CompTIA Security Plus Course SY0-701 and Hands on Labs

This video module discusses threats, vulnerabilities, and mitigations in the context of cybersecurity. It covers various threat actors, motivations, insider threats, shadow IT, and examples of real-world scenarios.

• Threat actors and motivations

• Types of threat actors (nation state actors, script kiddies, hacktivists, insider threats, organized crime, APTs)

• Motivations of threat actors (stealing data, espionage, disruption, financial gain, political agendas)

• Insider threats and their actions

• Shadow IT and its risks

• Real-world scenarios and examples

This video module discusses threat vectors, attack surfaces, and the human aspect of cybersecurity. It covers the definition of threat vectors, vulnerabilities, and exploits, as well as common threat vectors and ways to mitigate them. The concept of attack surface is also explained, along with examples of different layers of attack surfaces.

• Definition of threat vectors

• Difference between threat vectors, vulnerabilities, and exploits

• Common threat vectors and examples

• Understanding attack surfaces and layers of attack surfaces

• Human aspect of cybersecurity and vulnerabilities

This video module discusses the use of a specialized malicious Apple Lightning cable for social engineering purposes. The cable contains a hidden programmable chip with a wifi transceiver, allowing attackers to send malicious commands wirelessly to a target device. The video covers the process of updating the cable firmware, pre-programming it with malicious commands, and executing a script to extract account and password hashes from a target device.

• Introduction to social engineering with a malicious Apple Lightning cable

• Overview of the OMG cable with hidden programmable chip and wifi transceiver

• Programming commands into the cable for malicious purposes

• Making a wifi connection to the cable and sending commands wirelessly

• Updating the firmware of the OMG cable

• Pre-programming the cable with a script to extract password hashes

• Executing the script to extract password hashes from a target device

• Uploading the extracted password hashes to an FTP server for analysis

This video module demonstrates how to perform a malicious lightning cable hack using a batch file instead of the actual cable. It covers setting up a web server, using harmless text files, creating a malicious script, and executing the hack.

• Setting up a web server

• Using harmless text files

• Creating a malicious script

• Executing the hack using a batch file

This video module discusses social engineering, which involves manipulating people psychologically to get them to do something they shouldn't do, such as giving up confidential information or performing actions that are harmful. Various types of social engineering attacks and techniques are covered in detail.

• Introduction to social engineering

• Psychological manipulation of individuals

• Reasons why people fall victim to social engineering

• Common social engineering attacks (impersonation, quid pro quo, tailgating, piggybacking, phishing, vishing, smishing, spear phishing, whaling)

• Business email compromise

• Misinformation and disinformation campaigns

• Hoaxes and chain letters

• Spam, hooks, and scams

• Preventing social engineering attacks

• Recognizing and responding to social engineering attacks

This video module discusses operating system vulnerabilities and common attacks associated with them. It covers topics such as security misconfiguration, programming errors, privilege escalation, information disclosure, denial of service, insider threats, and the Windows unquoted service path vulnerability.

• Operating system vulnerabilities

• Common attacks on operating systems

• Security misconfiguration

• Programming errors

• Privilege escalation

• Information disclosure

• Denial of service attacks

• Insider threats

• Windows unquoted service path vulnerability

This video module discusses application vulnerabilities and attacks, focusing on common vulnerabilities found in applications, such as memory injection, buffer overflows, and race conditions. It also covers the impact of bad programming practices on application security.

• Application vulnerabilities and attacks

• Common application vulnerabilities

• Memory injection

• Buffer overflows

• Race conditions

• Impact of bad programming on application security

This video module focuses on conducting a buffer overflow attack against an XP Pro machine using Kali Linux. The instructor demonstrates how to set up the attack, execute the exploit, and analyze the artifacts left behind. Various tools and techniques are used to exploit vulnerabilities and gain system privileges.

• Setting up two virtual machines - Kali Linux and XP Pro

• Obtaining IP addresses of both machines

• Verifying firewall settings on XP Pro

• Using Metasploit framework to search for and execute an exploit

• Analyzing artifacts and evidence of successful exploit

• Creating a backdoor account and adding it to the administrators group

• Searching for artifacts in event viewer and network connections

• Disconnecting from the compromised machine and analyzing the impact

In this video module, we will explore web-based vulnerabilities and attacks, focusing on how web applications function and the common security flaws that can be exploited by attackers. We will discuss the architecture of web applications, the significance of input validation, and the most prevalent types of attacks such as SQL injection, cross-site scripting (XSS), and cross-site request forgery (CSRF). By understanding these vulnerabilities, developers can better protect their applications against malicious threats.

• Definition of web applications

• Architecture of web applications

• Importance of web applications in user interaction

• Common web application vulnerabilities

• Impact of unsanitized input

• SQL injection attacks

• Cross-site scripting (XSS)

• Cross-site request forgery (CSRF)

• Mitigation strategies for web app vulnerabilities

• Best practices for input validation

In this video module, we will explore SQL injection techniques using the DVWA web application hosted on Metasploitable. The session will cover the setup of the environment, the execution of various SQL injection attacks, and the retrieval of sensitive information such as usernames and password hashes from the database. Participants will learn how to manipulate SQL queries to extract data and understand the underlying vulnerabilities that allow such attacks.

• Setting up Metasploitable and DVWA

• Understanding SQL injection

• Executing basic SQL injection attacks

• Retrieving user information through SQL injection

• Analyzing underlying SQL queries

• Using UNION statements in SQL injection

• Extracting database version and user information

• Identifying tables and columns in a database

• Saving retrieved data for further analysis

This video module covers the concept of cross-site scripting (XSS) and demonstrates how a hacker can exploit session cookies to impersonate another user. Through the story of two users, Susie and Mo, viewers will learn how to set up a vulnerable environment using Metasploitable and perform a basic XSS attack to steal session cookies.

• Introduction to Cross-Site Scripting (XSS)

• Understanding Session Cookies

• Setting Up the Metasploitable Environment

• Clearing Cookies in Browsers

• User Registration and Login Process

• Executing a Basic XSS Attack

• Using JavaScript for Cookie Theft

• Session Hijacking Techniques

• Implications of XSS Attacks

This video module covers various types of vulnerabilities that can affect hardware, software, and cloud services. It emphasizes the importance of understanding these vulnerabilities to enhance security measures and mitigate risks. Key topics include firmware vulnerabilities, end-of-life devices, legacy systems, virtualization vulnerabilities, cloud service vulnerabilities, supply chain risks, and cryptographic failures.

• Hardware vulnerabilities

• Firmware vulnerabilities

• End-of-life devices

• Legacy systems

• Virtualization vulnerabilities

• Cloud service vulnerabilities

• Supply chain vulnerabilities

• Cryptographic failures

• Mobile device vulnerabilities

• Zero-day vulnerabilities

• Misconfiguration risks

In this video module, security analysts will learn to identify various indicators of malicious activity, distinguishing between indicators of attack (IOAs) and indicators of compromise (IOCs). The discussion will cover common signs of malicious behavior, methods for recognizing ongoing attacks, and clues that suggest a system has already been breached.

