Durata
Prezzo
Lingua
Understanding Cisco Cybersecurity Operations Fundamentals (CBROPS) (CIS10)
Codice: CIS10
Questo corso è progettato per preparare il partecipante alla certificazione Cisco Certified CyberOps Associate ottenibile attraverso il superamento dell’esame CBROPS 210-201. Le organizzazioni moderne, che vogliano competere nel mercato attuale, hanno bisogno di essere dotate o servirsi di un centro definito SOC (Security Operations Center). Questa entità, composta da un Team di professionisti, si occupa di fornire i seguenti principali servizi:
- Servizi di Gestione: tutte le attività di gestione delle funzionalità di sicurezza legate all’infrastruttura IT (rete, sistemi ed applicazioni).
- Servizi di Monitoraggio: l’infrastruttura IT e di Sicurezza vengono monitorate in tempo reale al fine di individuare tempestivamente tentativi di intrusione, di attacco o di compromissione dei sistemi.
- Servizi Proattivi: sono servizi finalizzati a migliorare il livello di protezione dell’organizzazione (Security assessments, vulnerability assessments, early warning, security awareness).
Per supportare adeguatamente questi servizi, i SOC, devono servirsi di personale qualificato a vari livelli. Risorse professionalmente adeguate nell’ambito della Cybersecurity sono oggi di difficile reperimento. In tale contesto nasce questo percorso formativo qualificante. Esso è specificatamente strutturato per ottenere una figura professionale che possa inserirsi rapidamente in un Security Operations Center. Il corso è caratterizzato da una parte teorica e una pratica realizzata su Laboratori forniti direttamente da Cisco. Questa è una prerogativa concessa solo ed esclusivamente ai Cisco Learning Partner.
Modalità di erogazione
In aula o Live Virtual Classroom
Attestato di partecipazione
Al termine del corso verrà rilasciato l’attestato di frequenza
Esame
200-201 – Understanding Cisco Cybersecurity Operations Fundamentals
Understanding the TCP/IP Protocol Suite
- OSI Model
- TCP/IP Model
- IP Addressing
- IP Address Classes
- Reserved IP Addresses
- Public and Private IP Addresses
- IPv6 Addresses
- TCP Three-Way Handshake
- TCP and UDP Ports
- Address Resolution Protocol
- Host-to-Host Packet Delivery Using TCP
- Dynamic Host Configuration Protocol
- Domain Name System
- Internet Control Message Protocol
- Packet Capture Using tcpdump
- Wireshark
- Explore the TCP/IP Protocol Suite
Understanding the Network Infrastructure
- Analyzing DHCP Operations
- IP Subnetting
- Hubs, Bridges, and Layer 2 Switches
- VLANs and Trunks
- Spanning Tree Protocols
- Standalone (Autonomous) and Lightweight Access Points
- Routers
- Routing Protocols
- Multilayer Switches
- NAT Fundamentals
- Packet Filtering with ACLs
- ACLs with the Established Option
- Explore the Network Infrastructure
Understanding Common TCP/IP Attacks
- Legacy TCP/IP Vulnerabilities
- IP Vulnerabilities
- ICMP Vulnerabilities
- TCP Vulnerabilities
- UDP Vulnerabilities
- Attack Surface and Attack Vectors
- Reconnaissance Attacks
- Access Attacks
- Man-in-the-Middle Attacks
- Denial of Service and Distributed Denial of Service
- Reflection and Amplification Attacks
- Spoofing Attacks
- DHCP Attacks
- Explore TCP/IP Attacks
Understanding Basic Cryptography Concepts
- Impact of Cryptography on Security Investigations
- Cryptography Overview
- Hash Algorithms
- Encryption Overview
- Cryptanalysis
- Symmetric Encryption Algorithms
- Asymmetric Encryption Algorithms
- Diffie-Hellman Key Agreement
- Use Case: SSH
- Digital Signatures
- PKI Overview
- PKI Operations
- Use Case: SSL/TLS
- Cipher Suite
- Key Management
- NSA Suite B
- Explore Cryptographic Technologies
Describing Information Security Concepts
- Information Security Confidentiality, Integrity, and Availability
- Personally Identifiable Information
- Risk
- Vulnerability Assessment
- CVSS v3.0
- Access Control Models
- Regulatory Compliance
- Information Security Management
- Security Operations Center
Understanding Network Applications
- DNS Operations
- Recursive DNS Query
- Dynamic DNS
- HTTP Operations
- HTTPS Operations
- Web Scripting
- SQL Operations
- SMTP Operations
- Explore Network Applications
Understanding Common Network Application Attacks
- Password Attacks
- Pass-the-Hash Attacks
- DNS-Based Attacks
- DNS Tunneling
- Web-Based Attacks
- Malicious iFrames
