Program 1 : CyberOps Training (70 Hours)

Modules, Descriptions and Duration

The Danger
Duration: 2 hours
Description:
This being the 1st module will have introduction to the course and understand the attacker's and defender's role, how attackers gain motivation, what impact likely to happen to our networks and digital assets.
Fighters in the War Against Cybercrime
Duration: 2 hours
Description:
Major focus in the module to how to build a cybersecurity career, know the mission of the security operation centre (SOC) and how to prepare for a career in cyber defender.
The Windows Operating System
Duration: 4 hours
Description:
In this module detail about Windows operating system shall be covered e.g., architecture, operations, configuration, monitoring, and how to secure Windows operating system.
Linux Overview
Duration: 4 hours
Description:
A detail understanding of Linux operating system, its usefulness in network security monitoring/investigation, shell scripting, managing security log files, Linux tools, Linux GUI and Linux File system/permissions.
Network Protocols
Duration: 3 hours
Description:
Basic operation of data network communication, network protocols, data encapsulation, and data transmission.
Ethernet and Internet Protocol (IP)
Duration: 3 hours
Description:
Understand Ethernet and IP Protocol, IP V4 addressing, how IP address enables network communication, Default Gateway, and understanding IPV6.
Principles of Network Security
Duration: 2 hours
Description:
Explain how ICMP is used to test network connectivity, and use Windows tools, ping, and traceroute to verify network connectivity.
Address Resolution Protocol
Duration: 2 hours
Description:
Compare the roles of the MAC address and the IP address, analyze ARP by examining Ethernet frames, and explain how ARP requests impact network and host performance.
The Transport Layer
Duration: 2 hours
Description:
Explain how transport layer protocols support network communication, explain howthe transport layer establishes communication sessions, and explain how the transport layer establishes reliable communications.
Network Services
Duration: 4 hours
Description:
Explain how DHCP, DNS, NAT, HTTP, FTP, Email, services enable network functionality.
Network Communication Devices
Duration: 2 hours
Description:
Explain how wired and wireless network devices enable network communication.
Network Security Infrastructure
Duration: 3 hours
Description:
Explain how network designs influence the flow of traffic through the network, explain how specialized devices are used to enhance network security, and explain how network services enhance network security.
Attackers and Their Tools
Duration: 3 hours
Description:
Explain how network threats have evolved and describe the various types of attack tools used by Threat Actors.
Common Threats and Attacks
Duration: 3 hours
Description:
Describe types of malwares, explain reconnaissance, access, and social engineering attacks, and explain denial of service, buffer overflow, and evasion attacks.
Observing Network Operation
Duration: 2 hours
Description:
Explain the importance of network monitoring, and how network monitoring is conducted.
Attacking the Foundation
Duration: 3 hours
Description:
Explain the IPv4 and IPv6 header structure, explain how IP vulnerabilities enable network attacks, explain how TCP and UDP vulnerabilities enable network attacks.
Attacking What We Do
Duration: 2 hours
Description:
Explain IP service vulnerabilities, explain how network application vulnerabilities enable network attacks.
Understanding Defense
Duration: 2 hours
Description:
Explain how the defense-in-depth strategy is used to protect networks, Explain security policies, regulations, and standards.
Access Control
Duration: 2 hours
Description:
Explain how access control protects network data and how AAA is used to control network access.
Threat Intelligence
Duration: 2 hours
Description:
Describe information sources used to communicate emerging network security threats, Describe various threat intelligence services.
Cryptography
Duration: 3 hours
Description:
Explain the role of cryptography in ensuring the integrity and authenticity data, explain how cryptographic approaches enhance data confidentiality, explain public key cryptography, explain how the public key infrastructure functions, explain how the use of cryptography affects cybersecurity operations.
Endpoint Protection
Duration: 2 hours
Description:
Explain methods of mitigating malware, explain host-based IPS/IDS log entries, explain how sandbox is used to analyze malware.
Endpoint Vulnerability Assessment
Duration: 2 hours
Description:
Explain the value of network and server profiling, explain how CVSS reports are used to describe security vulnerabilities, explain how secure device management techniques are used to protect data and assets, explain how information security management systems are used to protect assets.
Technologies and Protocols
Duration: 2 hours
Description:
Explain the behaviour of common network protocols in the context of security monitoring, explain how security technologies affect the ability to monitor common network protocols.
Network Security Data
Duration: 2 hours
Description:
Describe the types of data used in security monitoring, describe the elements of an end device log file, describe the elements of a network device log file.
Evaluating Alerts
Duration: 2 hours
Description:
Identify the structure of alerts, explain how alerts are classified.
Working with Network Security Data
Duration: 2 hours
Description:
Explain how data is prepared for use in Network Security Monitoring (NSM) system, use Security Onion tools to investigate network security events, describe network monitoring tools that enhance workflow management.
Digital Forensics and Incident Analysis and Response
Duration: 3 hours
Description:
Explain the role of digital forensic processes, Identify the steps in the Cyber Kill Chain, Classify an intrusion event using the Diamond Model, and apply the NIST 800-61r2 incident handling procedures to a given incident scenario.