• Common malicious activity indicators

• Indicators of attack (IOAs)

• Indicators of compromise (IOCs)

• Patterns of behavior indicating ongoing attacks

• Examples of malicious activity

• Data exfiltration signs

• Unusual network traffic

• Geographical irregularities

• Malware reinfection

• Unauthorized system changes

In this video module, we will explore insider threat indicators that can help identify potential risks within a high-security environment. The discussion emphasizes that most insider threats are not malicious at the outset and focuses on recognizing early signs of distress or behavioral changes in employees. By understanding these indicators, organizations can intervene and provide support before issues escalate.

• Definition of insider threat indicators

• Nature of insider threats

• Recognizing behavioral changes

• Indicators of financial distress

• Impact of personal issues on work performance

• Monitoring unusual work hours

• Interest in unauthorized information

• Traveling overseas and loyalty concerns

In this video, we will explore the various indicators of social engineering attacks, focusing on how to identify potential threats through unexpected communications and high-pressure tactics. We will discuss real-world examples of phishing, smishing, and hoaxes, as well as the role of email relays in facilitating these attacks. By the end of the module, viewers will be equipped with the knowledge to recognize and respond to social engineering attempts effectively.

• Overview of social engineering

• Indicators of social engineering attacks

• Unexpected messages and requests

• Urgency and intimidation tactics

• Real-world examples of phishing and smishing

• Identifying hoaxes

• Understanding email relays and their role in spam and phishing

In this video module, we will explore the techniques of social engineering by creating a fake website and a phishing email using Kali Linux. The focus will be on capturing user credentials through a malicious link that redirects to our fake site. Participants will learn to set up the necessary tools and execute a phishing attack while understanding the ethical implications of such actions.

• Introduction to social engineering

• Setting up Kali Linux for social engineering tasks

• Creating a fake website to capture credentials

• Crafting a phishing email

• Using the Thunderbird email client

• Executing the phishing attack

• Monitoring captured credentials

• Ethical considerations in social engineering

In this video, we will explore various indicators of malware activity, discussing the symptoms and signs that suggest a potential malware infection. We will cover different types of malware, including ransomware, remote access trojans, spyware, bloatware, worms, keyloggers, logic bombs, and rootkits, along with their specific indicators and the implications of each type.

• Indicators of general malware activity

• Symptoms of malware infection

• Types of malware: ransomware, trojans, spyware, bloatware, worms, keyloggers, logic bombs, rootkits

• Specific indicators for each type of malware

• Consequences of malware infections

• Best practices for dealing with malware

In this video module, we will explore various indicators of operating system (OS) attacks and the methods used to exploit vulnerabilities within an OS. The discussion will cover physical access attacks, password exploitation, buffer overflow attacks, malware activities, and privilege escalation techniques. We will also examine specific examples, such as DLL injection, to illustrate how these attacks can manifest in real-world scenarios.

• Overview of operating system attack indicators

• Physical access attacks

• Password attacks (network and local)

• Buffer overflow attacks

• Malware activity

• Malicious updates and insider threats

• Privilege escalation techniques

• Denial of service and distributed denial of service

• Common indicators of OS attacks

• Examples of DLL injection

• PowerShell and its role in OS attacks

In this video module, we will explore specific application attack indicators, focusing on various types of application attacks and their methodologies. We will discuss the most prevalent attack types, particularly injection attacks, and the importance of input sanitization and web application firewalls in protecting web applications. Additionally, we will identify key indicators of application attacks, including buffer overflows, privilege escalation, and directory traversal, along with examples of how these attacks can manifest.

• Overview of application attacks

• Comparison with operating system attacks

• Injection attacks and their prevalence

• Input sanitization and web application firewalls

• Indicators of application attacks

• Buffer overflow vulnerabilities

• Privilege escalation activities

• Cross-site request forgery (CSRF)

• Server-side request forgery (SSRF)

• Directory traversal attacks

• Examples of SQL injection and LDAP injection

• Detection of application attack indicators in logs

In this video module, we will explore the concept of directory traversal within a web application, specifically using the DVWA (Damn Vulnerable Web Application) on the Metasploitable platform. We will demonstrate how to navigate the file system structure, exploit vulnerabilities to perform directory traversal, and analyze web logs to identify evidence of such attacks.

• Introduction to directory traversal

• Navigating the DVWA web application

• Understanding file system structure in Linux

• Exploiting command execution vulnerabilities

• Performing directory traversal to access sensitive files

• Analyzing web logs for evidence of directory traversal attacks

In this video module, we will explore various indicators of operating system (OS) attacks and the methods used to exploit vulnerabilities within an OS. The discussion will cover physical access attacks, password exploitation, buffer overflow attacks, malware activities, and privilege escalation techniques. We will also examine specific examples, such as DLL injection, to illustrate how these attacks can manifest in real-world scenarios.

• Overview of operating system attack indicators

• Physical access attacks

• Password attacks (network and local)

• Buffer overflow attacks

• Malware activity

• Malicious updates and insider threats

• Privilege escalation techniques

• Denial of service and distributed denial of service

• Common indicators of OS attacks

• Examples of DLL injection

• PowerShell and its role in OS attacks

In this video module, we explore the Flipper Zero, a versatile gadget that captures, stores, and replays various wireless signals. We will demonstrate its capabilities in cloning RFID badges and NFC credit cards, showcasing its open-source nature and the creative possibilities it offers for experimentation.

• Introduction to Flipper Zero

• Capabilities of Flipper Zero

• Wireless signal capture and replay

• Cloning RFID badges

• Cloning NFC credit cards

• Open-source features

• Creative experimentation with peripherals

In this video module, we explore various network attack indicators, focusing on botnet activity, malware, man-in-the-middle attacks, DNS attacks, and denial of service (DoS) attacks. The module provides insights into the mechanisms behind these attacks, their indicators, and how to identify and respond to them effectively.

• Botnet activity and malware

• Types of attacks: DDoS, credential replay, and on-path attacks

• Indicators of botnet and malware activity

• Man-in-the-middle (MITM) attacks

• ARP poisoning and its indicators

• DNS attacks: spoofing, amplification, and poisoning

• Denial of Service (DoS) and Distributed Denial of Service (DDoS) attacks

• Wireless and Bluetooth attacks

• NFC attacks and their implications

In this video module, we explore various network attack indicators, focusing on botnet activity, malware, man-in-the-middle attacks, DNS attacks, and denial of service (DoS) attacks. The module provides insights into the mechanisms behind these attacks, their indicators, and how to identify and respond to them effectively.

• Botnet activity and malware

• Types of attacks: DDoS, credential replay, and on-path attacks

• Indicators of botnet and malware activity

• Man-in-the-middle (MITM) attacks

• ARP poisoning and its indicators

• DNS attacks: spoofing, amplification, and poisoning

• Denial of Service (DoS) and Distributed Denial of Service (DDoS) attacks

• Wireless and Bluetooth attacks

• NFC attacks and their implications

In this video, we will explore various cryptographic attack indicators, focusing on how attackers can compromise cryptosystems through different methods. We will discuss downgrade attacks, hash collisions, and the birthday attack, providing examples and explanations of how these vulnerabilities can be exploited. Additionally, we will identify key indicators that suggest a cryptographic attack may be occurring.

