The course starts by teaching you how to assess cybersecurity threats, as well as how to evaluate and select controls to keep your networks and systems secure.
The following topics are covered:
- Cybersecurity Objectives
- Privacy vs. Security
- Evaluating Security Risks
- Building a Secure Network
- Secure Endpoint Management
- Penetration Testing
- Reverse Engineering
- Efficiency and Process Improvement
- The Future of Cybersecurity Analytics
- Summary
- Exam Essentials
- Lab Exercises
Understanding the underlying architecture that makes up your organization's infrastructure will help you defend your organization. In this lesson you will explore concepts like serverless and containerization technology as well as virtualization. You will also explore logs and logging, network architecture and design concepts, identity and access management concepts, and how encryption can be used for security and data protection.
The following topics are covered:
- Infrastructure Concepts and Design
- Operating System Concepts
- Logging, Logs, and Log Ingestion
- Network Architecture
- Identity and Access Management
- Encryption and Sensitive Data Protection
- Summary
- Exam Essentials
- Lab Exercises
Analyzing events and identifying malicious activity is a key part of many security professionals roles. In this lesson you will explore how to monitor for and detect host-based, network-based, and application-based attacks and indicators of compromise. You will also explore how logs, email, and other tools and data sources can be used as part of your investigations.
The following topics are covered:
- Analyzing Network Events
- Investigating Host-Related Issues
- Investigating Service- and Application-Related Issues
- Determining Malicious Activity Using Tools and Techniques
- Summary
- Exam Essentials
- Lab Exercises
Security professionals need to fully understand threats in order to prevent them or to limit their impact. In this lesson, you will learn about the many types of threat intelligence, including sources and means of assessing the relevance and accuracy of a given threat intelligence source. You'll also discover how to use threat intelligence in your organization.
The following topics are covered:
- Threat Data and Intelligence
- Threat Classification
- Applying Threat Intelligence Organizationwide
- Summary
- Exam Essentials
- Lab Exercises
Gathering information about an organization and its systems is one of the things that both attackers and defenders do. In this lesson, you will learn how to acquire intelligence about an organization using popular tools and techniques. You will also learn how to limit the impact of intelligence gathering performed against your own organization.
The following topics are covered:
- Mapping, Enumeration, and Asset Discovery
- Passive Discovery
- Summary
- Exam Essentials
- Lab Exercises
Managing vulnerabilities helps to keep your systems secure. In this lesson, you will learn how to identify, prioritize, and remediate vulnerabilities using a well-defined workflow and continuous assessment methodologies.
The following topics are covered:
- Identifying Vulnerability Management Requirements
- Configuring and Executing Vulnerability Scans
- Developing a Remediation Workflow
- Overcoming Risks of Vulnerability Scanning
- Vulnerability Assessment Tools
- Summary
- Exam Essentials
- Lab Exercises
Vulnerability reports can contain huge amounts of data about potential problems with systems. In this lesson, you will learn how to read and analyze a vulnerability scan report, what CVSS scoring is and what it means, as well as how to choose the appropriate actions to remediate the issues you have found. Along the way, you will explore common types of vulnerabilities and their impact on systems and networks.
The following topics are covered:
- Reviewing and Interpreting Scan Reports
- Validating Scan Results
- Common Vulnerabilities
- Summary
- Exam Essentials
- Lab Exercises
In this lesson, we turn our attention to what happens after a vulnerability is discovered—the ways that organizations respond to vulnerabilities that exist in their environments. We'll begin with coverage of the risk management process and then dive into some of the specific ways that you can respond to vulnerabilities.
The following topics are covered:
- Analyzing Risk
- Managing Risk
- Implementing Security Controls
- Threat Classification
- Managing the Computing Environment
- Software Assurance Best Practices
- Designing and Coding for Security
- Software Security Testing
- Policies, Governance, and Service Level Objectives
- Summary
- Exam Essentials
- Lab Exercises
This lesson focuses on building a formal incident response handling program and team. You will learn the details of each stage of incident handling from preparation, to detection and analysis, to containment, eradication, and recovery, to the final post-incident recovery, as well as how to classify incidents and communicate about them.
The following topics are covered:
- Security Incidents
- Phases of Incident Response
- Building the Foundation for Incident Response
- Creating an Incident Response Team
- Classifying Incidents
- Attack Frameworks
- Summary
- Exam Essentials
- Lab Exercises
Security professionals monitor for indicators of compromise, and once found they are analyzed to determine if an incident happened. In this lesson you will explore IoCs related to networks, systems, services, and applications. You will also dive into data and log analysis as well as evidence acquisition and analysis.
The following topics are covered:
- Indicators of Compromise
- Investigating IoCs
- Evidence Acquisition and Preservation
- Summary
- Exam Essentials
- Lab Exercises
Once an incident has occurred and the initial phases of incident response have taken place, you will need to work on recovering from it. That process involves containing the incident to ensure that no further issues occur and then working on eradicating malware, rootkits, and other elements of a compromise. Once the incident has been cleaned up, the recovery stage can start, including reporting and preparation for future issues.
The following topics are covered:
- Containing the Damage
- Incident Eradication and Recovery
- Validating Data Integrity
- Wrapping Up the Response
- Summary
- Exam Essentials
- Lab Exercises
Communications and reporting are key to ensuring organizations digest and use information about vulnerabilities and incidents. In this lesson you'll explore both communications related to vulnerability management and incident response. You'll explore how to leverage vulnerability management and risk scores while understanding the most common inhibitors to remediation. You'll also look at incident reports, how to engage stakeholders, and how lessons learned can be gathered and used.
The following topics are covered:
- Vulnerability Management Reporting and Communication
- Incident Response Reporting and Communication
- Summary
- Exam Essentials
- Lab Exercises
Understanding what occurred on a system, device, or network, either as part of an incident or for other purposes, frequently involves forensic analysis. In this lesson, you will learn how to build a forensic capability and how the key tools in a forensic toolkit are used.
The following topics are covered:
- Building a Forensics Capability
- Understanding Forensic Software
- Conducting Endpoint Forensics
- Network Forensics
- Cloud, Virtual, and Container Forensics
- Post-Incident Activity and Evidence Acquisition
- Forensic Investigation: An Example
- Summary
- Exam Essentials
- Lab Exercises
