Course Overview
This course covers network defense and incident response methods, tactics, and procedures that are in alignment with industry frameworks such as NIST 800-61r2 (Computer Security Incident Handling Guide), US-CERT’s National Cyber Incident Response Plan (NCIRP), and Presidential Policy Directive (PPD)-41 on Cyber Incident Coordination, NIST 800.171r2 (Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations). It is ideal for candidates who have been tasked with the responsibility of monitoring and detecting security incidents in information systems and networks, and for executing standardized responses to such incidents.
The course introduces tools, tactics, and procedures to manage cybersecurity risks, defend cybersecurity assets, identify various types of common threats, evaluate the organization’s security, collect and analyze cybersecurity intelligence, and remediate and report incidents as they occur.
This course provides a comprehensive methodology for individuals responsible for defending the cybersecurity of their organization. This course is designed to assist students in preparing for the CertNexus CyberSec First Responder (Exam CFR-410) certification examination. What you learn and practice in this course can be a significant part of your preparation.
In addition, this course and subsequent certification (CFR-410) meet all requirements for personnel requiring DoD directive 8570.01-M position certification baselines:
- CSSP Analyst
- CSSP Infrastructure Support
- CSSP Incident Responder
- CSSP Auditor
Enrollment in this course includes student digital courseware, labs, and exam voucher for CyberSec First Responder (CFR-410).
What you’ll learn
Upon completion of CNX0013 CyberSec First Responder® (Exam CFR-410) course, students will be able to:
- Assess cybersecurity risks to the organization
- Analyze the threat landscape
- Analyze various reconnaissance threats to computing and network environments
- Analyze various attacks on computing and network environments
- Analyze various post-attack techniques
- Assess the organization’s security posture through auditing, vulnerability management, and penetration testing
- Collect cybersecurity intelligence from various network-based and host-based sources
- Analyze log data to reveal evidence of threats and incidents
- Perform active asset and network analysis to detect incidents
- Respond to cybersecurity incidents using containment, mitigation, and recovery tactics
- Investigate cybersecurity incidents using forensic analysis techniques
Requirements
- At least two years (recommended) of experience or education in computer network security technology or a related field
- The ability or curiosity to recognize information security vulnerabilities and threats in the context of risk management
- Foundational knowledge of the concepts and operational framework of common assurance safeguards in network environments. Safeguards include, but are not limited to, firewalls, intrusion prevention systems, and VPNs.
- General knowledge of the concepts and operational framework of common assurance safeguards in computing environments. Safeguards include, but are not limited to, basic authentication and authorization, resource permissions, and anti-malware mechanisms.
- Foundation-level skills with some of the common operating systems for computing environments.
- Entry-level understanding of some of the common concepts for network environments, such as routing and switching.
- General or practical knowledge of major TCP/IP networking protocols, including, but not limited to, TCP, IP, UDP, DNS, HTTP, ARP, ICMP, and DHCP.
- Course-specific Technical Requirements Technical requirements below are for local class setup only. Hardware For this course, you will need one Microsoft® Windows Server® 2019 computer and one Microsoft® Windows® 10 computer for each student and for the instructor. Make sure that each computer meets the classroom hardware specifications: Windows Server 2019
- 2 gigahertz (GHz) 64-bit (x64) processor.
- 4 gigabytes (GB) of Random Access Memory (RAM).
- Windows 10
Curriculum
- 11 Sections
- 39 Lessons
- 5 Days
- Lesson 1: Assessing Cybersecurity Risk4
- Lesson 2: Analyzing the Threat Landscape2
- Lesson 3: Analyzing Reconnaissance Threats to Computing and Network Environments3
- Lesson 4: Analyzing Attacks on Computing and Network Environments7
- 4.1Topic A: Assess the Impact of System Hacking Attacks
- 4.2Topic B: Assess the Impact of Web-Based Attacks
- 4.3Topic C: Assess the Impact of Malware
- 4.4Topic D: Assess the Impact of Hijacking and Impersonation Attacks
- 4.5Topic E: Assess the Impact of DoS Incidents
- 4.6Topic F: Assess the Impact of Threats to Mobile Security
- 4.7Topic G: Assess the Impact of Threats to Cloud Security
- Lesson 5: Analyzing Post-Attack Techniques5
- Lesson 6: Assessing the Organization's Security Posture4
- Lesson 7: Collecting Cybersecurity Intelligence3
- Lesson 8: Analyzing Log Data2
- Lesson 9: Performing Active Asset and Network Analysis3
- Lesson 10: Responding to Cybersecurity Incidents3
- Lesson 11: Investigating Cybersecurity Incidents3
Instructor
