Udemy
    •  
    •  
    •  
    •  
    •  
    •  
    •  
    •  
Turn what you know into an opportunity and reach millions around the world.
Learn More
Your cart is empty.
Keep shopping
Incident Response for Cyber Professionals
Rating: 3.7 out of 5(104 ratings)
941 students

Incident Response for Cyber Professionals

Defending Networks and Systems Against Hackers
Created byChad Russell
Last updated 3/2017
English
English [Auto],

What you'll learn

  • Defend networks and systems from common threats and attacks using open source incident response tools.
  • Use Snort and Bro to conduct incident response.
  • Use Kippo as an SSH Honeypot.
  • Architect IDS and network perimeter security environments.

Course content

1 section • 20 lectures • 3h 30m total length

  • Introduction1:26

    Learn to use open source and commercial tools to respond to security incidents, including malware response, defensive posturing, forensics, and malware analysis with operational security for virtualized and cloud environments.

  • Incident Response9:18

    Learn to verify, contain, eradicate, and recover from security incidents using a six-step incident response plan—preparation, identification, containment, eradication, recovery, and lessons learned.

  • Virtualization and Cloud Security - Part 116:19

    Examine virtualization and cloud security across hypervisors, containers, and software defined networking (OpenFlow) within OpenStack; learn best practices, threat modeling, and secure PaaS, data handling, and backup strategies.

  • Virtualization and Cloud Security - Part 212:57

    Explore container and cloud security, including Docker content trust, OpenFlow SDN, and best practices for IaaS and SaaS with strong authentication and encryption.

  • Malware5:12

    Explore how sandboxing and malware analysis tools enable security teams to capture, study, and reverse engineer malware across Windows, Linux, and Android.

  • Static Malware Analysis13:55

    Conduct static malware analysis on a Windows system using a safe virtual machine and snapshot backups, examining dependencies, signatures, packed malware, and potential ransomware behavior for containment.

  • Operational Security7:56

    implement operational security to manage day-to-day risk with security operations centers, threat detection, and compensating controls. enforce baseline configurations, vulnerability scanning, encrypted removable storage, strong passwords, and monitored remote access.

  • Disaster Recovery9:40

    Identify critical information systems via a business impact analysis and define recovery time and recovery point objectives to guide disaster recovery planning and business continuity.

  • Platform Hardening and Baselining8:20

    Learn how to implement platform hardening and baselining by defining security baselines, auditing for deviations, and applying targeted operating system, database, and application hardening to minimize attack surface.

  • Advanced Perimeter Security12:17

    Explore how load balancers, forward and reverse proxies, API gateways, and firewall rules secure network resources with unified threat management technologies.

  • IDS9:19

    Explore network-based nids and host-based hips, detective and preventive modes, anomaly-based and signature-based detection, inline and dmz architectures, with Snort as an example.

  • Advanced IDS6:20

    Explore advanced intrusion detection concepts, including statistical anomaly detection, rule based and signature based methods, and the ID XP exchange protocol for interoperable IDS architectures.

  • Snort and Bro26:46

    Explore intrusion detection in Windows networks using Snort and Security Onion. Set up promiscuous mode across Windows and Linux VMs to capture network based evidence and generate rule-based alerts.

  • Honeypots and Honeynets6:36

    Explore how honeypots and honeynets lure attackers away from critical data, monitor their activity with decoys and logs, and study threats to strengthen security.

  • Kippo SSH Honeypot6:50

    Explore kippo ssh honeypot in a python-based emulator, using honeyfs, log handling, and fake banners, then replay attacker sessions and detect honeypots with nmap scripts.

  • Firewalls3:30

    Trace the evolution of firewalls from stateless filters to stateful inspection and application layer protections, including next-generation wafs that inspect all seven layers.

  • Apache Security Logging5:14

    Change Apache logging from warn to debug, restart Apache, and tail the error log to observe verbose security events as logging becomes more detailed.

  • Security Information Event Management12:29

    Manage and analyze logs from operating systems, switches, routers, applications, and databases using log collection, centralized aggregation, retention, rotation, search, and SIEM-driven correlation.

