by Integrity Training | Publisher: Stone River eLearning | Release Date: April 2018 | ISBN: 300000006A0237

The CyberSec First Responder: Threat Detection and Response course prepares the candidates to protect the IT infrastructure of their organizations against cyber-attacks. The course also teaches the candidates to execute a properly planned response to such incidents. The tools and techniques taught in this course are independent of the size and scope of the organization as the course is based on the common threats, risks and their mitigation techniques which are applicable universally. The candidates are advised to have some knowledge of basic networking technologies such as TCP/IP, routing protocols, network security and VPNs. In addition to this, the candidates are also supposed to have at least two years of professional experience in network administration or a similar field.

1. Course Introduction
   • Introduction 00:00:23
   • Course Introduction 00:01:13
   • Instructor Introduction 00:00:10
2. Assessing Information Security Risk
   • Chapter 01 Introduction 00:00:22
   • Topic A: Identify the Importance of Risk Management 00:00:28
   • Elements of Cybersecurity (Perimeter Model) 00:01:26
   • Elements of Cybersecurity (Endpoint Model) 00:01:38
   • The Risk Equation 00:00:55
   • Risk Management 00:00:56
   • The Importance of Risk Management 00:00:44
   • ERM 00:00:42
   • Reasons to Implement ERM 00:01:02
   • Risk Exposure 00:00:25
   • Risk Analysis Methods 00:01:22
   • Risks Facing an Enterprise 00:01:11
   • Topic B: Assess Risk 00:00:32
   • ESA Frameworks 00:00:28
   • ESA Framework Assessment Process Part1 00:00:43
   • ESA Framework Assessment Process Part2 00:00:44
   • New and Changing Business Models 00:00:40
   • De-perimeterization 00:01:41
   • New Products and Technologies 00:01:24
   • Internal and External Influences 00:00:56
   • System-Specific Risk Analysis 00:00:39
   • Risk Determinations 00:02:58
   • Documentation of Assessment Results 00:00:37
   • Guidelines for Assessing Risk 00:02:02
   • Topic C: Mitigate Risk 00:00:51
   • Classes of Information 00:01:17
   • Classification of Information Types into CIA Levels 00:01:51
   • Security Control Categories 00:01:16
   • Technical Controls (Template) 00:00:27
   • Technical Controls (Example Answer) 00:00:36
   • Aggregate CIA Score 00:03:08
   • Common Vulnerability Scoring System 00:01:55
   • Common Vulnerabilities and Exposures 00:00:30
   • Demo - Common Vulnerability Scoring System 00:05:42
   • Extreme Scenario Planning and Worst Case Scenarios 00:01:12
   • Risk Response Techniques 00:01:11
   • Additional Risk Management Strategies 00:01:41
   • Continuous Monitoring and Improvement 00:00:27
   • IT Governance 00:00:31
   • Guidelines for Mitigating Risk 00:01:12
   • Topic D: Integrate Documentation into Risk Management 00:00:30
   • From Policy to Procedures 00:01:17
   • Policy Development 00:00:15
   • Process and Procedure Development 00:00:11
   • Demo - Finding a Policy Template 00:05:20
   • Topics to Include in Security Policies and Procedures 00:00:37
   • Best Practices to Incorporate in Security Policies and Procedures Part1 00:01:35
   • Best Practices to Incorporate in Security Policies and Procedures Part2 00:00:59
   • Business Documents That Support Security Initiatives 00:01:50
   • Guidelines for Integrating Documentation into Risk Management Part1 00:01:07
   • Guidelines for Integrating Documentation into Risk Management Part2 00:00:46
