Computer Network Security & Incident Response with Gen AI

Explore computer network protocols and the OSI and TCP/IP models, detailing layer responsibilities, addressing and routing, error recovery, and common protocols like HTTP, FTP, DNS, and IP.

Explore how the IP protocol enables addressing and routing at the network layer. Learn about IPv4 and IPv6 addresses, private ranges, and how routers use routing tables to forward packets.

Compare TCP and UDP as transport layer protocols, detailing reliability, flow control, sequencing, and port-based socket communication, and map ports to services like HTTP, DNS, and FTP.

Explore how application layer protocols like http/https, ftp, smtp, pop3, imap, dns, and dhcp enable web and email services, file transfers, and network configuration.

Practice tcp/ip network troubleshooting with ipconfig, ping, arp, ftp, nslookup, and net state, and learn their switches such as ipconfig /all, arp -a, and routing table.

Examine wireless networks' mobility, flexibility, and scalability, enabling bring-your own device access and guest connectivity. Compare with wired cores, noting cost savings, easy setup, and safer, cable-free environments.

Explore diverse wireless networks from wifi to gsm, bluetooth, infrared, and wimax. Learn about licensed and ism bands, regulatory roles, and triple play data, voice, and video over one outlet.

Explore Wi-Fi 802.11 standards (A, B, G, N) operating in 2.4 and 5 GHz, including infrastructure and ad hoc networks, SSID visibility (broadcast or hidden), and CSMA/CA with RTS/CTS.

Learn about wireless networking devices such as access points and usb modems, antenna influence, wifi standards, channels, ssids, vlan settings, and security features like mac filtering and wpa aes encryption.

Explore wireless drawbacks, including coverage limits and weather. Note higher bit error rate and sniffing risks, and that wireless cannot fully replace wired infrastructure.

Balance access and security while safeguarding confidentiality, integrity, and availability; identify assets, threats, vulnerabilities, and risk to minimize impact.

Design a secure network from the ground up with a dmz, internet firewall, and private core; apply defense in depth and vlans to limit attacks and segment access.

Learn tcp ip security through ip header analysis, protocol values (1 icmp, 6 tcp, 17 udp), fragmentation and nat concepts, and use Engage Packet Builder to craft test packets.

Learn port scanning fundamentals, identify open ports and vulnerable services with nmap and zenmap, and understand OS fingerprints for security testing with permission.

Explore sniffing concepts and how legitimate users and attackers use sniffers like tcpdump, Windump, and Wireshark to capture and analyze network traffic with focus on confidentiality and reconnaissance.

Discover how firewalls protect internal networks from external threats, inspect traffic, use network address translation, log events, and alongside honeypots, apply layered defense including two firewalls and dmz setups.

Understand how firewall rules decide to accept or reject traffic based on source, destination, ports, and the default rule, including default deny vs default allow and zero-day attacks.

Explore packet filtering firewalls, nat firewalls, and proxy firewalls, comparing speed and security, and learn how stateful inspection and personal firewalls balance protection with performance.

Use honeypots as decoy machines or networks to attract attackers, gather evidence and forensics, identify attack methods, and harden defenses by monitoring unused ports and fake services.

Explore how Windows Firewall works and how to configure inbound and outbound rules for tcp and udp. Recognize that peer-to-peer programs can bypass firewalls with dynamic ports, risking data exposure.

Explore how intrusion detection systems monitor hosts and networks, generate alerts, and support defense in depth, while detailing true and false positives and the need for skilled analysts.

The network intrusion detection system acts as a passive sensor at aggregation points, captures traffic, and generates alerts for events of interest based on signatures, anomaly analysis, and protocol analysis.

Explore deployment and access challenges of a network intrusion detection system, including storage and processing limits, encrypted traffic decryption, signatures quality versus quantity, and shallow versus deep inspection.

Snort, a low-cost, lightweight intrusion detection system, monitors multiple sites and sensors, delivers low false alarms, and generates alerts while illustrating inbound HTTP rules and CGI bin access detections.

Understand intrusion prevention system (IPS), evolution of intrusion detection system (IDS), as an active defense for networks and hosts. Learn about learning mode, false positives, and defense in depth.

