Course Outline
Module 1: Understanding the cyber-security landscape
In this module, participants will explore the contemporary cybersecurity landscape and learn how adopting the 'assume compromise' philosophy can help restrict an attacker's ability to move laterally between information systems and limit privilege escalation within those systems. While the current cyber-security landscape is vast and perhaps too complex for any single individual to fully comprehend, there are critical aspects that those interested in enterprise security fundamentals should closely monitor.
Lessons
- Current Cyber-security Landscape
- Assume Compromise Philosophy
Upon completing this module, students will be able to:
- Describe the current cybersecurity landscape.
- Explain the Assume Compromise Philosophy.
- Identify key factors that contribute to the cost of a security breach.
Module 2: Red Team: Penetration, Lateral Movement, Escalation, and Exfiltration
Red Team versus Blue Team exercises simulate attacks against an organization’s information systems. The Red Team replicates, and in some instances executes proof-of-concept steps of an attack against the organization’s IT infrastructure, while the Blue Team simulates the defensive response. This adversarial approach not only helps identify security vulnerabilities in IT system configurations but also enables information systems staff to learn how to detect and respond to potential threats. In this module, you will gain practical knowledge of the Red Team versus Blue Team approach to detecting and responding to security incidents.
Lessons
- Red Team versus Blue Team Exercises
- The Attacker's Objective
- Red Team Kill Chain
Upon completing this module, students will be able to:
- Distinguish between the responsibilities of red teams and blue teams.
- Identify typical objectives of cyber attackers.
- Describe the kill chain executed by red teams.
Module 3: Blue Team Detection, Investigation, Response, and Mitigation
In this module, you will explore the roles and goals of the Blue Team within attack exercises. You will examine the structure of an attack against an objective (Kill Chain) and learn methods for limiting how attackers can compromise unprivileged accounts. Additionally, you will study techniques used to restrict lateral movement, preventing attackers from leveraging a compromised system to attack other networks, and understand how telemetry monitoring aids in attack detection.
Lessons
- The Blue Team
- Blue Team Kill Chain
- Restricting Privilege Escalation
- Restricting Lateral Movement
- Attack Detection
Upon completing this module, students will be able to:
- Describe the role, goals, and kill chain activities of the blue team in red team exercises.
- Describe the structure of an attack against an objective (Kill Chain).
- Describe methods for limiting how an attacker can compromise unprivileged accounts.
- Describe techniques used to restrict lateral movement.
- Explain how telemetry monitoring is utilized to detect attacks.
Module 4: Organizational Preparations
Organizations can undertake several ongoing preparations to improve their overall information security strategy. This module provides a closer look at these initiatives. You will learn about a conceptual model for evaluating information security and discover how to approach information security effectively, including ensuring your organization adopts a deliberate and structured approach to securing information.
Lessons
- CIA Triad
- Organizational Preparations
- Developing and Maintaining Policies
Lab : Designing a Blue Team strategy
Upon completing this module, students will be able to:
- Explain the concept of the Confidentiality, Integrity, and Availability (CIA) triad.
- Describe the primary activities that should be included in organizational preparations.
- Identify the main principles of developing and maintaining policies.
Upon completing this lab, students will be able to:
- Design a high-level approach to mitigating threats
- Recommend tools and methodologies that facilitate tracking the origins of cyberattacks
- Provide high-level steps for a recovery effort
- Recommend methods for preventing cyberattacks
- Describe regulatory challenges resulting from malware exploits
Requirements
Beyond their professional experience, students enrolled in this training should possess the following technical knowledge:
- Understanding of the current cyber-security ecosystem
- Ability to analyze hacks targeting computers and networks
- Knowledge of basic Risk Management
Testimonials (2)
Thank you for the informative and wonderful course. I would also like to thank the trainer Mr. Ahmed El Gendy for delivering the information in a very smooth and understandable manner. I have benefited greatly from this course and can confidently say that I now understand all the topics and can apply them practically.
Atheer hadi aljezani - Tamkeen Technologies
Course - Windows Server 2019 Administration (authorized training course WS 011T00)
The environment is very very good