   • Chapter 01 Review 00:00:22
3. Analyzing the Threat Landscape
   • Chapter 02 Introduction 00:00:14
   • Topic A: Classify Threats and Threat Profiles 00:00:31
   • Threat Actors Part1 00:01:12
   • Threat Actors Part2 00:00:45
   • Threat Motives 00:00:39
   • Threat Intentions 00:00:40
   • Attack Vectors 00:00:42
   • Attack Technique Criteria 00:01:21
   • Qualitative Threat and Impact Analysis 00:00:54
   • Guidelines for Classifying Threats and Threat Profiles 00:00:39
   • Topic B: Perform Ongoing Threat Research 00:00:30
   • Ongoing Research 00:00:48
   • Situational Awareness 00:00:31
   • Commonly Targeted Assets 00:01:57
   • The Latest Vulnerabilities 00:01:22
   • The Latest Threats and Exploits 00:01:28
   • The Latest Security Technologies 00:01:08
   • Resources Aiding in Research Part1 00:00:52
   • Resources Aiding in Research Part2 00:00:22
   • Demo - Resources that Aid in Research of Threats 00:03:02
   • The Global Cybersecurity Industry and Community 00:00:43
   • Trend Data 00:00:16
   • Trend Data and Qualifying Threats 00:01:02
   • Guidelines for Performing Ongoing Threat Research 00:01:26
   • Chapter 02 Review 00:00:29
4. Analyzing Reconnaissance Threats to Computing and Network Environments
   • Chapter 03 Introduction 00:00:21
   • Topic A: Implement Threat Modeling 00:00:25
   • The Diverse Nature of Threats 00:00:37
   • The Anatomy of a Cyber Attack 00:02:13
   • Threat Modeling 00:00:37
   • Reasons to Implement Threat Modeling 00:00:33
   • Threat Modeling Process 00:01:15
   • Attack Tree 00:01:36
   • Threat Modeling Tools 00:00:25
   • Threat Categories 00:01:27
   • Topic B: Assess the Impact of Reconnaissance Incidents 00:00:37
   • Footprinting, Scanning, and Enumeration 00:01:15
   • Footprinting Methods 00:01:36
   • Network and System Scanning Methods 00:00:41
   • Enumeration Methods 00:01:05
   • Evasion Techniques for Reconnaissance 00:02:07
   • Reconnaissance Tools 00:02:39
   • Packet Trace Analysis with Wireshark 00:00:31
   • Demo - Performing Reconnaissance on a Network 00:07:23
   • Demo - Examining Reconnaissance Incidents 00:08:11
   • Topic C: Assess the Impact of Social Engineering 00:00:25
   • Social Engineering 00:02:10
   • Types of Social Engineering Part1 00:01:53
   • Types of Social Engineering Part2 00:01:44
   • Types of Social Engineering Part3 00:01:09
   • Phishing and Delivery Media 00:00:48
   • Phishing and Common Components 00:01:15
   • Social Engineering for Reconnaissance 00:00:50
   • Demo - Assessing the Impact of Social Engineering 00:07:37
   • Demo - Assessing the Impact of Phishing 00:03:23
   • Chapter 03 Review 00:00:26
5. Analyzing Attacks on Computing and Network Environments
   • Chapter 04 Introduction 00:00:22
   • Topic A: Assess the Impact of System Hacking Attacks 00:00:19
   • System Hacking Part1 00:00:29
   • System Hacking Part2 00:00:29
   • System Hacking Part3 00:00:33
   • System Hacking Part4 00:00:30
   • System Hacking Part5 00:00:27
   • System Hacking Part6 00:00:24
   • Password Sniffing 00:00:58
   • Password Cracking 00:03:58
   • Demo - Cracking Passwords Using a Password File 00:08:31
   • Privilege Escalation 00:00:58
   • Social Engineering for Systems Hacking 00:00:26
   • System Hacking Tools and Exploitation Frameworks 00:01:06
   • Topic B: Assess the Impact of Web-Based Attacks 00:00:26
   • Client-Side vs. Server-Side Attacks 00:01:10
   • XSS 00:00:57
   • XSRF 00:00:59
   • SQL Injection 00:01:47
