Cisco® Securing Cisco® Networks with Threat Detection and Analysis (SCYBER) 1.0

Course Outline

Module 1: Attacker Methodology
Lessons
• Defining the Attacker Methodology
• Identifying Malware and Attacker Tools
• Understanding Attacks

Module 2: Defender Methodology
Lessons
• Enumerating Threats, Vulnerabilities, and Exploits
• Defining SOC Services
• Defining SOC Procedures
• Defining the Role of a Network Security Analyst
• Identifying a Security Incident

Module 3: Defender Tools
Lessons
• Collecting Network Data
• Understanding Correlation and Baselines
• Assessing Sources of Data
• Understanding Events
• Examining User Reports
• Introducing Risk Analysis and Mitigation

Module 4: Packet Analysis
Lessons
• Identifying Packet Data
• Analyzing Packets Using Cisco IOS Software
• Accessing Packets in Cisco IOS Software
• Acquiring Network Traces
• Establishing a Packet Baseline
• Analyzing Packet Traces

Module 5: Network Log Analysis
Lessons
• Using Log Analysis Protocols and Tools
• Exploring Log Mechanics
• Retrieving Syslog Data
• Retrieving DNS Events and Proxy Logs
• Correlating Log Files

Module 6: Baseline Network Operations
Lessons
• Baselining Business Processes
• Mapping the Network Topology
• Managing Network Devices
• Baselining Monitored Networks
• Monitoring Network Health

Module 7: Incident Response Preparation
Lessons
• Defining the Role of the SOC
• Establishing Effective Security Controls
• Establishing an Effective Monitoring System

Module 8: Security Incident Detection
Lessons
• Correlating Events Manually
• Correlating Events Automatically
• Assessing Incidents
• Classifying Incidents
• Attributing the Incident Source

Module 9: Investigations
Lessons
• Scoping the Investigation
• Investigating Through Data Correlation
• Understanding NetFlow
• Investigating Connections Using NetFlow

Module 10: Mitigations and Best Practices
Lessons
• Mitigating Incidents
• Using ACLs
• Implementing Network-Layer Mitigations and Best Practices
• Implementing Link-Layer Best Practices

Module 11: Communication
Lessons
• Documenting Communication
• Documenting Incident Details

Module 12: Post-Event Activity
Lessons
• Conducting an Incident Post-Mortem
• Improving Security of Monitored Networks