
Explore cybersecurity fundamentals, the NICE cybersecurity workforce framework, the NIST cybersecurity framework, and certifications, then gain insight into SIEM tools, SOC operations, and incident response actions.
Define cyber security as securing computers, networks, data, and digital identities, and apply the CIA triad—confidentiality, integrity, availability—along with authentication, authorization, and non-repudiation, plus the NICE cybersecurity workforce framework.
Embrace continuous learning in cybersecurity by tapping free papers, affordable training, and free webinars from NIST CSRC, SANS, Cybrary, Udemy, and BrightTalk, while following top researchers and breaking news sites.
Define the scope of cyber security across computers, networks, applications, data, and identities; cover CIA triad, authentication, authorization, non-repudiation, and NICE's action categories: architecture, passive defense, active defense, intelligence, offense.
Explore application, data, endpoint, and network security, and cloud security concepts, including web application firewalls, encryption, data masking, DLP, CASB, and CSPM, to discuss security products.
Assess the Gartner magic quadrant for web application firewalls, identifying leaders like Imperva and Akamai, visionaries, niche players, and challengers, with vendor caveats.
Master static white box testing, dynamic black box testing, interactive application security testing, and runtime application self-protection, and learn to combine techniques for robust application security.
Explore static and dynamic application security testing (SAST and DAST): analyze code and running apps to identify vulnerabilities early, gain real-time feedback, and enable rapid remediation in production.
Examine interactive application security testing (IAST) and runtime application self-protection (RASP) tools, learn how they complement dynamic and static testing, and review the Gartner AST vendor quadrant.
Explore data security fundamentals: how people, processes, and technology protect confidentiality, integrity, and availability, meet GDPR, CCPA, and HIPAA obligations, and implement encryption, masking and tokenization, DLP, and DRM.
Explore how data encryption transforms plaintext into ciphertext and how key management protects data, using symmetric and asymmetric schemes, with hardware security modules safeguarding cryptographic keys.
Learn data masking to conceal sensitive data while preserving usability in non-production environments, and tokenization to replace data with tokens stored in a secure vault for payment processing.
Learn data leakage prevention by disabling usb ports or whitelisting devices via group policy object updates, with encrypted IronKey and device control blocking insider uploads to personal cloud storage.
Explore endpoint security technologies protecting laptops, desktops, and servers from cyber threats. Learn how machine learning, artificial intelligence, behavioural analytics, and emulation enhance protection beyond signature-based antivirus and SIEM integration.
Protects the entire hard drive on laptops with full disk encryption, guarding data in case of loss or theft, and is integrated into Windows since Vista.
Network access control enforces policy by validating endpoints with a policy management server, allowing only compliant devices onto the network, isolating noncompliant hosts to quarantine and remediate.
Secure web gateway inspects and filters internet-bound traffic, shifting from appliance proxies to cloud-delivered, agent-based security for mobile workforces, with policy decisions shaped by legal and human resources input.
Secure email gateway inspects incoming messages to block malware, attachments, URLs, and phishing using machine learning, artificial intelligence, and sandbox analysis. Cloud-based deployment reduces cost and speeds deployment.
Explore cloud security across SaaS, PaaS, and IaaS, and learn how shared responsibility shifts security duties, with AWS and Microsoft illustrating varying provider roles.
This is the latest (July 2022) CASB lecture edition.
Explore cloud security posture management as continuous checks for security, misconfigurations, and remediation; compare vendors like Dome Security, Check Point CloudGuard, and native cloud CSPM solutions, plus per-check pricing.
Explore cloud security posture management across providers, from Google Cloud Security Command Center to premium threat detection with proactive flaw discovery and multi-cloud support.
Explore the security operations center, its role in monitoring, detecting, and investigating security events with a siem dashboard, and prioritizing incidents for timely response.
Explore how people, process, and technology interoperate in a security operations center to optimize SIEM-driven detection, alerting, and incident response through metrics and continuous improvement.
