CyberOps Associate v1.0

Cursul CyberOps Associate oferă cunoștințele și abilitățile necesare pentru a gestiona cu succes responsabilitățile unui analist de securitate la nivel Associate, care lucrează într-un Security Operations Center (SOC). 

La finalizarea cursului CyberOps Associate, studenții vor putea îndeplini următoarele sarcini: 

• Să instaleze și să folosească mașini virtuale pentru a crea un mediu sigur pentru implementarea și analiza evenimentelor generate de amenințările actuale de securitate cibernetică​
• Să explice rolul analistului de operațiuni de securitate cibernetică în industrie
• Să explice și să utilizeze facilitățile sistemului de operare Windows, necesare pentru a susține analizele de securitate cibernetică
• Să explice și să utilizeze caracteristicile sistemului de operare Linux
• Să analizeze funcționarea protocoalelor și a serviciilor de rețea
• Să explice funcționarea infrastructurii de rețea
• Să clasifice diferitele tipuri de atacuri în rețea
• Să utilizeze diverse instrumente de monitorizare a rețelei pentru a identifica atacurile împotriva protocoalelor și serviciilor de rețea
• Să explice cum să prevină accesul malițios la rețelele de calculatoare, end-device-uri și la datele de pe acestea
• Să explice impactul criptografiei asupra monitorizării securității rețelei
• Să explice și să investigheze vulnerabilitățile și atacurile asupra end-device-urilor
• Să evalueze alertele de securitate ale rețelei
• Să analizeze datele privind intruziunile în rețea pentru a identifica device-urile compromise și vulnerabilitățile
• Să aplice modele de răspuns pentru a gestiona incidentele de securitate a rețele

Curriculum

• Ședința 1 Security Operations Center, Windows OS (3h 30m)
  • War Stories
  • Threat Actors
  • Threat Impact
  • The Modern Security Operations Center
  • Becoming a Defender – Possible Certifications
  • Lab - Installing the Virtual Machines
  • Windows History
  • Windows Architecture and Operations
  • Windows Configuration and Monitoring
  • Windows Security
  • Lab - Identify Running Processes
  • Lab - Exploring Processes, Threads, Handles, and Windows Registry
  • Lab - Create User Accounts
  • Lab - Using Windows PowerShell
  • Lab - Windows Task Manager
  • Lab - Monitor and Manage System Resources in Windows
• Ședința 2 Linux Operating System (3h 30m)
  • Linux Basics
  • Working in the Linux Shell
  • Linux Servers and Clients
  • Basic Server Administration
  • The Linux File System
  • Working with the Linux GUI
  • Working on a Linux Host
  • Lab - Working with Text Files in the CLI
  • Lab - Getting Familiar with the Linux Shell
  • Lab - Linux Servers
  • Lab - Locating Log Files
  • Lab - Navigating the Linux Filesystem and Permission Settings
• Ședința 3 Network Fundamentals (3h 30m)
  • Network Communications Process​
  • Communications Protocols
  • Data Encapsulation
  • Ethernet
  • IPv4 and IPv6 Addresses
  • ICMP, Ping and Traceroute Utilities
  • MAC and IP, ARP, ARP Issues
  • The transport Layer
  • Network Services – DHCP, DNS, NAT, FTP, Email, HTTP
  • Lab - Tracing a Route
  • Lab - Introduction to Wireshark
  •  Lab - Using Wireshark to Examine Ethernet Frames
  • Lab - Using Wireshark to Observe the TCP 3-Way Handshake
  • Lab - Exploring Nmap
  • Lab - Using Wireshark to Examine a UDP DNS Capture
  • Lab - Using Wireshark to Examine TCP and UDP Captures
  • Lab - Using Wireshark to Examine HTTP and HTTPS Traffic
    