• Introduction to cryptographic attack indicators

• Definition of cryptosystem attacks

• Overview of downgrade attacks

• Impact of improper website configuration on security

• Mechanics of SSL/TLS session hijacking

• Understanding hash collisions and their implications

• Classic collision attack examples

• MD5 vs SHA hashing algorithms

• Practical examples of collision attacks

• Introduction to the birthday attack

• Statistical basis of the birthday paradox

• Indicators of cryptographic attacks

• Examples of encrypted data exfiltration

• Signs of physical tampering with encrypted systems

• Discussion on HTTPS to HTTP connection downgrades

In this video module, we will learn how to crack password hashes using Hashcat on Kali Linux. The session will cover the necessary system requirements, file preparations, and the execution of a dictionary attack to recover passwords from NTLM hashes. By the end of the video, viewers will understand the process of utilizing Hashcat effectively and the significance of using a comprehensive dictionary file.

• System requirements for Kali Linux

• Setting up virtual machine memory

• Preparing hash and dictionary files

• Using Hashcat for password cracking

• Understanding NTLM hashes

• Executing a dictionary attack

• Analyzing cracked passwords

In this video module, we will explore enterprise-level strategies for enhancing network security through effective network segmentation. The discussion will cover various methods of segmenting networks, including physical and logical segmentation, isolation techniques, and the use of firewalls to create secure zones within an enterprise network. By understanding these concepts, organizations can better manage network traffic, enhance security, and minimize the risk of attacks.

• Introduction to enterprise-level security

• Understanding network segmentation

• Types of network segmentation

• Physical network segmentation

• Logical network segmentation (VLANs)

• Isolation techniques

• Use of firewalls and DMZs

• Access control and routing

• Practical examples of segmentation

• Segmentation for data protection

This video module provides an in-depth exploration of access control, a critical aspect of security that regulates who or what can access resources within a computing environment. The discussion covers both physical and logical access control mechanisms, various access control methods such as permissions and access control lists (ACLs), and the principle of least privilege. Additionally, it addresses practical scenarios related to application whitelisting and security measures to prevent unauthorized access.

• Definition of Access Control

• Importance of Access Control in Security

• Physical vs. Logical Access Control

• Access Control Mechanisms

• Permissions: Read, Write, Execute, Delete

• Access Control Lists (ACLs)

• Application Allow List (Whitelisting)

• Principle of Least Privilege

• Practical Scenarios and Examples

This video module focuses on various techniques for hardening enterprise devices to enhance security. It covers essential practices such as encryption, endpoint protection, configuration management, and the implementation of multi-factor authentication. The discussion emphasizes the importance of monitoring, controlling access, and maintaining compliance to protect sensitive data and prevent unauthorized access.

• Encryption and Full Disk Encryption (FDE)

• Endpoint Protection and Management

• Host-Based Firewalls and Intrusion Prevention Systems (HIPS)

• Disabling Unnecessary Ports and Protocols

• Changing Default Passwords and Strong Authentication

• Removing Unnecessary Software

• Automated Configuration Enforcement

• Patching and Update Management

• Remote Administration Security

• Multi-Factor Authentication (MFA)

• Access Control and Permissions

• Device-Specific Security Recommendations

• Network Monitoring and Anomaly Detection

• File Integrity Monitoring

• Device Lifecycle Management

• Input Validation for Web Applications

• Network Segmentation and Zone Security

• Zero Trust Access Control

• Sandboxing and Isolation Techniques

• Multi-Layer Zero Trust Defense

In this video module, we will explore security from an architectural perspective, focusing on the implications of various architecture models, including enterprise infrastructure security, data protection strategies, and resilience in security architecture. A significant emphasis will be placed on network segmentation, its benefits, and the potential risks associated with different segmentation techniques such as VLANs.

• Security implications of different architecture models

• Enterprise infrastructure security

• Data protection concepts and strategies

• Resilience and recovery in security architecture

• Network segmentation

• Physical segmentation vs. VLANs

• VLAN hopping risks

• Trust levels in network zones

• Best practices for isolating network segments

In this video module, we will learn how to create and configure a network of four PCs connected by a Cisco 3560 multilayer switch. The lesson will cover configuring the PCs to be in the same subnet, segmenting the network into two VLANs, and enabling inter-VLAN routing on the multilayer switch. By the end of the module, participants will understand how to set up VLANs, configure IP addresses, and enable communication between different VLANs.

• Creating a network of four PCs

• Configuring a Cisco 3560 multilayer switch

• Setting up PCs in the same subnet

• Segmenting the network into VLANs

• Configuring VLAN interfaces

• Enabling inter-VLAN routing

• Assigning IP addresses to PCs

• Testing connectivity between VLANs

In this video module, we will explore the concept of high availability in systems, emphasizing its importance in ensuring continuous operation without downtime. We will discuss various mechanisms to achieve high availability, including clustering, load balancing, and replication, along with their configurations and use cases. The module will also cover considerations for implementing these strategies effectively.

• Definition of High Availability

• Importance of Continuous Operation

• Redundancy and Failover Mechanisms

• Clustering: Active-Passive and Active-Active Configurations

• Load Balancing: Mechanisms and Use Cases

• Replication: Types and Geographic Distribution

• Considerations for High Availability Implementation

• Examples of High Availability in Real-World Applications

This video module delves into the concept of virtualization, exploring its benefits, risks, and applications in modern computing environments. It covers the architecture of virtual machines (VMs), hypervisors, and the implications of virtualization on data centers, including VM sprawl and security concerns. The module also introduces related technologies such as Virtual Desktop Infrastructure (VDI), Software Defined Networking (SDN), and containerization, highlighting their roles in enhancing efficiency and resource management.

• Introduction to Virtualization

• Benefits of Virtualization

• Architecture of Virtual Machines

• Hypervisors and Their Types

• VM Sprawl and Management

• Virtual Desktop Infrastructure (VDI)

• Software Defined Networking (SDN)

• Containerization and Its Advantages

• Security Risks in Virtual Environments

• Best Practices for Virtualization

In this video module, we will deploy a simple voting application using Docker containers. The tutorial covers downloading the application from GitHub, setting up Docker Desktop, and running multiple containers that work together to facilitate voting and displaying results in real-time. Participants will learn how to manage Docker containers and observe their performance metrics.

• Introduction to Docker containers

• Downloading the voting app from GitHub

• Setting up Docker Desktop

• Running the application with Docker Compose

• Understanding the architecture of the voting app

• Interacting with the voting app

• Monitoring container performance

• Managing Docker containers

This video module focuses on the shared responsibility model in cloud computing, emphasizing the division of security responsibilities between cloud service providers (CSPs) and customers. It discusses various cloud service models, including Infrastructure as a Service (IaaS), Platform as a Service (PaaS), Software as a Service (SaaS), and Function as a Service (FaaS), outlining the specific security responsibilities associated with each. Additionally, it covers considerations for hybrid cloud deployments, cost management, data encryption, compliance with data sovereignty regulations, and the importance of due diligence when selecting third-party vendors.

• Introduction to cloud services

• Shared responsibility model

• Security responsibilities in IaaS, PaaS, SaaS, and FaaS

• Hybrid cloud considerations

• Cost management in cloud services

• Data encryption and security best practices

• Compliance with data sovereignty regulations

• Third-party vendor management

In this video, we explore the concepts of Infrastructure as Code (IAC) and Serverless Computing, highlighting their significance in modern application development and deployment. We discuss how IAC allows for automated provisioning of infrastructure using code, enabling developers to focus on building applications without the overhead of managing servers. Additionally, we delve into Serverless Architecture, which abstracts server management, allowing developers to run code without worrying about the underlying infrastructure. The video also covers the integration of DevOps practices, security considerations, and the benefits of microservices.