   • Directory Traversal 00:01:59
   • File Inclusion 00:01:25
   • Additional Web Application Vulnerabilities and Exploits 00:01:17
   • Web Services Exploits 00:01:10
   • Web-Based Attack Tools 00:00:21
   • Demo - Assessing the Impact of Web-Based Threats 00:03:24
   • Topic C: Assess the Impact of Malware 00:00:22
   • Malware Categories 00:04:55
   • Trojan Horse 00:00:47
   • Polymorphic Virus 00:00:15
   • Spyware 00:01:10
   • Supply Chain Attack 00:00:41
   • Malware Tools 00:00:17
   • Demo - Malware Detection and Removal 00:05:35
   • Topic D: Assess the Impact of Hijacking and Impersonation Attacks 00:00:28
   • Spoofing, Impersonation, and Hijacking 00:00:42
   • ARP Spoofing 00:05:12
   • DNS Poisoning 00:01:36
   • ICMP Redirect 00:00:58
   • DHCP Spoofing 00:02:33
   • NBNS Spoofing 00:01:17
   • Session Hijacking 00:00:45
   • Hijacking and Spoofing Tools 00:00:24
   • Topic E: Assess the Impact of DoS Incidents 00:00:24
   • DoS Attacks 00:01:58
   • DoS Attack Techniques 00:04:37
   • DDoS 00:00:53
   • DoS Evasion Techniques 00:01:31
   • DoS Tools 00:00:27
   • Demo - Assessing the Impact of DoS Attacks 00:04:07
   • Topic F: Assess the Impact of Threats to Mobile Security 00:00:27
   • Trends in Mobile Security 00:02:38
   • Wireless Threats 00:01:51
   • BYOD Threats 00:01:33
   • Mobile Platform Threats 00:02:11
   • Mobile Infrastructure Hacking Tools 00:00:18
   • Topic G: Assess the Impact of Threats to Cloud Security 00:00:19
   • Cloud Infrastructure Challenges 00:01:56
   • Threats to Virtualized Environments 00:03:37
   • Threats to Big Data 00:01:34
   • Example of a Cloud Infrastructure Attack 00:01:22
   • Cloud Platform Security 00:01:10
   • Chapter 04 Review 00:00:21
6. Analyzing Post - Attack Techniques
   • Chapter 05 Introduction 00:00:38
   • Topic A: Assess Command and Control Techniques 00:00:24
   • Command and Control 00:01:01
   • IRC 00:00:34
   • HTTP/S 00:00:56
   • DNS 00:02:02
   • ICMP 00:01:48
   • Additional Channels 00:01:31
   • Demo - Assessing Command and Control Techniques 00:10:37
   • Topic B: Assess Persistence Techniques 00:00:21
   • Advanced Persistent Threat 00:00:53
   • Rootkits 00:00:51
   • Backdoors 00:00:37
   • Logic Bomb 00:00:24
   • Demo - Detecting Rootkits 00:03:45
   • Rogue Accounts 00:02:04
   • Topic C: Assess Lateral Movement and Pivoting Techniques 00:00:25
   • Lateral Movement 00:01:42
   • Pass the Hash 00:01:40
   • Golden Ticket 00:02:26
   • Remote Access Services 00:00:59
   • WMIC 00:01:41
   • PsExec 00:01:05
   • Port Forwarding 00:01:12
   • VPN Pivoting 00:00:57
   • SSH Pivoting 00:00:42
   • Routing Tables and Pivoting 00:00:26
   • Topic D: Assess Data Exfiltration Techniques 00:00:18
   • Data Exfiltration 00:00:44
   • Covert Channels 00:01:34
   • Steganography 00:01:03
   • Demo - Steganography 00:03:52
   • File Sharing Services 00:00:25
   • Topic E: Assess Anti -Forensics Techniques 00:00:37
   • Anti-Forensics 00:00:47
   • Golden Ticket and Anti-Forensics 00:00:44
   • Demo - Assessing Anti-Forensics 00:03:45
   • Buffer Overflows 00:00:43
   • Memory Residents 00:00:35
   • Program Packers 00:01:01
   • VM and Sandbox Detection 00:00:41
   • ADS 00:02:22
   • Covering Tracks 00:01:24
   • Chapter 05 Review 00:00:43
7. Evaluating the Organization’s Security Posture
   • Chapter 06 Introduction 00:00:21
   • Topic A: Conduct Vulnerability Assessments 00:00:32
   • Vulnerability Assessment 00:01:14
   • Penetration Testing 00:00:54
