This course explores network defense strategies and incident response methodologies, aligned with industry standards such as NIST 800-61 r.2 (Computer Security Incident Handling), US-CERT’s NCISP (National Cyber Incident Response Plan), and Presidential Policy Directive (PPD) 41 on Cyber Incident Coordination Policy. It is tailored for professionals responsible for monitoring and detecting security incidents within information systems and networks, as well as executing standardized response protocols. The curriculum introduces tools, tactics, and procedures to manage cybersecurity risks, identify common threats, assess organizational security posture, collect and analyze cybersecurity intelligence, and remediate and report incidents in real-time. This course offers a comprehensive framework for individuals tasked with defending their organization’s cybersecurity.
Designed to assist students in preparing for the CertNexus CyberSec First Responder (Exam CFR-310) certification, the knowledge and skills acquired here form a critical part of your preparation. Furthermore, this course and the subsequent CFR-310 certification satisfy all requirements for personnel needing DoD directive 8570.01-M position certification baselines:
• CSSP Analyst
• CSSP Infrastructure Support
• CSSP Incident Responder
• CSSP Auditor
Course Objectives: Throughout this course, you will learn to understand, assess, and respond to security threats while operating a system and network security analysis platform. You will:
• Compare and contrast various threats and classify threat profiles
• Explain the purpose and application of attack tools and techniques
• Explain the purpose and application of post-exploitation tools and tactics
• Explain the purpose and application of social engineering tactics
• Conduct ongoing threat landscape research and utilize data to prepare for incidents in given scenarios
• Explain the purpose and characteristics of various data sources
• Utilize appropriate tools to analyze logs in given scenarios
• Use regular expressions to parse log files and identify meaningful data in given scenarios
• Use Windows tools to analyze incidents in given scenarios
• Use Linux-based tools to analyze incidents in given scenarios
• Summarize methods and tools used for malware analysis
• Analyze common indicators of potential compromise in given scenarios
• Explain the importance of best practices in preparing for incident response
• Execute the incident response process in given scenarios
• Explain concepts unique to forensic analysis
• Explain general mitigation methods and devices
Target Audience: This course is primarily designed for cybersecurity practitioners who are preparing for or currently perform job functions related to protecting information systems by ensuring their availability, integrity, authentication, confidentiality, and non-repudiation. It is ideal for roles within federal contracting companies and private sector firms whose mission or strategic objectives require the execution of Defensive Cyber Operations (DCO) or DoD Information Network (DODIN) operations and incident handling. The course focuses on the knowledge, abilities, and skills necessary to defend information systems in a cybersecurity context, including protection, detection, analysis, investigation, and response processes.
Additionally, the course ensures that all members of an IT team—regardless of size, rank, or budget—understand their role in cyber defense, incident response, and incident handling.
Read more...