• Introduction to Serverless Computing

• Infrastructure as Code (IAC)

• Configuration Files and Templates

• DevOps Integration

• Benefits of IAC

• Security in IAC

• Serverless Architecture Overview

• Function as a Service (FaaS)

• Microservices Architecture

• APIs and Communication between Microservices

• Cost-Effectiveness and Scalability

In this video, we explore the Internet of Things (IoT), its architecture, applications, and security considerations. We discuss how IoT devices communicate, the various technologies involved, and the potential vulnerabilities that arise from their widespread use. The video also highlights real-world examples of IoT applications in different sectors, emphasizing both the convenience and risks associated with IoT.

• Definition of IoT

• IoT devices and their communication

• Technologies enabling IoT (Bluetooth, Zigbee, WiFi, etc.)

• Applications of IoT in various industries

• IoT architecture and data flow

• Remote control and monitoring of IoT devices

• Security vulnerabilities in IoT

• Common weaknesses and hacking risks

• Considerations for IoT deployment

In this video, we explore the concepts of Industrial Control Systems (ICS) and Supervisory Control and Data Acquisition (SCADA) within the context of the Internet of Things (IoT). We discuss how these systems are used to control and monitor industrial processes, the shift towards internet connectivity, and the associated cybersecurity risks. The balance between convenience and security is emphasized, along with the challenges posed by legacy systems.

• Introduction to Industrial Control Systems (ICS)

• Overview of Supervisory Control and Data Acquisition (SCADA)

• The role of IoT in industrial processes

• Cybersecurity risks associated with ICS and SCADA

• Network architecture of ICS and SCADA

• Use cases of ICS in various industries

• Security considerations for legacy systems

• Balancing convenience and security in ICS

In this video module, participants will engage with a Sketa simulator to understand the operations of a SCADA (Supervisory Control and Data Acquisition) system. The session will cover the management of fluid levels in tanks, the operation of valves and pumps, and the importance of maintaining optimal conditions within the system. Through interactive activities, learners will gain practical insights into the roles and responsibilities of a SCADA operator.

• Introduction to Sketa simulator

• Overview of SCADA systems

• Understanding tank management

• Operation of valves and pumps

• Maintaining fluid levels

• Interactive simulation activities

• Real-world applications of SCADA operations

This video module delves into Real-Time Operating Systems (RTOS) and Embedded Systems, focusing on their characteristics, applications, and significance in mission-critical environments. It highlights the unique constraints of RTOS, such as time-bound processing and performance stability, and discusses various examples of both RTOS and embedded systems, emphasizing their roles in industrial control systems (ICS) and SCADA.

• Introduction to Real-Time Operating Systems (RTOS)

• Characteristics of RTOS

• Applications of RTOS in mission-critical systems

• Examples of RTOS

• Introduction to Embedded Systems

• Characteristics of Embedded Systems

• Examples of Embedded Systems

• Challenges in updating embedded systems

• Compensating controls for security

In this module, we will explore enterprise infrastructure security, focusing on reducing the attack surface and implementing robust security measures. Key concepts include the importance of consistent security policies, defense in-depth strategies, zero trust architecture, and understanding failure modes in security systems.

• Enterprise infrastructure security

• Reducing the attack surface

• Firewalls

• Intrusion Detection Systems (IDS) and Intrusion Prevention Systems (IPS)

• Secure communications

• Secure access

• Port security

• Software-Defined Wide Area Networks (SD-WAN)

• SASE (Secure Access Service Edge)

• Security policies

• Defense in-depth

• Zero trust architecture

• Endpoint protection

• Failure modes: fail closed vs. fail open

• Human life considerations in security

This video module explores the critical role of firewalls in enterprise security, discussing their evolution from traditional gatekeepers to essential components in modern zero trust architectures. It covers various types of firewalls, their functionalities, and how they can be effectively utilized to create secure network zones, manage traffic, and protect against unauthorized access and malicious threats.

• Role of firewalls in enterprise security

• Evolution of firewalls from traditional to zero trust

• Traffic management and rule setting

• Types of firewalls: hardware, software, web application firewalls, next-generation firewalls

• Network zones and segmentation

• Intrusion detection and prevention systems

• Packet filtering and stateful vs. stateless firewalls

• Circuit level and application level gateways

• Unified threat management (UTM)

• Real-world examples and scenarios

This video module provides an in-depth exploration of intrusion detection systems (IDS) and intrusion prevention systems (IPS), focusing on their types, functionalities, and deployment strategies. It covers network-based and host-based systems, detailing how they detect and respond to malicious activities. The module also discusses the methodologies used in intrusion detection, such as signature-based and anomaly-based detection, as well as the importance of understanding the results of intrusion detection systems.

• Introduction to IDS and IPS

• Types of IDS systems: Network-based (NIDS) and Host-based (HIDS)

• Signature-based vs. Anomaly-based detection

• Indicators of network intrusions

• Deployment strategies for NIDS and NIPS

• Understanding true positives, false positives, true negatives, and false negatives

• Host-based intrusion detection (HIDS and HIPS)

• Indicators of system intrusions

• Wi-Fi intrusion prevention systems (WIPS) and their deployment models

In this video module, we will explore secure communications and secure access methods, focusing on proxies, jump servers, and VPNs. We will discuss the differences between forward and reverse proxies, the functionality of jump servers, and the intricacies of VPNs, including tunneling and encryption methods. Additionally, we will cover remote access solutions and their security implications.

• Introduction to secure communications

• Overview of proxies

• Forward and reverse proxies

• Jump servers and their functionality

• VPNs: tunneling and encryption

• Transport Layer Security (TLS)

• IPsec VPN: authentication header and encapsulating security payload

• Remote access methods

• Security considerations for remote access

This video module focuses on port security, specifically switch port security, and the IEEE 802.1X standard for port-based network access control. It discusses the Extensible Authentication Protocol (EAP), its various authentication methods, and how it facilitates secure network access through a structured authentication process involving supplicants, authenticators, and authentication servers.

• Introduction to port security

• Overview of switch port security

• Understanding IEEE 802.1X standard

• Extensible Authentication Protocol (EAP)

• Role of supplicant, authenticator, and authentication server

• Types of authentication servers (RADIUS, TACACS)

• EAP variants and their applications

• Tunnel Transport Layer Security (TTLS)

• Mutual authentication process

• Securing LAN and wireless LAN

• Preventing on-path and evil twin attacks

In this video, we explore the concepts of Software Defined Wide Area Network (SD WAN) and Secure Access Service Edge (SASE), commonly pronounced as 'Sassy'. The discussion covers the architecture, functionalities, and advantages of SD WAN, including its application-aware routing and centralized control. We also delve into SASE, a newer framework that integrates network and security services in the cloud, addressing the challenges of managing external traffic without routing through a data center.

