Entry Point

What to expect

This course will focus on introducing topics with brief lectures, followed by hands-on exercises to further explore those topics. During the exercises, instructors and teaching assistants will be available to answer questions and provide guidance. The class will culminate in the student using the skills they developed to investigate a mock incident from start to finish.
Technical Content beginner

Audience

  • Entry Level Network Operation Center Analysts
  • Entry Level Security Operations Center Analysts
  • Managers wanting to gain a basic understanding of security concepts
  • Anyone else interested in cybersecurity, digital forensics, or incident response

Applicability

If you looked at the other Cyber Fire course descriptions and are concerned that they are too advanced, you are in the right spot.

If you have basic skills in network protocols, network packet capture, viewing files in hex editors and/or calculating file hashes, you may want to consider one of the more advanced courses.

Objectives

  • Learn to use various analysis tools in a Linux environment
  • Perform basic file analysis and file carving
  • Analyze forensic disk and memory images
  • Understand basics of network layers and routing
  • Conduct analysis on common network protocols
  • Understand basics of binary analysis
  • Understand basics of incident reporting
  • Investigate a multi-stage mock incident

Typical Agenda

Entry Point

  • Linux Workstation Introduction
  • File Analysis
  • Host Forensics
  • Forensic Disk Imaging
  • File Carving
  • Network Layers
  • Networking Routing
  • Network Packet Capture
  • Network Protocols
  • Network Scanning
  • Malware Analysis
  • Incident Reporting
  • Mock Incident Practice

Setup

The class requires laptops with virtualization software. We recommend VMWare products such as Workstation Pro or Workstation Player for Windows and Linux or VMWare Fusion for macOS. VirtualBox will work, but you may be limited on advanced virtual machine functionality.

Setup instructions and a link to download the class Virtual Machine will be provided to registrants via the participant portal website prior to the event.