Explore common SOC staffing models, from 24x7 to eight by five, shaped by company size, risk appetite, and regional presence, and how MSSP or MDR partnerships address gaps.
Monitor security events from applications, operating systems, and security technology solutions. Raise incident tickets and investigate potential breaches to protect confidentiality, integrity, and availability using siem tools.
Define event collections through scoping and sizing to identify assets and logs to monitor for siem, and estimate eps needs with logpoint tool to control costs and prevent dropped events.
Explore the siem architecture from the event collection layer to analytics, including normalization and anomaly detection. Understand event correlation yields high fidelity alerts and the operations layer visualizes them.
Explore the key SIEM features, including log aggregation, sizing, event correlation, alerting, dashboards, compliance reporting, and log retention, as SIEM evolves with threat landscapes.
Assess the Gartner magic quadrant for SIEM vendors, noting leaders like Splunk, IBM, QRadar, Exabeam, LogRhythm, Securonix, and Dell; Logpoint is the sole visionary with a free online sizing tool.
Design alert use cases to predefine event types and trigger relevant, actionable alerts in a SIEM, using examples from external IP scans, pivots, and data leakage.
Explore the four collapsed incident response phases—preparation, detection and analysis, containment, and eradication and recovery—and post-incident activity, and review the NIST SP800-61r2 guidance.
Prepare for incidents by building a planning process, preventive controls, passive defense capabilities, SOPs, and a trained incident response team with defined roles and asset inventories.
Detect and analyze security events with well-tuned SIEM alerts and actionable reports, emphasizing situational awareness and multi-source analysis. Use findings to guide containment, eradication, and recovery.
Extract lessons from cybersecurity incidents by determining the root cause and evaluating the incident response actions. Implement improvements, preventive controls, and enhanced detection and response capabilities for future incidents.
Assemble an incident response jump kit with tools, incident handling documents, and workflows, including an offline investigative laptop, live CD, network diagrams, contact details, cables, and spare storage.
This lecture explains incident categorization and a multi-phase SOC workflow, linking asset criticality and incident severity to MTTD and MTTR, plus SLAs and the critical cybersecurity incident response team.
Attached resource is an example of a real-life attack scenario to which students that purchase lab access will be introduced. Visit www.cyberation.io to learn more
Last Updated: March 2021
This course is all about working in a security operations center (SOC). It is designed to produce SOC analysts with excellent understanding of cyber security essentials, technology solutions, security operations, and incident response. Upon completion, learners will be capable of hitting the ground running from day 1 on the job. Additionally, learners will gain an excellent understanding of common tools, people and operational processes and procedures that make a value delivering SOC function effectively. The door to the SOC is ever revolving therefore SOC analysts will always be in high demand. This training is guaranteed to equip learners with everything required to work as an entry level SOC analyst who will be capable of giving intermediate analysts a run for their money.
The SOC has become one of the most important cyber defense capabilities in enterprise environment today. A key tenet of cyber security is prevention is ideal, but detection is a must, which means that where you're not able to prevent an adversary from breaching your defensive layers, detecting their presence in your environment in a timely manner is crucial. It is for this reason that organizations are constantly in the hunt for SOC analysts. As of March 2021, there were approximately 2,500 vacant SOC analyst job positions across the United States (source: LinkedIn), which is a clear indication that those with the requisite skill set will always be in a job.
This course covers technology solutions and their respective vendors across multiple cyber defense domains, therefore learners are going to gain an excellent understanding of security products that are typically leveraged in enterprise environments, such that they are able to have meaningful conversations with potential employers.
By the time students get to the security operations and incident response section of the course, they would appreciate why it was important to build the necessary foundational knowledge of security technologies. This is because the main tool used in the SOC (i.e. the SIEM) relies on all these other security technologies to deliver value. As a SOC analyst, you want your SIEM tool to give you that much needed situational awareness of security events that are unfolding on the network, therefore, you need the various sources of security events to push logs to your SIEM tool for analysis, correlation and alerting.
The course is packed with a lot of relevant and realistic information and scenarios, so be rest assured that you're going to get the full value for your money!