• Definition of SD WAN

• Application-aware routing protocols

• Virtual overlay and tunneling

• Centralized cloud-based controller

• Quality of Service (QoS)

• Components of SD WAN

• IPsec VPNs

• SD WAN gateways

• Introduction to SASE

• Combining network and security services

• Cloud-based security functions

• Firewall as a Service

• Zero Trust Network Access

• Policy enforcement and URL filtering

• Use cases and benefits of SASE

This video module focuses on the classification of data, which is essential for determining the level of protection required for various types of information. It discusses different data classification levels, their implications for security, and provides examples relevant to various organizations, including military, government, and private sectors.

• Introduction to data classification

• Importance of data classification in protection

• Levels of data classification

• Public data

• Private data

• Confidential data

• Sensitive data

• Restricted data

• Critical data

• Real-world application of data classification

In this video module, we will explore the various methods of protecting classified data based on its type. We'll discuss the considerations businesses must make regarding regulatory compliance, the importance of encryption, and the legal protections available for intellectual property and sensitive information. The module emphasizes the necessity of classifying data to determine appropriate protection measures.

• Data classification and protection

• Regulatory considerations for data protection

• Cost-benefit analysis of data protection measures

• Protection strategies for trade secrets

• Intellectual property protection methods

• Legal considerations for confidential information

• Financial information protection

• Handling personally identifiable information (PII)

• Protection of personal health information (PHI)

• Data loss prevention strategies

In this video, we will explore the importance of choosing an architecture that ensures resilience and the ability to recover from failures. The focus will be on redundancy, also known as high availability, which is crucial for maintaining acceptable service levels during faults and challenges. We will discuss various methods of implementing redundancy, including clustering, load balancing, and geographical dispersion, as well as the considerations involved in designing a high availability system.

• Introduction to resilience and recovery in architecture

• Understanding redundancy and high availability

• Risks associated with single points of failure

• Coordination of redundant systems

• Clustering vs. load balancing

• Geographical dispersion for disaster recovery

• Methods of redundancy implementation

• Cost considerations for redundancy

• Redundant physical components

• Ease of implementing redundancy in cloud environments

• Designing high availability solutions

• Importance of hardening redundant systems

In this video, we explore the concept of alternate sites for data centers and businesses, focusing on the importance of redundancy and geographic dispersion. We discuss various types of alternate sites, including mirror sites, hot sites, warm sites, and cold sites, highlighting their features, costs, and recovery times. Additionally, we examine the value of geographic dispersion and how cloud infrastructure can serve as an effective alternate site.

• Introduction to alternate sites

• Types of alternate sites

• Mirror sites

• Hot sites

• Warm sites

• Cold sites

• Reciprocal agreements

• Geographic dispersion

• Cloud as an alternate site

• Mitigating risks with alternate sites

In this module, we will explore the concept of platform diversity in IT operations, discussing the implications of using multiple platforms, including hardware and operating systems. We will cover considerations for standardization, security, and the management of various platforms, including cloud services, operating systems like Windows and Linux, and the use of physical servers. Additionally, we will delve into the benefits and challenges of hybrid and multi-cloud environments.

• Redundancy and alternate sites

• High availability

• Platform diversity

• Standardization challenges

• Security considerations

• Cloud services

• Operating systems: Windows vs. Linux

• Physical servers and Xeon processors

• Bring Your Own Device (BYOD) and Choose Your Own Device (CYOD)

• Multiple cloud services

• Hybrid cloud environments

• Flexibility in workload management

In this video module, we will explore the critical components of business continuity and disaster recovery planning. We will discuss the importance of creating a comprehensive business continuity plan (BCP) and disaster recovery plan (DRP) to ensure that operations can continue in the face of unexpected disruptions. Key topics include capacity planning, risk assessment, backup strategies, and testing methodologies to prepare staff for emergencies.

• Introduction to Business Continuity

• Importance of Business Continuity Planning

• Creating a Business Continuity Plan (BCP)

• Disaster Recovery Planning (DRP)

• Capacity Planning for Disasters

• Risk Assessment and Business Impact Analysis

• Testing BCP and DRP

• Backup Strategies: Full, Incremental, and Differential Backups

• Power Redundancy Options

• Simulation Exercises and Tabletop Walkthroughs

In this module, we will explore the importance of secure baselines in maintaining daily security for computing resources. We will discuss how to establish, deploy, and maintain these baselines to ensure consistent security across various devices in an organization. The session will cover the creation of structured documents that define security criteria, the use of templates, and the significance of regular assessments and updates to adapt to evolving security needs.

• Introduction to secure baselines

• Definition and importance of baselines

• Creating structured security documents

• Compliance with regulatory requirements

• Using industry templates for baselines

• Building golden images for device deployment

• Automated tools for compliance and updates

• Regular assessment and updating of baselines

• Documentation and versioning of baseline information

In this video, we will explore strategies for reducing the attack surface by hardening various types of devices, including workstations, servers, mobile devices, IoT devices, embedded devices, and cloud infrastructure. The focus will be on implementing security measures to protect against vulnerabilities and ensure secure operations across different environments.

• Understanding the attack surface

• Hardening workstations

• Hardening servers

• Hardening mobile devices

• Hardening IoT devices

• Hardening embedded devices

• Hardening real-time operating systems

• Hardening cloud infrastructure

• Implementing security policies and best practices

• Utilizing monitoring and logging for security validation

In this video, we will explore the essential considerations for securely installing a wireless network. We will discuss the unique challenges posed by wireless LANs, the importance of site surveys, and the design aspects necessary to ensure effective coverage and security. Key topics include installation considerations, access point management, antenna design, and the significance of creating a coverage heat map.

• Introduction to wireless networks

• Understanding WLAN and WiFi

• Security risks associated with wireless networks

• Installation considerations for wireless networks

• Challenges of wireless network installation

• Site surveys and their importance

• Coverage management and access point placement

• Antenna design and signal directionality

• Cable routing and power over Ethernet considerations

• Identifying physical obstructions and interference

• Creating coverage heat maps for optimization

• Best practices for secure wireless installations

  
  

This video module focuses on securing wireless systems after installation. It discusses the inherent vulnerabilities of wireless networks, various authentication methods, and the potential exploits that can affect both wired and wireless connections. The module emphasizes the importance of strong security measures, including the latest standards like WPA3, and practical strategies for implementing secure guest Wi-Fi systems.

• Vulnerabilities of wireless networks

• Service Set Identifier (SSID)

• Authentication modes for Wi-Fi

• Centralized authentication and 802.1x

• Wireless and wired exploits

• Evil twin attacks

• Wi-Fi jamming techniques

• Wi-Fi password cracking methods

• Security standards: WEP, WPA, WPA2, WPA3

• Captive portals for guest Wi-Fi

• Faraday cages for high-security environments

This video module discusses different ways to deploy and secure mobile devices, including BYOD, COPE, and choose your own device. It also covers how mobile devices connect, including over cellular networks, WiFi, Bluetooth, NFC, and USB. Additionally, it explores various security features of mobile devices and the importance of mobile device management (MDM) in ensuring security and control over company data.

• Deployment options for mobile devices (BYOD, COPE, choose your own device)

• Methods of mobile device connectivity (cellular networks, WiFi, Bluetooth, NFC, USB)

• Security features of mobile devices (two-factor authentication, app permissions, encryption, VPN, endpoint protection, device tracking)

• Overview of mobile device management (MDM) and its features

• Examples of MDM products (Microsoft Intune, Cisco Meraki, Jamf)

• Best practices for securing company data on personal devices

In this video module, we will explore how to create and deploy a malicious Android application using BlueStacks and Kali Linux. The process involves generating an APK file with MSFVenom, setting up a handler with Metasploit, and utilizing a Python HTTP server to deliver the APK to a target device. We will also discuss various functionalities that can be exploited once access to the device is gained.