• Ședința 4 Network Infrastructure Security (3h 30m)
  • Network Devices
  • Routers, Hubs, Switches, VLANs, STP
  • Wireless Communications
  • Network Topologies
  • Security Devices
  • Security Services
  • Lab - ACL, SNMP, NetFlow, SPAN, Syslog, NTP, AAA, VPN
• Ședința 5 Threats and Attacks (Part 1) (3h 30m)
  • Attackers and Their Tools​
  • Threat Actor Tools
  • Common Threats and Attacks
  • Categories of Attacks
  • Reconnaissance Attacks
  • Access Attacks
  • DoS and DDoS Attacks
  • Buffer Overflow Attack
  • Lab - Network Monitoring and Tools
  • Attacking the Foundation
  • IP Vulnerabilities
  • Amplification, Reflection, and Spoofing Attacks
    
  • Lab - TCP and UDP Vulnerabilities
    
• Ședința 6 Threats and Attacks (Part 2) (3h 30m)
  • Attacking What We Do​
  • ARP Vulnerabilities
  • ARP Cache Poisoning
  • DNS Attacks
  • DHCP Attacks
  • Common HTTP Exploits
  • Web-Exposed Databases
  • Cross-Site Scripting
  • Lab - Anatomy of Malware
  • Lab - Exploring DNS Traffic
  • Lab - Reading Server Logs
  • Lab - Attacking a MySQL Database
    
• Ședința 7 Network Defense (3h 30m)
  • Understanding Defense​
  • Assets, Vulnerabilities, Threats
  • Security Policies, Regulations, and Standards
  • Access Control Concepts
  • Lab - AAA Usage and Operation
  • Threat Intelligence Services
  • FireEye
  • Common Vulnerabilities and Exposures (CVE) Database
  • Threat Intelligence Communication Standards
  • Threat Intelligence Platforms
    
• Ședința 8 Cryptography and Endpoint Protection (Part 1) (3h 30m)
  • Cryptography​
  • Integrity and Authenticity
  • Confidentiality
  • Lab - Symmetric and Asymmetric Encryption
  • Diffie-Hellman
  • Lab - Public Key Cryptography
  • Authorities and the PKI Trust System
    
  • Applications and Impacts of Cryptography
    
• Ședința 9 Cryptography and Endpoint Protection (Part 2) (3h 30m)
  • Endpoint Protection​
  • Antimalware Protection
  • Host-Based Malware Protection
  • Network-Based Malware Protection
  • Host-Based Intrusion Prevention
  • Application Security
  • Application Block Listing and Allow Listing
  • System-Based Sandboxing
  • Endpoint Vulnerability Assessment
  • Common Vulnerability Scoring System (CVSS)
  • Secure Device Management
  • Information Security Management Systems
  • Lab - Hashing Things Out
  • Lab - Encrypting and Decrypting Data Using OpenSSL
  • Lab - Encrypting and Decrypting Data Using a Hacker Tool
  • Lab - Examining Telnet and SSH in Wireshark
  • Lab - Certificate Authority Stores
    
• Ședința 10 Protocols and Log Files (3h 30m)
  • Technologies and Protocols
  • Lab - Monitoring Common Protocols
  • Security Technologies
  • Network Security Data
  • Types of Security Data
  • End Device Logs
  • Network Logs
    
• Ședința 11 Analyzing Security Data (3h 30m)
  • Evaluating Alerts​
  • Lab - Snort and Firewall Rules
  • Lab - Convert Data into a Universal Format
  • Lab - Regular Expression Tutorial
  • Lab - Extract an Executable from a PCAP
  • Sources of Alerts
  • Overview of Alert Evaluation
  • Primary Tools for the Tier 1 Cybersecurity Analyst
  • Kibana
  • Zeek
  • Wireshark
  • Working with Network Security Data
  • A Common Data Platform
  • Investigating Network Data
  • Lab - Interpret HTTP and DNS Data to Isolate Threat Actor
  • Lab - Isolate Compromised Host Using 5-Tuple
  • Lab - Investigating a Malware Exploit
  • Lab - Investigating an Attack on a Windows Host
  • Working in Squill
  • Enhancing the Work of the Cybersecurity Analyst
  • Lab - Incident Handling
  • Digital Forensics and Incident Analysis and Response
  • Evidence Handling and Attack Attribution
  • The Cyber Kill Chain
  • The Diamond Model of Intrusion Analysis
  • Incident Response