Course Outline
Module 1: Understanding the cyber-security landscape
In this module, you will explore the current cybersecurity landscape and learn how adopting the assume compromise philosophy can restrict an attacker’s ability to move laterally between information systems and limit their ability to escalate privileges within those systems. The current cyber-security landscape is vast and likely impossible for any single individual to fully comprehend. However, there are several key aspects of this landscape that those interested in the fundamentals of enterprise security should focus on.
Lessons
- Current Cyber-security Landscape
- Assume Compromise Philosophy
After completing this module, students will be able to:
- Describe the current cybersecurity landscape.
- Describe the Assume Compromise Philosophy.
- Identify factors that contribute to the cost of a breach.
Module 2: Red Team: Penetration, Lateral Movement, Escalation, and Exfiltration
Red team versus blue team exercises involve simulating an attack against an organization’s information system. The red team simulates, and in some cases executes, proof-of-concept steps taken during an attack against the organization’s IT systems. The blue team simulates the response to that attack. This adversarial approach not only helps identify security vulnerabilities in the configuration of the organization’s IT systems but also enables information systems staff to learn how to detect and respond to attacks. In this module, you will learn the Red team versus Blue team approach to detecting and responding to security threats.
Lessons
- Red Team versus Blue Team Exercises
- The Attackers Objective
- Red Team Kill Chain
After completing this module, students will be able to:
- Distinguish between the responsibilities of red teams and blue teams.
- Identify typical objectives of cyber attackers.
- Describe a kill chain executed by red teams.
Module 3: Blue Team Detection, Investigation, Response, and Mitigation
In this module, you will learn about the roles and goals of the Blue Team during attack exercises. You will understand the structure of an attack against an objective (Kill Chain) and methods for limiting how an attacker can compromise unprivileged accounts. You will also learn about the methods used to restrict lateral movement, which prevents attackers from using a compromised system to attack others, and how telemetry monitoring is used to detect attacks.
Lessons
- The Blue Team
- Blue Team Kill Chain
- Restricting Privilege Escalation
- Restrict Lateral Movement
- Attack Detection
After completing this module, students will be able to:
- Describe the role, goals, and kill chain activities of the blue team in the red team exercises.
- Describe the structure of an attack against an objective (Kill Chain).
- Describe the ways limiting how an attacker can compromise unprivileged accounts.
- Describe the methods used to restrict lateral movement.
- Describe how telemetry monitoring is used to detect attacks.
Module 4: Organizational Preparations
There are several ongoing preparations that an organization can undertake to improve its overall approach to information security. In this module, we will examine some of these in detail. You will learn about a conceptual model for thinking about information security, how to approach information security, and how to prepare properly, including ensuring your organization adopts a deliberate approach to information security.
Lessons
- CIA Triad
- Organizational Preparations
- Developing and Maintain Policies
Lab : Designing a Blue Team strategy
After completing this module, students will be able to:
- Explain the concept of Confidentiality, Integrity, and Availability (CIA) triad.
- Describe the primary activities that should be included in organization preparations.
- Identify the main principles of developing and maintaining policies.
After completing this lab, students will be able to:
- Design a high-level approach to mitigating threats
- Recommend tools and methodology facilitating tracking down origins of cyberattacks
- Provide high level steps of a recovery effort
- Recommend methods of preventing cyberattacks
- Describe regulatory challenges that result from malware exploits
Requirements
In addition to their professional experience, students enrolling in this training should already possess the following technical knowledge:
- Understanding of the current cyber-security ecosystem
- Analysis of hacks on computers and networks
- Basic Risk Management
Testimonials (2)
Thank you for the informative and wonderful course. I would also like to thank the trainer Mr. Ahmed El Gendy for delivering the information in a very smooth and understandable manner. I have benefited greatly from this course and can confidently say that I now understand all the topics and can apply them practically.
Atheer hadi aljezani - Tamkeen Technologies
Course - Windows Server 2019 Administration (authorized training course WS 011T00)
The environment is very very good