• Introduction to BlueStacks and Kali Linux

• Installation of necessary tools

• Creating a malicious APK using MSFVenom

• Setting up a Python HTTP server

• Configuring Metasploit for handling connections

• Deploying the malicious APK

• Exploiting the Android device after installation

This video module focuses on application security, emphasizing the importance of various strategies developers can implement to enhance the security of their applications. Key topics include input validation, secure cookie management, code analysis, digital signing, sandboxing, and application monitoring.

• Application Security Overview

• Input Validation Techniques

• Use of Regular Expressions

• Escaping Meta Characters

• HTML Entity Encoding

• Secure Cookie Management

• Static and Dynamic Code Analysis

• Digital Code Signing

• Sandboxing Practices

• Application Monitoring and Logging

• Responding to Security Vulnerabilities

In this video module, we will explore the essential concepts of asset management, focusing on the definition of assets, their life cycle, and the challenges associated with managing them effectively. We will discuss the procurement process, tracking and maintaining assets, and the importance of labeling and ownership assignment. Additionally, we will cover the proper disposal methods for decommissioned assets, including data sanitization and destruction.

• Definition of an asset

• Types of IT assets

• Asset life cycle

• Challenges in asset management

• Asset management policy

• Procurement process

• Tracking assets

• Life cycle management

• Risk assessment

• Labeling and ownership assignment

• Disposal methods for assets

• Data sanitization vs. destruction

This video module provides an in-depth overview of vulnerability management, focusing on key concepts such as confirmed vulnerabilities, prioritization, remediation, and various control types. It also discusses the importance of vulnerability assessment, patch management, and the classification of vulnerabilities using systems like CVSS and CVE. The module emphasizes the necessity of identifying, reporting, and remediating vulnerabilities effectively to enhance organizational security.

• Confirmed Vulnerabilities vs. False Positives and Negatives

• Prioritization of Vulnerabilities

• Remediation and Control Types

• Patch Management

• Account Audits

• Exposure Factor and Environmental Variables

• Risk Tolerance and Vulnerability Classification

• Common Vulnerability Scoring System (CVSS)

• Common Vulnerability Enumeration (CVE)

• Common Weakness Enumeration (CWE)

• Vulnerability Scanning and Assessment

• Static and Dynamic Analysis

• Threat Feeds and Open Source Intelligence (OSINT)

• Penetration Testing and Responsible Disclosure

• Credentialed vs. Uncredentialed Scans

• Reporting and Follow-Up on Vulnerabilities

In this video module, we will explore the critical aspects of network security monitoring, including the various activities involved in monitoring systems, networks, and user behavior. We will discuss the tools and techniques used to detect anomalies, manage logs, respond to alerts, and ensure data integrity.

• Importance of monitoring in network security

• Types of activities to monitor

• Tools for monitoring and alerting

• Log management and syslog servers

• Aggregating and correlating data

• Creating reports and archiving data

• Responding to alerts and remediation

• Quarantining compromised systems

• Validating remediation efforts

• Tuning alerts to reduce false positives

In this video module, we will explore various tools and protocols used for monitoring cybersecurity and IT systems. We will discuss the Security Content Automation Protocol (SCAP), benchmark testing, agent-based and agentless monitoring, Security Information and Event Management (SIEM), antivirus solutions, Data Loss Prevention (DLP), Simple Network Management Protocol (SNMP), NetFlow, and vulnerability scanners. Each tool's purpose, functionality, and examples will be covered to provide a comprehensive understanding of how to enhance cybersecurity posture and compliance.

• Introduction to monitoring tools

• Security Content Automation Protocol (SCAP)

• Benchmark testing

• Agent-based vs. agentless monitoring

• Security Information and Event Management (SIEM)

• Antivirus solutions

• Data Loss Prevention (DLP)

• Simple Network Management Protocol (SNMP)

• NetFlow

• Vulnerability scanners

• Tuning alerts and managing noise

In this video module, we will learn how to conduct a vulnerability scan using OpenVAS on multiple virtual machines (VMs). The process includes installing OpenVAS, setting it up, and scanning for vulnerabilities across the networked devices. We will also explore the results and understand how to interpret them for further analysis and remediation.

• Introduction to OpenVAS

• Installation of OpenVAS on Kali Linux

• Setting up OpenVAS and downloading signatures

• Configuring targets for scanning

• Conducting a vulnerability scan

• Analyzing scan results

• Exploring vulnerabilities and exploits using Exploit DB

• Understanding severity levels of vulnerabilities

• Next steps for remediation

In this video module, we will explore the configuration and management of firewall appliances to enhance the security posture of an enterprise. We will discuss the fundamental concepts of firewalls, including their role as a protective barrier between trusted and untrusted networks, and delve into specific configurations such as access control lists (ACLs), port forwarding, and best practices for firewall management.

• Introduction to firewall appliances

• Differences between software firewalls and hardware appliances

• Understanding trusted and untrusted networks

• Firewall configuration basics

• Access Control Lists (ACLs)

• Inbound and outbound traffic management

• Demilitarized Zone (DMZ) concepts

• Port forwarding and its applications

• Common protocols and their associated ports

• Firewall configuration best practices

In this video module, we will learn how to configure a router to implement packet filtering rules, effectively transforming it into a firewall. The focus will be on controlling traffic between two subnets based on specific business requirements, allowing certain communications while blocking others.

• Overview of router configuration

• Understanding subnets and their connections

• Packet filtering rules and their importance

• Testing connectivity and traffic flow

• Implementing firewall rules on a router

• Verifying the effectiveness of access control lists

In this video module, we will explore the configuration and implementation of Intrusion Detection Systems (IDS) and Intrusion Prevention Systems (IPS). We will discuss their functionalities, the importance of signature databases, and the risks associated with each system. Additionally, we will provide examples of IDS rules and best practices for effective deployment and tuning.

• Introduction to IDS and IPS

• Functionality of IDS

• Signature database updates

• Implementation methods for IDS

• Example of an IDS rule (Snort)

• Risks associated with IDS

• Introduction to IPS

• Comparison between IDS and IPS

• Best practices for IDS and IPS

• Real-world scenarios and mitigation strategies

I'm here to help an

In this module, we will explore web traffic filtering, focusing on the devices, software, and plugins that manage web content access. We will discuss the functionality of web filters as preventive technical controls, their deployment methods, and best practices for effective web traffic management.

• Introduction to web traffic filtering

• Types of web filters

• Deployment methods for web filters

• Filtering criteria: keywords, URLs, content categories, DNS, and website reputation

• Central management systems and endpoint agents

• Browser plugins for web filtering

• Configuring web filter settings

• Website reputation evaluation

• Best practices for web filtering

• Troubleshooting web filter issues

This video module focuses on enhancing enterprise security posture through the implementation of operating system policies, specifically highlighting Security Enhanced Linux (SE Linux) and Microsoft Windows Group Policy. It discusses the functionalities, configurations, and comparative advantages of these security measures.

