion detection and anti-virus. Meanwhile, dedicated attackers are attempting intrusions over months and years while going undetected to steal valuable information, trade secrets and financial information. Defence techniques that leverage information about attackers and their techniques, however, provide the ability to greatly enhance the security of an organization.

Modern defences can integrate intelligence and counterintelligence information which greatly increases the ability to keep attackers out and to detect their presence quickly. This course will teach students about the tools they can use to gain insight into attackers and to integrate them into their organization. This course will be a mix of lecture and hands-on training so students will be equipped on day one to go back to their work and start using threat intelligence to protect their networks.

PREREQUISITE WARNING Each class has prerequisites for software loads and a laptop is mandatory. These individual class guides will list material the students are expected have knowledge about coming in and software tools that need to be pre-installed before attending so you get the maximum benefit from the focused intermediate or advanced level course. Please pay particular attention to the prerequisites, as the material listed there will not be reviewed in the courses, and will be necessary to get the maximum benefit out of these educational programs.

Course Modules:


Basic scripting (bash or python), understanding of reverse engineering malware and sandboxing, knowledge of networking and DNS.

What you will need to bring:

A laptop capable of running VMs (specifics and configs will be sent to students prior to class).

Who Should Attend:

Investigators, network defenders, incident responders and anyone interested in how to use intelligence to get ahead of the adversary.