   • Vulnerability Assessment vs. Penetration Testing 00:02:51
   • Vulnerability Assessment Implementation 00:02:24
   • Vulnerability Assessment Tools 00:01:43
   • Specific Assessment Tools 00:01:10
   • Port Scanning and Fingerprinting 00:02:05
   • Sources of Vulnerability Information 00:01:29
   • Operating System and Software Patching 00:01:02
   • Systemic Security Issues 00:00:46
   • Demo - Perform a Vulnerability Scan with Nessus 00:07:36
   • Demo - Perform a Vulnerability Scan with MBSA 00:05:17
   • Topic B: Conduct Penetration Tests on Network Assets 00:00:35
   • ROE 00:02:29
   • Pen Test Phases 00:01:20
   • Pen Test Scope 00:00:54
   • External vs. Internal Pen Testing 00:02:06
   • Pen Testing Techniques 00:01:34
   • Pen Testing Tools of the Trade 00:00:45
   • Kali Linux 00:00:21
   • Data Mining 00:00:40
   • Attack Surface Scanning and Mapping 00:00:37
   • Packet Manipulation for Enumeration 00:00:50
   • Simulated Attacks 00:00:29
   • Password Attacks 00:01:54
   • Penetration Test Considerations 00:04:07
   • Topic C: Follow Up on Penetration Testing 00:00:19
   • Effective Reporting and Documentation 00:01:51
   • Target Audiences 00:00:43
   • Information Collection Methods 00:00:48
   • Penetration Test Follow-Up 00:00:52
   • Report Classification and Distribution 00:01:09
   • Chapter 06 Review 00:00:25
8. Collecting Cybersecurity Intelligence
   • Chapter 07 Introduction 00:00:16
   • Topic A: Deploy a Security Intelligence Collection and Analysis Platform 00:00:57
   • Security Intelligence 00:01:05
   • The Challenge of Security Intelligence Collection 00:00:34
   • Security Intelligence Collection Lifecycle 00:00:52
   • Security Intelligence Collection Plan 00:00:23
   • CSM 00:00:56
   • What to Monitor 00:01:12
   • Security Monitoring Tools 00:00:41
   • Data Collection 00:00:40
   • Potential Sources of Security Intelligence 00:02:13
   • Guidelines for Determining Which Data to Collect for Security Intelligence 00:01:01
   • Guidelines for Determining Which Fields You Should Log 00:01:03
   • Guidelines for Configuring Logging Systems Based on Their Impact 00:02:26
   • Guidelines for Determining Which Events Should Prompt an Alert 00:01:16
   • Information Processing 00:00:42
   • External Data Sources 00:00:39
   • Publicly Available Information 00:00:19
   • Collection and Reporting Automation 00:00:56
   • Data Retention 00:00:53
   • Topic B: Collect Data from Network-Based Intelligence Sources 00:00:34
   • Network Device Configuration Files 00:00:58
   • Network Device State Data 00:02:25
   • Switch and Router Logs 00:01:00
   • Wireless Device Logs 00:01:07
   • Firewall Logs 00:02:27
   • WAF Logs 00:00:47
   • IDS/IPS Logs 00:01:27
   • Proxy Logs 00:01:52
   • Carrier Provider Logs 00:00:36
   • Software-Defined Networking 00:00:39
   • Network Traffic and Flow Data 00:01:12
   • Log Tuning 00:00:35
   • Demo - Collecting Network-Based Security Intelligence 00:07:32
   • Topic C: Collect Data from Host-Based Intelligence Sources 00:00:23
   • Operating System Log Data 00:00:56
   • Windows Event Logs 00:03:01
   • Syslog Data 00:01:01
   • Application Logs 00:01:21
   • DNS Event Logs 00:00:54
   • SMTP Logs 00:01:04
   • HTTP Logs 00:00:45
   • FTP Logs 00:00:36
   • SSH Logs 00:01:24
   • SQL Logs 00:01:03
   • Demo - Collecting Host-Based Security Intelligence 00:15:51
   • Demo - Parsing Log Files 00:03:54
   • Chapter 07 Review 00:00:37
9. Analyzing Log Data
   • Chapter 08 Introduction 00:00:36