  • Cyber Attacks17:54

    Explore a spectrum of cyber attacks, from shoulder surfing and dumpster diving to zero-day exploits, tailgating, impersonation, all the way to fishing and pharming, with defense strategies.

  • Incident Forensics17:42

    Learn Windows and Linux forensic techniques to mount disk images, recover deleted files with Sleuth Kit tools, and reconstruct browser activity using Galera and Pascoe.

Requirements

  • Students should have a basic understanding of technology and networking.
  • A working internet connection.

Description

Incident Response Course Syllabus

Course Overview

In this course you will learn how to use open source tools for incident response purposes.   This course utilizes first hand explanations and screencast demonstrations of how to use these tools in a step-by-step manner so you can start incident response work immediately on your own.   

Table of Contents

Course Overview – Introductory Lesson

Incident Response - Incident response is an organized approach to addressing and managing the aftermath of a security breach or attack .  The goal is to handle the situation in a way that limits damage and reduces recovery time and costs. An incident response plan includes a policy that defines, in specific terms, what constitutes an incident and provides a step-by-step process that should be followed when an incident occurs.

Cyber Attacks - Here we will cover CyberAttacks on Wi-Fi networks and over the web so you can understand how to respond to them. 

Virtualization and Cloud Security - So virtualization can mean many things at different layers of the stack.   At the network layer you have VLAN’s, MPLS networks and even SDN (Software Defined Network) technologies such as Openflow.    At the storage layer you have VSAN’s.     At the Hardware and OS layer you have hypervisors for machine virtualization and containers for runtime virtualization and isolation.     Databases have even gotten in on the act using container technology.    

Malware - In this section we will define Malware categories and characteristics and talk through protective countermeasures to keep networks, systems and data safe from compromise. ‘

Static Malware Analysis –

Analyze malware statically in VM environments.

Operational Security - Once we have a Risk Management program in place we need to implement operational security to manage the day to day aspects of security.    In this lesson you will learn about Operational Security Controls what they consist of and how they help us to incrementally manage risk on a daily basis.

Lesson 7 – Disaster Recovery - While at first glance DR might not seem like a natural fit with cybersecurity after further analysis we realize that disasters are threats that can inflict much more damage than any hacker.   Here we will talk about DR planning, strategies and best practices.  

Platform Hardening and Baselining - Minimizing the attack surface area of operating systems, databases and applications is a key tenet of operational security.   In this lesson you will learn about techniques for OS/DB and App hardening.  

Lesson 9 - Advanced Perimeter Security - While many argue that with the advent of mobile technologies and the cloud the perimeter is dissolving, it will remain a key component in securing network resources for years to come.    Here we’ll cover Load balancers, forward and reverse proxies, API Security Gateways,  Firewall rules and Unified Threat Management technologies.  

IDS - Intrusion Detection technology is offered in multiple flavors.    They are either network based or host based and can be detective or preventive in nature.  

Advanced IDS - Previously we’ve talked about IDS basic concepts.   Now it’s time to cover advanced IDS architectures, standards and further explore the inner workings of statistical and Rule based IDS. 

Snort and Bro – In this lesson you will learn how to use Snort and Bro NIDS/HIDS by example.    

 Honeypots and Honeynets - Luring attackers away from critical data and studying their behavior can help us to protect the data that matters most.   Let’s found out how we can use honeypots to tie up attackers and find out what they are up to.

Kippo SSH Honeypot

Firewalls - In this lesson we will cover the evolution of firewalls and their capabilities.   

Apache Security Logging – Apache is still the most popular web server by install base on the web.   Let’s learn how to log malicious activities using Apache logging.      

SIM - Management of logs is a key component of operational security.    These days the velocity, variety and volume of data collected via logs has catapulted log management into the realm of Big Data.   You will learn how to effectively manage these logs and derive useful security information from them. 

Forensic Duplication

Learn how to acquire a forensic duplicate using Linux based tool


Who this course is for:

  • Students who desire to learn more about defending networks and systems against hackers.

Report abuse