Chicago 2014

Overview

Day 1 provides a refresher or introduction, depending on your background, to TCP/IP. It covers the essential foundations such as the TCP/IP communication model, theory of bits, bytes, binary and hexadecimal, an introduction to Wireshark, the IP layer, and both IPv4 and IPv6 and packet fragmentation in both. We describe the layers and analyze traffic not just in theory and function, but from the perspective of an attacker and defender.

All traffic is discussed and displayed using the two open-source tools Wireshark and tcpdump. Students can follow along with the instructor viewing the sample traffic capture files supplied. Six hands-on exercises, one after each major topic, offer you the opportunity to reinforce what you just learned.

Overview

Day 2 continues where the previous day ended in understanding TCP/IP. Two essential tools â Wireshark and tcpdump - are explored to give you the skills to analyze your own traffic. The focus of these tools on Day 2 is filtering traffic of interest in Wireshark using display filters and in tcpdump using Berkeley Packet Filters. We proceed with our exploration of the TCP/IP layers covering TCP, UDP, and ICMP. Once again, we describe the layers and analyze traffic not just in theory and function, but from the perspective of an attacker and defender.

All traffic is discussed and displayed using the two-open source tools, Wireshark and tcpdump. Students can follow along with the instructor viewing the sample capture files supplied. Four hands-on exercises, one after each major topic, offer you the opportunity to reinforce what you just learned.

Note: This course is available to SEC503 participants only.

Overview

Day 3 culminates the examination of TCP/IP with an exploration of the application protocol layer. The concentration is on some of the most widely used, and sometimes vulnerable, crucial application protocols: HTTP, SMTP, DNS, and Microsoft communications. Our focus is on traffic analysis, a key skill in intrusion detection.

We'll take a brief foray into packet crafting and nmap remote OS identification so that you can analyze and recognize telltale signs of each. Packet crafting is a handy skill for an analyst to have, especially for testing IDS/IPS rules. IDS/IPS evasions are the bane of the analyst, so the theory and possible implications of evasions at different protocol layers are examined. The day concludes with an analysis of some real-world traffic captures.

Once again, we describe the applications not just in theory and function, but from the perspective of an attacker and defender. All traffic is discussed and displayed using the two-open source tools, Wireshark and tcpdump. Students can follow along with the instructor viewing the sample traffic capture files supplied. Four hands-on exercises, one after each major topic, offer you the opportunity to reinforce what you just learned.

Note: This course is available to SEC503 participants only.

Overview

The fundamental knowledge gained from the first three days provides a fluid progression into one of the most popular days SEC503. Snort and Bro are widely deployed open-source IDS/IPS solutions that have been industry standards for over a decade. We take a unique approach of teaching both open-source IDS solutions by presenting them in their operational life-cycle phases from planning to updating. This will offer you a broader view of what is entailed for the production operation of each of the tools. This is more than just a step-by-step discussion of install, configure, and run the tools. This approach provides a recipe for a successful deliberated deployment, not just a haphazard âÂÂdownload and install the code and hope for the best.âÂÂ

The introduction to these two tools gives you the requisite theory and hands-on skills to deploy them at your job. You will understand the differences and strengths of each tool, and how they can provide benefits to your network security and inspection of noteworthy events.

There are three hands-on exercises: the mechanics of running Snort; writing a Snort rule, and and learning Bro's capabilities, such using its scripting language, writing signatures, and raising a notice to report about a given event.

Note: This course is available to Security 503 participants only.

Overview

On the penultimate day, you'll become familiar with other tools in the âÂÂanalyst toolkitâ to enhance your analytical skills and give you alternative perspectives of traffic. The open-source network flow tool SiLK is introduced. It offers the capability to summarize network flows to assist in anomaly detection and retrospective analysis, especially at sites where the volume is so prohibitively large that full packet captures cannot be retained for very long, if at all. The topic of network forensics is examined to show you how to investigate an incident using multiple approaches, including log analysis. Finally, you can see how your forensic data can be correlated and analyzed by open-source tools, with a concentration on the OSSEC that acts as a host-based IDS and Security Information and Event Manager (SIEM).

Four hands-on exercises, one after each major topic, offer you the opportunity to reinforce what you just learned.

Note: This course is available to SEC503 participants only.