- HTTP 302 Cushioning
- Domain Shadowing
- Command Injections
- SQL Injections
- Cross-Site Scripting and Request Forgery
- Email-Based Attacks
- Explore Network Application Attacks
Understanding Windows Operating System Basics
- Windows Operating System History
- Windows Operating System Architecture
- Windows Processes, Threads, and Handles
- Windows Virtual Memory Address Space
- Windows Services
- Windows File System Overview
- Windows File System Structure
- Windows Domains and Local User Accounts
- Windows Graphical User Interface
- Run as Administrator
- Windows Command Line Interface
- Windows PowerShell
- Windows net Command
- Controlling Startup Services and Executing System Shutdown
- Controlling Services and Processes
- Monitoring System Resources
- Windows Boot Process
- Windows Networking
- Windows netstat Command
- Accessing Network Resources with Windows
- Windows Registry
- Windows Event Logs
- Windows Management Instrumentation
- Common Windows Server Functions
- Common Third-Party Tools
- Explore the Windows Operating System
Understanding Linux Operating System Basics
- History and Benefits of Linux
- Linux Architecture
- Linux File System Overview
- Basic File System Navigation and Management Commands
- File Properties and Permissions
- Editing File Properties
- Root and Sudo
- Disks and File Systems
- System Initialization
- Emergency/Alternate Startup Options
- Shutting Down the System
- System Processes
- Interacting with Linux
- Linux Command Shell Concepts
- Piping Command Output
- Other Useful Command Line Tools
- Overview of Secure Shell Protocol
- Networking
- Managing Services in SysV Environments
- Viewing Running Network Services
- Name Resolution: DNS
- Testing Name Resolution
- Viewing Network Traffic
- System Logs
- Configuring Remote syslog
- Running Software on Linux
- Executables vs. Interpreters
- Using Package Managers to Install Software in Linux
- System Applications
- Lightweight Directory Access Protocol
- Explore the Linux Operating System
Understanding Common Endpoint Attacks
- Classify Attacks, Exploits, and Vulnerabilities
- Buffer Overflow
- Malware
- Reconnaissance
- Gaining Access and Control
- Gaining Access Via Social Engineering
- Social Engineering Example: Phishing
- Gaining Access Via Web-Based Attacks
- Exploit Kits
- Rootkits
- Privilege Escalation
- Pivoting
- Post-Exploitation Tools Example
- Exploit Kit Example: Angler
- Explore Endpoint Attacks
Understanding Network Security Technologies
- Defense-in-Depth Strategy
- Defend Across the Attack Continuum
- Authentication, Authorization, and Accounting
- Identity and Access Management
- Stateful Firewall
- Network Taps
- Switched Port Analyzer
- emote Switched Port Analyzer
- Intrusion Prevention System
- IPS Evasion Techniques
- Snort Rules
- VPNs
- Email Content Security
- Web Content Security
- DNS Security
- Network-Based Malware Protection
- Next Generation Firewall
- Security Intelligence
- Threat Analytic Systems
- Network Security Device Form Factors
- Security Onion Overview
- Security Tools Reference
- Explore Network Security Technologies
Understanding Endpoint Security Technologies
- Host-Based Personal Firewall
- Host-Based Anti-Virus
- Host-Based Intrusion Prevention System
- Application Whitelists and Blacklists
- Host-Based Malware Protection
- Sandboxing
- File Integrity Checking
- Explore Endpoint Security
Describing Security Data Collection
- Network Security Monitoring Placement
- Network Security Monitoring Data Types
- Intrusion Prevention System Alerts
- True/False, Positive/Negative IPS Alerts
- IPS Alerts Analysis Process
- Firewall Log
- DNS Log
- Web Proxy Log
- Email Proxy Log
- AAA Server Log
- Next Generation Firewall Log
- Applications Log
- Packet Captures
- NetFlow
- Network Behavior Anomaly Detection
- Data Loss Detection Using Netflow Example
- Security Information and Event Management Systems
- Explore Security Data for Analysis
Describing Security Event Analysis
- Cyber Kill Chain
- Advanced Persistent Threats
- Diamond Model for Intrusion Analysis
- Cybersecurity Threat Models Summary
- SOC Runbook Automation
- Malware Reverse Engineering
- Chain of Custody
Defining the Security Operations Center
- Types of Security Operations Centers
- SOC Analyst Tools
- Data Analytics
- Hybrid Installations: Automated Reports, Anomaly Alerts