   • Topic A: Use Common Tools to Analyze Logs 00:00:37
   • Preparation for Analysis 00:00:32
   • Guidelines for Preparing Data for Analysis 00:00:27
   • Log Analysis Tools 00:00:26
   • The grep Command 00:00:58
   • The cut Command 00:01:26
   • The diff Command 00:02:13
   • The find Command 00:01:21
   • WMIC for Log Analysis 00:01:31
   • Event Viewer 00:03:28
   • Bash 00:02:38
   • Windows PowerShell 00:02:51
   • Additional Log Analysis Tools 00:00:57
   • Guidelines for Using Windows- and Linux-Based Tools for Log Analysis 00:02:49
   • Demo - Analyzing Linux Logs for Security Intelligence 00:08:21
   • Topic B: Use SIEM Tools for Analysis 00:00:24
   • Security Intelligence Correlation 00:01:42
   • SIEM 00:01:39
   • The Realities of SIEM 00:00:49
   • SIEM and the Intelligence Lifecycle 00:01:09
   • Guidelines for Using SIEMs for Security Intelligence Analysis 00:01:58
   • Demo - Incorporating SIEMs into Security Intelligence Analysis 00:18:02
   • Topic C: Parse Log Files with Regular Expressions 00:00:45
   • Regular Expressions 00:01:16
   • Quantification Operators 00:02:38
   • Anchor Operators 00:00:53
   • Character Set Operators 00:01:54
   • Miscellaneous Search Operators 00:02:24
   • Special Operators 00:02:51
   • Build an Expression 00:02:28
   • Keyword Searches 00:04:30
   • Special Character Searches 00:02:10
   • IP Address Searches 00:02:37
   • Guidelines for Writing Regular Expressions 00:00:51
   • Chapter 08 Review 00:00:26
10. Performing Active Asset and Network Analysis
    • Chapter 09 Introduction 00:00:26
    • Topic A: Analyze Incidents with Windows-Based Tools 00:00:26
    • Registry Editor (regedit) 00:00:59
    • Analysis with Registry Editor 00:01:14
    • File System Analysis Tools for Windows 00:01:39
    • Process Explorer 00:01:07
    • Process Monitor 00:00:30
    • Service Analysis Tools for Windows 00:01:30
    • Volatile Memory Analysis Tools for Windows 00:01:00
    • Active Directory Analysis Tools 00:01:56
    • Network Analysis Tools for Windows Part1 00:02:38
    • Network Analysis Tools for Windows Part2 00:04:09
    • Demo - Windows-Based Incident Analysis Tools 00:19:47
    • Topic B: Analyze Incidents with Linux-Based Tools 00:00:15
    • File System Analysis Tools for Linux 00:00:48
    • Process Analysis Tools for Linux 00:00:26
    • Volatile Memory Analysis Tools for Linux 00:00:48
    • Session Analysis Tools for Linux 00:01:01
    • Network Analysis Tools for Linux Part1 00:00:54
    • Network Analysis Tools for Linux Part2 00:01:19
    • Demo - Linux -Based Incident Analysis Tools 00:07:01
    • Topic C: Analyze Malware 00:00:42
    • Malware Sandboxing 00:01:18
    • Crowd -Sources Signature Detection 00:00:57
    • VirusTotal Malware Entry 00:00:39
    • Reverse Engineering 00:00:58
    • Disassemblers 00:01:12
    • Disassembly of Malware in IDA 00:00:25
    • Malware Strings 00:00:59
    • Anti -Malware Solutions 00:02:12
    • MAEC 00:00:40
    • Guidelines for Analyzing Malware 00:01:26
    • Demo - Analyzing Malware 00:03:18
    • Topic D: Analyze Indicators of Compromise 00:00:34
    • IOCs 00:00:49
    • Unauthorized Software and Files 00:03:19
    • Suspicious Emails 00:02:07
    • Suspicious Registry Entries 00:01:09
    • Unknown Port and Protocol Usage 00:02:51
    • Excessive Bandwidth Usage 00:02:31
    • Service Disruption and Defacement 00:01:46
    • Rogue Hardware 00:02:29
    • Suspicious or Unauthorized Account Usage 00:01:16