• Introduction to operating system policy for enterprise security

• Overview of Security Enhanced Linux (SE Linux)

• Preventive technical controls in SE Linux

• Mandatory access controls (MAC) in SE Linux

• Configuration of targeted and multilevel policies in SE Linux

• Installation and deployment of SE Linux on various Linux distributions

• Comparison of SE Linux and AppArmor

• Modes of operation in SE Linux

• Introduction to Microsoft Windows Group Policy

• Preventive technical controls in Windows Group Policy

• Configuration and management of Group Policy settings

• Flexibility of Group Policy in user and computer management

• Examples of Group Policy settings and templates

In this video module, we will explore Windows Group Policy, a powerful tool for managing settings across computers and users in a Microsoft environment. We will focus on the local Group Policy Editor, its structure, and how to navigate and configure various settings that can impact user experience and system security.

• Introduction to Windows Group Policy

• History of Group Policy

• Local Group Policy Editor Overview

• Computer Configuration vs. User Configuration

• Navigating Administrative Templates

• Filtering and Searching Settings

• Configuring Security and User Rights

• Standardizing User Environments

• Best Practices for Group Policy Management

In this video module, we will explore the importance of securing network services and the protocols that can be used to enhance security. We will discuss various unsecure protocols and their secure replacements, as well as preventive measures such as DNS filtering and email security techniques.

• Overview of securing network services

• Unsecure protocols and their secure replacements

• FTP to SFTP

• Telnet to SSH

• HTTP to HTTPS

• SMB version upgrades

• SNMP version upgrades

• LDAP to LDAPS

• DNS security and DNS filtering

• Email security measures

• DMark, DKIM, and SPF

• Secure email gateways

• SecureMIME (S/MIME) and PGP

In this video module, we will explore various methods to enhance data protection within network environments. Key topics include file integrity monitoring, data loss prevention (DLP), data destruction techniques, and administrative controls like clean desk policies. Each method is designed to detect, prevent, and respond to potential data breaches and ensure compliance with security standards.

• File Integrity Monitoring (FIM)

• Data Loss Prevention (DLP)

• Data Destruction Techniques

• Shredding and Incineration

• Clean Desk Policy

• Incident Response

• Data Classification

• Forensic Analysis

In this video module, we will explore file integrity checking using the built-in Windows tool Sigverif. We will learn how to verify the integrity of critical system files, manipulate a text file, and observe how changes affect file signatures. The session will also cover taking ownership of files and restoring them to maintain system integrity.

• Introduction to file integrity checking

• Using Sigverif tool

• Checking integrity of critical system files

• Viewing and interpreting log files

• Manipulating text files

• Taking ownership of files

• Changing file permissions

• Restoring files to original state

• Understanding digital signatures

In this video module, we will explore the concept of Network Access Control (NAC) and its role in enforcing security policies on devices attempting to access a network. The discussion will cover various components of NAC, including its integration with other security measures, as well as the importance of Endpoint Detection and Response (EDR) and User Behavior Analytics (UBA) in enhancing network security. We will also address potential security threats and the mechanisms to mitigate them.

• Overview of Network Access Control (NAC)

• Preventive technical controls in NAC

• Quarantine VLAN and captive portals for non-compliant devices

• Verification of device identity, role, and compliance

• Integration of NAC with 802.1X authenticators

• Switch port security and MAC filtering

• Introduction to Endpoint Detection and Response (EDR)

• Continuous monitoring and threat detection with EDR

• Extended Detection and Response (XDR)

• User Behavior Analytics (UBA) and its applications

• Detecting anomalies and potential threats

• Security measures against unauthorized network access

In this video module, we will guide you through the process of setting up multi-factor authentication (MFA) for your Gmail account. This security feature adds an extra layer of protection by requiring two steps to verify your identity when logging in. We will cover the steps needed to enable two-step verification and test its functionality to ensure your account is secure.

• Introduction to Multi-Factor Authentication

• Creating a Gmail Account

• Accessing Google Account Settings

• Enabling Two-Step Verification

• Choosing Verification Methods

• Testing Two-Step Verification

• Disabling Two-Step Verification

In this video module, we will explore the critical aspects of identity and access management (IAM), focusing on the processes of provisioning and deprovisioning user accounts, identity proofing, authentication methods, and best practices for password security. We will also discuss multi-factor authentication, single sign-on, and the importance of biometrics in securing user identities.

• Identity and Access Management Overview

• Provisioning and Deprovisioning User Accounts

• Identity Proofing and Verification

• Authentication Methods and Factors

• Password Security Best Practices

• Multi-Factor Authentication (MFA)

• Single Sign-On (SSO)

• Biometric Authentication

• Federation and Trust Relationships

In this video module, we will explore the critical concepts of access management within identity management. We will cover various access control models, the principles of assigning permissions, and the importance of managing user access throughout its lifecycle. Key techniques such as least privilege, role-based access control, and privileged access management will be discussed, along with practical applications like geo-fencing and attestation.

• Introduction to Access Management

• Assigning Permissions

• Mandatory Access Control (MAC)

• Discretionary Access Control (DAC)

• Role-Based Access Control (RBAC)

• Rule-Based Access Control (RuleBAC)

• Attribute-Based Access Control (ABAC)

• Least Privilege Principle

• Privileged Access Management (PAM)

• Geo-Fencing

• Access Lifecycle Management

• Attestation and Access Certification

• Just-In-Time (JIT) Access

• Ephemeral Credentials

• Multi-Factor Authentication

In this video module, we will explore the fundamentals of access control in a Windows environment. You will learn how to create users and groups, manage permissions, and understand the implications of access control lists (ACLs). We will also discuss how to effectively set and deny permissions, as well as how to check effective access for users.

• Introduction to access control

• Navigating to the Control Panel

• Creating a new user

• Creating a new group

• Understanding user permissions

• Managing folder properties and permissions

• Explaining inherited vs. explicit permissions

• Using deny permissions

• Checking effective permissions

• Conclusion and overview of access control in other operating systems

In this video module, we will explore the critical role of security automation in managing complex security tasks efficiently. We will discuss the concepts of automation and orchestration, the benefits they bring to security operations, and the importance of integrating various security tools through Security Orchestration, Automation, and Response (SOAR). Additionally, we will cover compliance checklists, manual audits, and the costs associated with implementing automation in security processes.

• Introduction to security automation

• Definition and benefits of automation

• Common components of automation: scripting and templates

• Understanding orchestration in security

• Overview of Security Orchestration, Automation, and Response (SOAR)

• Capabilities of SOAR: orchestration, automation, and response

• Importance of compliance checklists

• Manual audits and their advantages

• Costs associated with automation: learning, adaptation, maintenance, and maturity

• Use cases for automation in security tasks

This video module covers the essential aspects of incident response, focusing on the development and implementation of a Disaster Recovery Plan (DRP) as part of a broader Business Continuity Plan (BCP). It emphasizes the importance of preparedness, structured response strategies, and the roles of various team members during incidents. The module also discusses the incident management lifecycle, including preparation, detection, analysis, containment, eradication, recovery, and post-incident activities, with a focus on root cause analysis to prevent future occurrences.