Explore wired equivalent privacy concepts and wireless security challenges, including isolating wireless networks from sensitive servers with firewalls, VLANs, or separate switches. Learn encryption basics and why WEP is deprecated.

Trace the evolution from WEP to WPA and WPA2, highlighting 256-bit keys, TKIP per-packet keys, and AES-based counter cipher mode with block chaining, plus vulnerabilities and adoption guidance.

Expose wireless security myths, including rogue access points and ad hoc networks. Build defense in depth with traffic isolation and encryption to protect wired infrastructure from wireless threats.

Defend wireless networks by encrypting traffic to prevent eavesdropping, auditing with packet sniffers, and deploying mutual authentication, TLS/SSL, and IDS to detect rogue access points and mitigate DoS threats.

Design a secure wireless network by isolating access points on a segregated switch, routing traffic through the firewall, applying OSI-layer security, and using WPA2 AES.

Protect personnel, information, and equipment by integrating physical security with network controls to prevent unauthorized access and protect CIA: confidentiality, integrity, and availability.

Identify physical security threats such as fire, smoke, water flooding, extreme temperatures, and power loss, and mitigate with sensors, alarms, firefighting systems, UPS, HVAC, signage, mantraps, and video surveillance.

define defense in depth by layering security across information, application, host, and network to frustrate attackers with multiple controls like encryption, firewalls, ids, access control, and updated software.

Identify incidents by distinguishing events of interest from routine events. Determine attacker, victim, and malware involvement using NetBIOS scans or a missing backup tape as examples.

Prepare with a published policy and management support, then identify, contain, eradicate, and recover from incidents, while documenting evidence and lessons learned to strengthen defenses.

Explains the CIA triad—confidentiality, integrity, and availability—and demonstrates access control using knowledge-based, possession-based, and biometric factors, plus password policies.

Identify assets, threats, and vulnerabilities to protect confidentiality, integrity, and availability. Learn how asset valuation, threat exposure, and vulnerability assessment shape risk and patching strategies.

Assess and minimize cyber risk by analyzing threat, vulnerabilities, and impact to protect critical assets. Explore intrusion techniques, data theft, identity theft, and denial of service.

Learn common cyber threats like social engineering and phishing, compare viruses, worms, and Trojan horses, and outline DoS and DDoS attacks alongside brute force, spyware, cookies, and spam.

Identify malware propagation methods across removable media, email, web, social networks, and instant messaging, and implement a layered defense including security policies, firewalls, antivirus, IDS/IPS, and regular updates.

Develop a six-stage incident handling approach—preparation, identification, containment, eradication, recovery, and lessons learned—driven by observable events of interest and documented evidence.

Explore the six incident handling phases—preparation, identification, containment, eradication, recovery, and lessons learned—and learn to prepare people, policy, data, software, hardware, communications, and documentation.

Form a multidisciplinary incident handling team with security, operations, legal, human resources, and public affairs members; implement controlled access, training, reporting channels, and tools like a jump bag and honeypot.

Identify and alert early to incidents, correlate data from firewall, antivirus, UTM, and hosts, and enforce need-to-know with a primary incident handler across network, host, and application levels.

Identify incidents by reviewing logging and monitoring data for unusual processes, network usage, startup items, and registry changes, then assess evidence and report with custody maintained.

Stop the incident from spreading during containment by deploying an on-site team, assessing severity and sensitivity, and coordinating targeted notification and eradication.

Implement containment to limit damage and preserve evidence by isolating the infected system and creating disk images, then coordinate with business units and ISPs to patch and remove attacker accounts.

Execute eradication by removing malware, backdoors, and rootkits, restore from the most recent clean backup or reformat, then patch and harden to prevent reattack.

During the recovery phase, validate and safely restore operations using vulnerability scanners, tests, baseline documentation, and business-unit retesting to confirm no reinfection and ensure ongoing monitoring.

Document lessons learned from incidents, develop a follow-up report with stakeholder consensus and sign-offs, and secure funding to strengthen enterprise-wide incident handling and security processes.

Document the incident and lessons learned to improve security. Develop a follow-up report with consensus, sign-offs, funding, and shared responsibility to bolster enterprise-wide incident handling via data collection and correlation.