    • Guidelines for Analyzing Indicators of Compromise 00:01:36
    • Demo - Analyzing Indicators of Compromise 00:15:03
    • Chapter 09 Review 00:00:29
11. Responding to Cybersecurity Incidents
    • Chapter 10 Introduction 00:00:17
    • Topic A: Deploy an Incident Handling and Response Architecture 00:00:42
    • Incident Handling and Response Planning 00:00:37
    • Site Book 00:01:25
    • Incident Response Process 00:02:18
    • SOCs 00:01:10
    • CSIRT Organization 00:00:35
    • CSIRT Roles 00:01:54
    • A Day in the Life of a CSIRT 00:01:40
    • CSIRT Communication Process 00:02:01
    • Incident Indicator Sources 00:01:04
    • The Impact and Scope of Incidents 00:01:51
    • Incident Evaluation and Analysis 00:01:00
    • Incident Containment 00:01:48
    • Incident Mitigation and Eradication 00:00:46
    • Incident Recovery 00:01:02
    • Lessons Learned 00:01:09
    • Incident Handling Tools 00:01:28
    • Topic B: Mitigate Incidents 00:00:24
    • System Hardening 00:01:36
    • Demo - Hardening Windows Servers 00:14:23
    • System and Application Isolation 00:00:29
    • Blacklisting 00:02:17
    • Whitelisting 00:00:53
    • DNS Filtering 00:01:38
    • Demo - DNS Filtering 00:05:07
    • Demo - Blacklisting and Whitelisting 00:09:54
    • Black Hole Routing 00:01:22
    • Mobile Device Management 00:03:09
    • Devices Used in Mitigation 00:02:47
    • The Importance of Updating Device Signatures 00:01:19
    • Guidelines for Mitigating Incidents 00:00:48
    • Topic C: Prepare for Forensic Investigation as a CSIRT 00:00:17
    • The Duties of a Forensic Analyst 00:01:34
    • Communication of CSIRT Outcomes to Forensic Analysts 00:00:47
    • Guidelines for Conducting Post-Incident Tasks 00:00:56
    • Chapter 10 Review 00:00:16
12. Investigating Cybersecurity Incidents
    • Chapter 11 Introduction 00:00:19
    • Topic A: Apply a Forensic Investigation Plan 00:00:33
    • A Day in the Life of a Forensic Analyst 00:00:20
    • Forensic Investigation Models 00:00:59
    • Forensic Investigation Preparation 00:00:51
    • Investigation Scope 00:00:48
    • Timeline Generation and Analysis 00:01:45
    • Authentication of Evidence 00:00:37
    • Chain of Custody 00:00:54
    • Communication and Interaction with Third Parties 00:00:47
    • Forensic Toolkits 00:01:40
    • Guidelines for Preparing for a Forensic Investigation 00:00:27
    • Topic B: Securely Collect and Analyze Electronic Evidence 00:00:25
    • Order of Volatility 00:01:57
    • File Systems 00:01:31
    • File Carving and Data Extraction 00:01:07
    • Persistent Data 00:01:27
    • Data Preservation for Forensics 00:00:47
    • Forensic Analysis of Compromised Systems 00:01:19
    • Demo - Securely Collecting Electronic Evidence 00:05:34
    • Demo - Analyzing Forensic Evidence 00:07:55
    • Topic C: Follow Up on the Results of an Investigation 00:00:16
    • Cyber Law 00:00:24
    • Technical Experts and Law Enforcement Liaisons 00:00:46
    • Documentation of Investigation Results 00:00:23
    • Chapter 11 Review 00:00:17
    • Next Steps 00:00:32
    • Course Closure 00:01:16



300000006A0237.CyberSec.First.Responder.Threat.Detection.and.Response.Exam.CFR210.CSFR.part1.OR.rar

300000006A0237.CyberSec.First.Responder.Threat.Detection.and.Response.Exam.CFR210.CSFR.part2.OR.rar

300000006A0237.CyberSec.First.Responder.Threat.Detection.and.Response.Exam.CFR210.CSFR.part3.OR.rar

300000006A0237.CyberSec.First.Responder.Threat.Detection.and.Response.Exam.CFR210.CSFR.part4.OR.rar