Note: Each module shall be concluded with module summary and a module quiz.

Program 2: Cyber Defence Clinic Course Description (40 Hours)

Module and Scenarios

HackMDs.com: Connect and Set Up (Required)
This scenario walks through connecting to the model enterprise and ensuring that the security tools used today are up and available. At the end of this scenario, you will have access to the lab environment and a map to the resources you will need for using the tools within this lab.
Target Reconnaissance: Gather Information about Vulnerabilities for a Future Attack
This scenario will set the stage for all other scenarios, because information obtained from reconnaissance can lead to various forms of attacks, depending on how the target is identified as vulnerable. Students will perform a simple port and vulnerability scan to represent one of the many methods real target research is performed. Real world research would take much more time and involve various methods to learn as much as the attacker could obtain about the potential target. At the end of this scenario, you will have a basic understanding of how attackers research targets to prepare for future attacks. You will have an introduction to how to scan a target for open ports using Masscan as a port scanner, that has a very familiar NMAP-like syntax, as well as how to evaluate a target for vulnerabilities using a custom script that searches for a vulnerability using the attackers 'specific' toolchain. You will also play the defender role by scanning your network for unknown assets and evaluate those assets with a popular vulnerability scanner by Rapid7 called Nexpose.
Smash and Grab: Attack Public Network Services Through the Front Door
Now, the attacker, will use the Metasploit tool in this scenario to weaponized an exploit against the Struts vulnerability. This will allow the attacker to obtain command line access or a 'shell' on the vulnerable DMZ web server. The advance section of this scenario will show you how to further compromise DMZ web server as a gateway to pivot deeper into other systems on the HackMDs network. You will also learn more about pivoting attacks in subsequent scenarios At the end of this scenario, you will have delivered a traditional server exploit using Metasploit. You will use Armitage, a GUI overlay to Metasploit, to launch your attack. You will search for the Struts vulnerability options, configure the attack, and then launch the attack. When the attack is

complete, you will have a working command shell on the DMZ web server, giving Mr. Orange full access to the resources on the HackMDs DMZ network.
The Ransom Scenario: Respond to Advanced Persistent Threats (APTs)
In this scenario, we will be exploring how malware could function. There are several types of Malwares, some of which are extremely automated in nature to attack as many people as possible with the least amount of intervention. The attacks used in today's lab will focus on manually infecting a user and later laterally moving around the network to infect other systems. This is a common characteristic of an APT (Advanced Persistent Threat), mixed with traditional BotNets and newer Ransomware.

At the end of this scenario, you will have launched a realistic compromise of HackMDs' network using a simulated advanced persistent threat. You would have launched a phishing attack to trick a victim to open a fake medical record infecting that system with Ransomware and a RAT. After launching the attack, you switched to the defender side and used Cisco Advanced Malware Protection (AMP) on the network and host level to identify and remediate the Ransomware and RAT software.
Insider Threats: Move Within to Obtain and Export Your Data
Perimeter security is not 100% meaning eventually a malicious entity will breach your network. The step that typically follows a breach is establishing a foothold inside a target's network. Once attackers are inside a network either through malicious software or through a remote connection, they will need to understand the internal environment. This is typically accomplished through scanning the environment. Once internal targets are identified, attackers will attempt to access other systems, also known as pivoting. The goal is typically to identify systems of interest so they can obtain something of value. This process has been documented and modelled as the Attacker Kill Chain.

