This program explores network defense and incident response methodologies, tactics, and procedures, aligning with industry standards such as NIST 800-61 r.2 (Computer Security Incident Handling), US-CERT’s NCISP (National Cyber Incident Response Plan), and Presidential Policy Directive (PPD) 41 on Cyber Incident Coordination Policy. It is tailored for candidates responsible for monitoring and detecting security incidents within information systems and networks, as well as executing standardized responses to these events. The course introduces tools, tactics, and procedures to manage cybersecurity risks, identify common threat types, evaluate organizational security, collect and analyze cybersecurity intelligence, and remediate and report incidents in real-time. This program offers a comprehensive methodology for individuals tasked with defending their organization's cybersecurity posture.
The course is designed to help students prepare for the CertNexus CyberSec First Responder (Exam CFR-310) certification. The skills and practices gained here are a significant component of exam preparation. Additionally, this course and the subsequent CFR-310 certification satisfy all personnel requirements for DoD directive 8570.01-M position certification baselines:
• CSSP Analyst
• CSSP Infrastructure Support
• CSSP Incident Responder
• CSSP Auditor
Course Objectives: Participants will learn to understand, assess, and respond to security threats while operating a system and network security analysis platform. Key learning outcomes include:
• Comparing and contrasting various threats and classifying threat profiles
• Explaining the purpose and usage of attack tools and techniques
• Explaining the purpose and usage of post-exploitation tools and tactics
• Explaining the purpose and usage of social engineering tactics
• Conducting ongoing threat landscape research and utilizing data to prepare for incidents, given a specific scenario
• Describing the purpose and characteristics of various data sources
• Utilizing appropriate tools to analyze logs, given a specific scenario
• Using regular expressions to parse log files and locate meaningful data, given a specific scenario
• Using Windows tools to analyze incidents, given a specific scenario
• Using Linux-based tools to analyze incidents, given a specific scenario
• Summarizing methods and tools used for malware analysis
• Analyzing common indicators of potential compromise, given a specific scenario
• Explaining the importance of best practices in incident response preparation
• Executing the incident response process, given a specific scenario
• Explaining concepts unique to forensic analysis
• Explaining general mitigation methods and devices
Target Student: This course is primarily intended for cybersecurity practitioners who are preparing for or currently performing job functions related to protecting information systems by ensuring availability, integrity, authentication, confidentiality, and non-repudiation. It is ideal for roles in federal contracting companies and private sector firms whose mission or strategic objectives involve executing Defensive Cyber Operations (DCO) or DoD Information Network (DODIN) operations and incident handling. The course focuses on the knowledge, ability, and skills necessary to defend these information systems in a cybersecurity context, including protection, detection, analysis, investigation, and response processes.
Furthermore, the course ensures that all members of an IT team—regardless of size, rank, or budget—understand their role in cyber defense, incident response, and incident handling.
Read more...