Overview

Making your network secure from attack starts with designing, building, and implementing a robust network infrastructure. There are many aspects to implementing a defense-in-depth network that are often overlooked when companies focus only on functionality. Achieving the proper balance between business drivers and core information security requires that an organization build a secure network that is mission-resilient to a variety of potential attacks.

On the first course day students will learn how to design and build a secure network that can both prevent attacks and recover after a compromise. They will also learn how to retrofit an existing network to achieve the level of protection that is required. Building a network is not that complicated, but it takes special skills to integrate all of the components so the network can withstand a variety of attacks and support the organization's mission. Students will learn how to design and implement a functionality-rich, secure network and how to maintain and update it as the threat landscape evolves.

Overview

"Prevention is ideal, but detection is a must" is a critical motto for network security professionals. While organizations always want to prevent as many attacks as possible, some adversaries will still sneak into the network. In cases where an attack cannot be prevented, security professionals must detect the indications that the attack is in progress and stop it before significant harm is caused. Packet analysis and intrusion detection are at the core of such timely detection. Organizations need to not only detect attacks but also to react in a way that ensures those attacks can be prevented in the future.

Because of the changing landscape of attacks, detecting them is an ongoing challenge. Today's attacks are more stealthy and difficult to find than ever before. Only by understanding the core principles of traffic analysis can you become a skilled analyst able to differentiate between normal and attack traffic. New attacks are surfacing all the time, so security professionals must be able to write rules that detect the latest advanced zero-day attacks before they compromise a network.

Traffic analysis and intrusion detection used to be treated as a separate discipline within many organizations. Today, prevention, detection, and reaction must be closely knit so that once an attack is detected, defensive measures can be adapted, proactive forensics implemented, and the organization can to continue to operate.

Overview

Security is all about understanding, mitigating, and controlling the risk to an organization's critical assets. An organization must understand the changing threat landscape and have the capacity to compare it against its own vulnerabilities that could be exploited to compromise its network. While this was never an easy task, it is becoming much more difficult because threats are evolving rapidly and organizations are so complex. On day three, students will learn about the variety of tests that can be run against an organization and how to perform effective penetration testing.

Finding basic vulnerabilities is easy but not necessarily effective if these are not the vulnerabilities attackers exploit to break into a system. Advanced penetration testing involves understanding the variety of systems and applications on a network and how they can be compromised by an attacker. Students will learn about both external and internal penetration testing and the methods of black, gray, and white box testing.

Penetration testing is critical to identify an organization's exposure points, but students will also learn how to prioritize and fix these vulnerabilities to increase the organization's overall security.

Overview

Any organization connected to the Internet or that has employees is going to have attacks launched against it. Even with a keen focus on robust network design, preventive security, and identifying vulnerabilities through penetration testing, some attacks will still occur. In these cases, identifying, analyzing, and responding effectively to the attack is critical.

Security professionals need to understand how to perform incident response, analyze what is occurring, and restore their organization back to its normal state as soon as possible. Day four will provide students with a proven six-step process to follow in response to an attack: Prepare, Identify, Contain, Eradicate, Recover, and Learn from previous incidents. Cyber incidents are a lot like a fire-the sooner you detect them, the easier they are to contain, and the less damage they cause. Therefore prompt incident response is a key follow-on to intrusion analysis.

Another key aspect of incident response is forensic analysis and discovery. Students will learn how to perform forensic investigation and identify indications of an attack. This information will be fed into the incident response process to ensure that the attack is prevented from occurring again in the future.

Overview

As security professionals continue to build more proactive security measures, the methods of attackers will continue to evolve. A common way for attackers to target, control, and break into as many systems as possible is through the use of malware. Students must therefore understand what type of malware is currently available to attackers, as well as future trends and methods of exploiting systems. With this knowledge, students can then learn how to analyze, defend, and detect malware on systems and minimize its impact on the organization.

Overview

Cybersecurity is all about managing, controlling, and mitigating risk to your critical assets. In almost every organization, critical assets are made up of data or information. Whether it is a customer list, research plans, intellectual property, classified information, or a marketing plan, these data represent your organization's lifeline and must be properly protected. Perimeters are still important and critical, but as our networks become more porous and our data more portable, we are moving away from a fortress model and moving towards a focus on data.

Information no longer solely resides on servers where properly configured access control lists can limit access and protect our information. The same intellectual property that is protected on a server behind a strong perimeter can now be copied to laptops (i.e., portable servers) and plugged into networks (i.e., hotels, airports, and coffee shops). Those venues have no firewalls or security devices in place. This means that you must be able to protect the data no matter where it resides. A compromise of sensitive data will have an impact on your company-no matter how or where it was stolen.

Building a strong perimeter defense is a critical first step, but focusing on protecting and controlling critical data from loss is also critical to building strong preventive measures. Proactive security must be implemented to properly protect critical information and minimize its exposure.