This schedule is subject to change before the beginning of the school.
Week 1: Onboarding
The first thing most labs require is a drug test and badging. You will then be introduced to your national lab, the local team you're joining, and the remote toaster staff and students. You will then create various accounts you'll need for the internship, and take loads and loads of training. During this week you will also download and install required software, and set up your virtual machine.
Toward the end of the week, you will participate in an introduction to incident coordination.
Weeks 2-3: Malware Analysis
Malware Analysis will walk you through using various tools to pull apart executables, and understand their capabilities and program flow.
Week 4: Host Forensics
Host Forensics will teach you how to analyze forensic memory and hard drive images.
Week 5: Network Archaeology
Network Archaeology teaches techniques to extract undocumented protocol communications from network traffic. Students will learn to use Cyber Fire toolsets to create their own custom decoders.
Week 6: SUNBURST / Operational Technology
Using Network Archaeology techniques, students will create a custom decoder for the SUNBURST incident data from 2020.
During this week, students will also learn how Operational Technology (OT) differs from traditional Information Technology, and get a chance to work with OT equipment from a security perspective.
Weeks 7-10: Analysis and Presentation
Students will be given their first piece of the project dataset. This dataset either mimics a real APT incident, or is real data from a past APT incident at a DOE site.
Using techniques taught in the classes, and with staff assistance, teams will disassemble the dataset, looking for indicators of compromise and better evidence fragments, such as command and control traffic, transferred files, malware executables, and more.
The school ends with a presentation of findings to senior site management. You play the role of an incident response team, presenting your findings to senior management. You will be required to package your findings in a standard report template, then give a verbal presentation, and field questions.