• Introduction to Incident Response

• Disaster Recovery Plan (DRP)

• Business Continuity Plan (BCP)

• Risk Assessment and Business Impact Analysis (BIA)

• Incident Management Processes

• NIST Incident Response Lifecycle

• Preparation and Playbooks

• Detection and Analysis of Incidents

• Containment and Eradication Strategies

• Post-Incident Activities and Root Cause Analysis (RCA)

• Training and Testing Incident Response Plans

• Threat Hunting

This module covers the fundamentals of digital forensics, focusing on the identification, preservation, and analysis of digital evidence in the context of security incidents and legal investigations. It emphasizes the importance of artifacts, the legal implications of evidence handling, and the tools and techniques used in forensic investigations.

• Definition of digital forensics

• Understanding digital artifacts

• Legal considerations in digital forensics

• Chain of custody

• E-discovery process

• Data acquisition methods

• Common tools for forensic analysis

• Log data analysis

• Registry and memory analysis

• Reporting and documentation in forensics

This video module covers the essential elements of effective IT governance, emphasizing the alignment of IT with business objectives, the roles and responsibilities involved, and the various frameworks and policies that guide IT operations. It discusses the importance of both centralized and decentralized IT management structures, the differences between guidelines, policies, standards, and procedures, and the need for compliance with external regulations.

• Introduction to IT Governance

• Importance of Aligning IT with Business Strategy

• IT Governance Frameworks (COBIT, ITIL, CMMI)

• Roles and Responsibilities in IT Governance

• Centralized vs. Decentralized IT Management

• Guidelines, Policies, Standards, and Procedures

• External Considerations in IT Governance

• Monitoring and Revision of Policies

• Compliance with Laws and Regulations

In this video module, we will explore the essential components of risk management, including risk assessment, risk response, and business impact analysis. We will define risk, discuss the various types of risks organizations face, and outline the processes involved in identifying, evaluating, and prioritizing risks. Additionally, we will delve into qualitative and quantitative risk assessments, the importance of maintaining the CIA triad (Confidentiality, Integrity, Availability), and strategies for managing and mitigating risks effectively.

• Definition of Risk

• Understanding Vulnerabilities and Threats

• Types of Risks: Organized Crime, Ransomware, Malware, Insider Threats

• Risk Management Process

• Risk Assessment: Identifying and Evaluating Risks

• Qualitative vs. Quantitative Risk Assessment

• Risk Response Strategies: Avoid, Mitigate, Transfer, Reject

• Business Impact Analysis (BIA)

• Disaster Recovery Planning

• Key Risk Indicators and Risk Register

In this video, we will explore the critical importance of third-party risk assessment in IT operations. As organizations increasingly rely on external vendors and service providers, understanding and managing the risks associated with these relationships is essential. We will discuss the due diligence process, potential conflicts of interest, vendor assessment types, and the significance of agreements such as SLAs, MOUs, and NDAs in mitigating risks.

• Introduction to third-party risk assessment

• Importance of due diligence

• Conflict of interest in vendor relationships

• Types of vendor assessments

• Vendor risk management questionnaires

• Third-party penetration testing

• Supply chain analysis

• Counterfeit hardware risks

• Types of agreements: SLA, MOA, MOU, NDA, MSA, SOW, BPA

• Rules of engagement for penetration testing

• Ongoing vendor monitoring

In this module, we will analyze the SolarWinds Orion Hack, a significant cybersecurity incident that exposed vulnerabilities in supply chain management. The discussion will cover the nature of the attack, the impact it had on various sectors, and the lessons learned regarding third and fourth party software supply chain risk management. We will also delve into the technical details of the malware involved and demonstrate how to analyze the malicious DLL.

• Overview of the SolarWinds Orion Hack

• Impact of the hack on organizations

• Understanding SolarWinds Orion and its functionalities

• Details of the Sunburst malware

• Supply chain vulnerabilities and risk management

• Timeline of the attack

• Malware detection evasion techniques

• Command and control server operations

• Analysis of the malicious DLL using decompilation tools

• Obfuscation techniques used in the malware

• Countermeasures and industry response

In this video module, we will explore key concepts of compliance and privacy in IT security, focusing on the responsibilities of an IT security analyst. The discussion will cover compliance due diligence, due care, attestation, automation in compliance, reporting, and the implications of non-compliance. Additionally, we will delve into privacy terminology, data roles, and the legal frameworks governing data protection.

• Compliance and Privacy Concepts

• Due Diligence and Due Care

• Attestation and Acknowledgement

• Internal vs External Compliance Monitoring

• Automation in Compliance

• Compliance Reporting

• Consequences of Non-Compliance

• Privacy Terminology

• Data Roles: Data Subject, Data Controller, Data Processor

• Data Inventory and Retention

• Right to be Forgotten

• Annual Privacy Notice

• Legal Implications of Data Privacy

• Global Data Privacy Regulations

In this video module, we will explore the importance of attestation, internal and external audits, and penetration testing in assessing cybersecurity risk management. We will discuss the roles of different teams involved in penetration testing, the types of reconnaissance, and the significance of audits in ensuring compliance and trust with stakeholders.

• Attestation and its significance

• Internal vs. external audits

• Penetration testing (pen testing) overview

• Types of penetration testing: red team, blue team, purple team, and white team

• Reconnaissance: active vs. passive

• Importance of audits in cybersecurity

• Vulnerability assessments and remediation

In this video, we will explore the process of Open Source Intelligence (OSINT) using a tool called The Harvester in Kali Linux. The focus will be on how to gather publicly available information about a target organization, including names, email addresses, IP addresses, and more, to aid in understanding potential vulnerabilities. We will also discuss the importance of adapting to the ever-changing landscape of hacking and the nuances of using The Harvester effectively.

• Introduction to OSINT and its significance

• Overview of The Harvester tool in Kali Linux

• How to gather information using The Harvester

• Understanding command usage and options

• Interpreting results from The Harvester

• Ethical considerations in OSINT

• Next steps after gathering information

In this video module, we will explore the process of active reconnaissance using Nmap to discover live hosts and open ports within a subnet. This step follows passive reconnaissance and precedes vulnerability scanning. The session will cover how to configure virtual machines, perform subnet scans, interpret Nmap results, and identify potential vulnerabilities based on the services running on discovered hosts.

• Active reconnaissance overview

• Setting up virtual machines on a bridged network

• Using Nmap for subnet scanning

• Understanding Nmap output and port states

• Identifying operating systems and services

• Interpreting filtered, closed, and open ports

• Gathering information for vulnerability assessment

This video module focuses on the importance of security awareness training, outlining essential topics to cover and strategies to ensure the effectiveness of such training. It emphasizes the need for a structured security awareness program that addresses various threats and engages employees through diverse communication methods. The module also discusses the significance of tailoring training to different audience roles and monitoring the program's impact.

• Introduction to security awareness training

• Components of a security awareness program

• Reducing human factors in security risks

• Communication methods for training

• Recognizing and reporting phishing attempts

• Developing a security awareness training curriculum

• Tailoring training for different job roles

• Monitoring and evaluating training effectiveness

• Key topics for security training

• Training modalities and engagement strategies

• Simulated attacks and performance indicators

importance of thoroughly understanding cybersecurity concepts and recognizing indicators of attacks. The course aims to prepare students for their certification exam while encouraging them to contribute to a safer digital environment.

• Importance of repeated learning

• Improving security posture

• Recognizing indicators of attack

• Identifying artifacts left by hackers

• Preparing for the certification exam

• Contributing to cybersecurity efforts