- Sufficient Staffing Necessary for an Effective Incident Response Team
- Roles in a Security Operations Center
- Develop Key Relationships with External Resources
Understanding NSM Tools and Data
- NSM Tools
- NSM Data
- Security Onion
- Full Packet Capture
- Session Data
- Transaction Data
- Alert Data
- Other Data Types
- Correlating NSM Data
- Explore Network Security Monitoring Tools
Understanding Incident Analysis in a Threat-Centric SOC
- Classic Kill Chain Model Overview
- Kill Chain Phase 1: Reconnaissance
- Kill Chain Phase 2: Weaponization
- Kill Chain Phase 3: Delivery
- Kill Chain Phase 4: Exploitation
- Kill Chain Phase 5: Installation
- Kill Chain Phase 6: Command-and-Control
- Kill Chain Phase 7: Actions on Objectives
- Applying the Kill Chain Model
- Diamond Model Overview
- Applying the Diamond Model
- Exploit Kits
- Investigate Hacker Methodology
Identifying Resources for Hunting Cyber Threats
- Cyber-Threat Hunting Concepts
- Hunting Maturity Model
- Cyber-Threat Hunting Cycle
- Common Vulnerability Scoring System
- CVSS v3.0 Scoring
- CVSS v3.0 Example
- Hot Threat Dashboard
- Publicly Available Threat Awareness Resources
- Other External Threat Intelligence Sources and Feeds Reference
- Hunt Malicious Traffic
Understanding Event Correlation and Normalization
- Event Sources
- Evidence
- Security Data Normalization
- Event Correlation
- Other Security Data Manipulation
- Correlate Event Logs, PCAPs, and Alerts of an Attack
Identifying Common Attack Vectors
- Obfuscated JavaScript
Questo corso è progettato per un analista di sicurezza informatica che lavora nei centri operativi di sicurezza.
Per beneficiare appieno di questo corso, dovresti avere le seguenti conoscenze e abilità:
- Competenze e conoscenze equivalenti a quelle apprese durante l’implementazione e l’amministrazione delle soluzioni Cisco (CCNA)
- Conoscenza delle reti Ethernet e TCP/IP
- Conoscenza operativa dei sistemi operativi Windows e Linux
- Familiarità con le basi dei concetti di sicurezza di rete
- Offerte di formazione Cisco consigliate che possono aiutare gli studenti a soddisfare questi prerequisiti
Dopo aver seguito questo corso, dovresti essere in grado di:
- Explain how a SOC operates and describe the different types of services that are performed from a Tier 1 SOC analyst’s perspective.
- Explain Network Security Monitoring (NSM) tools that are available to the network security analyst.
- Explain the data that is available to the network security analyst.
- Describe the basic concepts and uses of cryptography.
- Describe security flaws in the TCP/IP protocol and how they can be used to attack networks and hosts.
- Understand common endpoint security technologies.
- Understand the kill chain and the diamond models for incident investigations, and the use of exploit kits by threat actors.
- Identify resources for hunting cyber threats.
- Explain the need for event data normalization and event correlation.
- Identify the common attack vectors.
- Identify malicious activities.
- Identify patterns of suspicious behaviors.
- Conduct security incident investigations.
- Explain the use of a typical playbook in the SOC.
- Explain the use of SOC metrics to measure the effectiveness of the SOC.
- Explain the use of a workflow management system and automation to improve the effectiveness of the SOC.
- Describe a typical incident response plan and the functions of a typical CSIRT.
- Explain the use of VERIS to document security incidents in a standard format.
- Describe the Windows operating system features and functionality.
- Describe the Linux operating system features and functionality.
- Business applications
- Sicurezza informatica
- ISO
- EGovernement
- Database, big data, machine learning e ia
- HR & Organization
- Giuridico Normativa
- Cloud & virtualization
- Programming & development
- PA
- Metodologie di Service & Project Management
- Management & Collaboration
- Microservizi
- Sistemi operativi
- Marketing & Sales
- Formazione AI
- Networking
- Office & collaboration
- Web design
Torna a trovarci per conoscere i nuovi Corsi inseriti
Oppure richiedi informazioni sul corso che ti interessa nella sezione Contatti
Utilizziamo cookie e tecnologie simili per migliorare la tua esperienza sul nostro sito web. Leggi la nostra Informativa sulla privacy.