| 1 |
Chapter 1 - Managing Threats and Vulnerabilities |
Instructor Introduction<br />Course Introduction<br />Managing Threats and Vulnerabilities<br />Topic A: Threat Data and Intelligence<br />Importance of Threat Data<br />Open-Source Intelligence<br />Proprietary / Closed Source Intelligence<br />Intelligence Characteristics<br />Demo - Threat Data<br />Indicator Management<br />STIX Domain Objects<br />Trusted Automated Exchange of Indicator Information (TAXII)<br />OpenIoC<br />Threat Classification<br />Threat Actors<br />Intelligence Cycle<br />Information Sharing<br />Topic B: Utilizing Threat Intelligence<br />Threat Intelligence and Operational Security<br />Attack Frameworks<br />MITRE ATT&CK<br />MITRE ATT&CK (cont.)<br />The Diamond Model of Intrusion Analysis<br />Kill Chain<br />Threat Research<br />Threat Modeling<br />Threat Intelligence Sharing with Supported Functions<br />Topic C: Vulnerability Management<br />Introduction to Vulnerability Management<br />Vulnerability Identification<br />Validation Options<br />Remediation and Mitigation<br />Understanding Scanning<br />Additional Scanning Considerations<br />Inhibitors to Remediation<br />Topic D: Using Vulnerability Assessment Tools<br />Web Application Scanners<br />Infrastructure Scanners<br />Demo - Infrastructure Scanners<br />Software Assessments<br />Enumeration<br />Demo - Enumeration<br />Wireless Assessments<br />Cloud Assessment<br />Chapter 1 Review |
| 2 |
Chapter 2 - Specialized Threats and Vulnerabilities |
Specialized Threats and Vulnerabilities<br />Topic A: Threats and Vulnerabilities with Specialized Technology<br />Common Vulnerabilities<br />App Vulnerabilities<br />Internet of Things (IoT)<br />Other Specialized Devices<br />Other Specialized Devices (cont.)<br />Topic B: Threats and Vulnerabilities for Cloud Environments<br />Cloud Services Models <br />Software as a Service (SaaS)<br />Platform as a Service (PaaS)<br />Infrastructure as a Service (IaaS)<br />Cloud Deployment Models<br />Additional Cloud Concepts<br />Insecure Application Programming Interface (API)<br />Additional Cloud Vulnerabilities<br />Demo - Identifying Azure Security Vulnerabilities<br />Chapter 2 Review |
| 3 |
Chapter 3 - Attacks and Software Vulnerability Mitigation |
Attacks and Software Vulnerability Mitigation<br />Topic A: Understanding Attack Types<br />Injection Attacks<br />Injection Attacks (cont.)<br />Directory Traversal<br />Buffer Overflow Attacks<br />Privilege Escalation<br />Authentication Attacks<br />Topic B: Software Vulnerabilities<br />Improper Error Handling<br />Dereferencing<br />Insecure Object Reference<br />Race Conditions<br />Sensitive Data Exposure<br />Additional Vulnerabilities<br />Chapter 3 Review |
| 4 |
Chapter 4 - Infrastructure Management |
Infrastructure Management<br />Topic A: Network Security Solutions<br />Network Architecture<br />Physical Network<br />Software-Defined Network<br />Virtual Private Cloud Network<br />Virtual Private Network<br />Virtualization Solutions<br />Network Segmentation <br />Demo - Virtual Network Segmentation<br />Demo - Data Collector Sets<br />Topic B: Identity and Access Management<br />IAM Concepts<br />Privilege Management<br />Multifactor Authentication<br />Demo - MFA Implementation<br />Identity Federation<br />Access Control Types<br />Demo - Access Control<br />Cloud Access Security Broker<br />Topic C: Additional Solutions<br />Monitoring and Logging<br />Cryptography<br />Demo - Encrypting File System and Certification Management<br />Chapter 4 Review |
| 5 |
Chapter 5 - Hardware and Software Assurance |
Hardware and Software Assurance<br />Topic A: Hardware Assurance Best Practices<br />Hardware Root of Trust<br />Trusted Platform Module<br />Demo - BitLocker Drive Encryption<br />Hardware Security Module<br />eFuse<br />Unified Extensible Firmware Interface (UEFI)<br />Measured Boot and Attestation<br />Additional Hardware Options<br />Topic B: Software Assurance Best Practices<br />Platforms and Software Architecture<br />Service-Oriented Architecture<br />Software Development Lifecycle<br />Software Assessment Methods<br />Secure Coding<br />Chapter 5 Review |
| 6 |
Chapter 6 - Monitoring Security Options |
Monitoring Security Options<br />Topic A: Security Data Analytics<br />Monitoring Fundamentals<br />Aggregating Data<br />Data Analysis<br />Topic B: Endpoint and Network Analysis<br />Endpoint Security<br />Network Analysis<br />Log Review<br />Demo - Logging and Monitoring<br />Impact Analysis<br />Topic C: Email Analysis<br />Social Engineering<br />Anti-SPAM<br />Demo- Configuring Anti-Spam Options in Exchange Online<br />Chapter 6 Review |
| 7 |
Chapter 7 - Implementing Security Changes |
Implementing Security Changes<br />Topic A: Security Configuration Management<br />Fundamental Identity Configuration<br />Software Controls<br />Firewalls<br />Intrusion Detection Systems (IDS)<br />Data Loss Prevention<br />Endpoint Detection and Response<br />Network Access Control<br />Additional Techniques<br />Topic B: Threat Hunting<br />Understanding Threat Hunting<br />Threat Hunting Process<br />Establishing Hypothesis<br />Profiling Threat Actors<br />Threat Hunting Tactics Attack Surface Reduction<br />Topic C: Automating Security<br />Security Automation Concepts<br />Workflow Orchestration<br />Orchestration Playbooks<br />Scripting<br />API Integration<br />REST Principles<br />Security Content Automation Protocol<br />Software Engineering<br />Chapter 7 Review |
| 8 |
Chapter 8 - Incident Response |
Incident Response<br />Topic A: Importance of Incident Response<br />Incident Response Process<br />Establishing Communications Processes<br />Internal Communications<br />External Communications<br />Identifying Critical Data<br />Topic B: Incident Response Procedures<br />Incident Response Cycle<br />Preparation Phase<br />Detection and Analysis<br />Containment<br />Containment Types<br />Eradication and Recovery<br />Eradication and Recovery (cont.)<br />Post-Incident Activities<br />Topic C: Analyzing Indicators of Compromise<br />Network-related Indicators<br />Host-related Indicators<br />Application-related Indicators<br />Demo - Analyzing IoCs<br />Topic D: Utilizing Digital Forensics Techniques<br />Digital Forensics<br />Using Network Tools<br />Demo - Using Wireshark<br />Capturing Endpoint Systems<br />Additional Forensics Situations<br />Building a Forensics Kit<br />Chapter 8 Review |
| 9 |
Chapter 9 - Compliance and Assessment |
Compliance and Assessment<br />Topic A: Data Privacy and Protection<br />Security vs. Privacy<br />Data Types<br />Legal Requirements<br />Nontechnical Controls<br />Data Retention Standards<br />Technical Controls<br />Data Loss Prevention<br />Demo - Implementing DLP<br />Topic B: Risk Mitigation<br />Business Impact Analysis<br />BIA Steps<br />Risk Assessment<br />Risk Identification Process<br />Risk Calculation<br />Risk Prioritization<br />Security Controls<br />Training and Exercises<br />Topic C: Policies and Procedures<br />Code of Conduct<br />Control Types<br />Audits and Assessment<br />Chapter 9 Review<br />Course Closure |