At the end of this scenario, you will have a basic understanding of what attackers do once they breach a network. You will have accessed a network and performed internal reconnaissance to identify how the internal network looks like for HackMDs.com.
Compromised Hosts: Control Access and Monitor Malicious Threats
It is critical that you know who and what can access your network. It is also critical to automatically enforce proper policy. This includes all aspects of network access meaning LAN, Wireless and VPN from guests to the CEO. Gaps in coverage expose you to the risk of having a system bypass your perimeter security with direct access to network resources. At the end of this scenario, you will have a basic understanding of how access control and internal security solutions can work together to prevent real world cyber threats. You will access the HackMDs network over Cyber Defense Clinic Lab v4.1 149 Scenarios Outcome VPN however, the same policy could be enforced for LAN and Wireless connections.
Centralized Defense: Centralize Event Data (Splunk and IBM QRadar)
In this scenario, you will be using the HackMDs SIEM (Splunk or QRadar) to view various types of attacks that have been identified with Firepower, Identity Services Engine (ISE), Advanced Malware Protection (AMP) and Stealthwatch. You will also look at potential weaknesses within the HackMDs organization based on vulnerability data seen by Firepower and Rapid7's Nexpose. Tasks will include using prebuilt dashboards and searching across multiple datasets to identify the potential threats to the HackMDs environment. At the end of this scenario, you will have accessed Splunk or QRadar and investigated different security events using existing dashboards and native mining techniques. First, you will investigate an insider threat based on concern of unauthorized remote connections to the inside network, suspicious reconnaissance and exfiltration behaviour seen by Stealthwatch and Firepower. Next, you will review the exploitation of a struts vulnerability found on your DMZ server. Lastly, you will investigate a compromised VPN host that was removed from the network by Cisco ISE based on Firepower alerts.
SOAR: Automation and Response with Splunk Phantom
In this scenario, you will explore how to automate responses to incidents with a Security Orchestration, Automation and Response (SOAR) tool called Splunk Phantom we will shortened to Phantom within this document. Phantom combines security infrastructure orchestration, playbook automation and case management capabilities. Phantom allows for your SOC to create Playbooks, which represent a series of automation tasks that are triggered on an event. Playbooks help a SOC develop and deploy automation to fit a threat workflow or investigation strategy. At the end of this scenario, you will have a basic understanding of how a SOAR such as Phantom can automate tasks for a threat response situation.
Web Defense and Resource Sustainability Part 1: WAF Focus
In this scenario, the attacker shall steal sensitive data from HackMDs. Stolen data will be used to extort HackMDs leadership or sold on the darknet. The attacker is going to use several vulnerabilities as per OWASP e.g., Cross-site scripting, SQL Injection, Broken access Control etc. At the end of this scenario, you will have delivered several Web Application exploitation attacks exploiting a new HackMDS billing server. You will first discover the application, look for vulnerabilities, and attempt to either take control of the server or steal data within the server. The HackMDS server is in the DMZ. Compromising this system could also provide a foothold into the network.
Web Defense and Resource Sustainability Part 2: DDoS Focus
At the end of this scenario, you will have delivered two different denial of service attacks with the goal of disrupting the HackMDs web applications. You will also learn how to defend against both protocol and volume-based DDoS attacks using Radware's Defense Pro solution.
Defend Identities and Prevent Password Compromise: MFA Saves the Day
Two of the most common attacks against people is social engineering and phishing. The goal of these attacks is to trick the victim into clicking something, installing malicious software, or reveal the victim's password. Rather than focusing on making passwords longer and more complex, it is best practice to have users validate identity upon connection to any resource with sensitive data, using multifactor authentication that identifies you by something you have, something you know or who you are.

At the end of the scenario, you will learn how to deliver social engineering and phishing attacks using the Social Engineering Toolkit (SET). Gain experience deploying Cisco Duo and protecting users from account takeover and password compromise. Protect Splunk by enhancing authentication with Cisco Duo.
Managed Services: Monitor Threats and Performance with Tetration
For this scenario, you will play out the role of an externally managed service provider assigned to monitor HackMDs's datacentre. You are fortunate to have Cisco Tetration, which has mapped out all application dependences providing complete visibility into communications and potential risks. HackMDs has asked for a whitelist approach to access within the datacenter. This approach provides access to only what is required for successful operation and monitoring for potential risks. Risks include vulnerabilities, unauthorized access, or gaps in the access control policies.
Cyber Defense Response Challenge: Incident Response
The goal of Cyber Defense Response clinic is demonstrating why various security concepts are important using real work attack and defend scenarios. Our challenge is trying to create an environment that can provide value to people with various levels of skills and experience. The scenarios thus far have followed a script explaining the steps for both the attack and defend exercises. We decided to include one scenario that is scripted differently. In this scenario, you are challenged to come up with your own steps to answer specific questions about an attack that has recently occurred. Consider this an incident response challenge! At the end of this scenario, you will have attempted the Cyber Defense Response Challenge by performing an incident response to a recent attack. You will have investigated a Windows system that you were informed may have been infected with some form of malware based on potential communication to a command and control (C2) server. You will have run Wireshark to view packet level traffic between the IT system and outside world.

Trainings

Cyber Warrior Associate

Cyber Warrior Associate