Course Overview:

This course is instructed with an instructor in the classroom with provided lab equipment and Cyber Range.

Students enrolled in the Certified Network Defender course, will gain a detailed understanding and hands on ability to function in real life situations involving network defense. They will gain the technical depth required to actively design a secure network in your organization. This program will be akin to learning math instead of just using a calculator.

This course gives you the fundamental understanding of the true construct of data transfer, network technologies, software technologies so that you understand how networks operate, understand what software is automating and how to analyze the subject material.

You will learn how to protect, detect and respond to, and predict threats on the network.  This builds upon the typical knowledge and skills of Network Administrators in network components, traffic, performance and utilization, network topology, system locations, and security policies.

You will learn network defense fundamentals, the application of network security controls, protocols, perimeter appliances, secure IDS, VPN and firewall configuration. You will then learn the intricacies of network traffic signature, analysis and vulnerability scanning which will help you when you design greater network security policies and successful incident response plans. These skills will help you foster resiliency and continuity of operations during attacks.

This course supports a certification that is DoD approved 8570 Baseline Certificate and meets DoD 8140/8570 training requirements.

 

What’s Included:

  • EC-Council official E-Courseware
  • EC-Council iLabs access included for 6 months
  • EC-Council official Certificate of Attendance
  • CND Exam Voucher with 1 FREE RETAKE VOUCHER

 

Security Course Flow
Document Flow Chart iconsm

Dates/Locations:

No Events

Duration: 5 Days

Course Content:

  • Module 01. Network and Defense Strategies
  • Module 02. Administrative Network Security
  • Module 03. Technical Network Security
  • Module 04. Network Perimeter Security
  • Module 05. Endpoint Security-Windows Systems
  • Module 06. Endpoint Security- Linux Systems
  • Module 07. Endpoint Security- Mobile Devices
  • Module 08. Endpoint Security- IoT Devices
  • Module 09. Administrative Application Security
  • Module 10. Data Security
  • Module 11. Enterprise Virtual Network Security
  • Module 12. Enterprise Cloud Network Security
  • Module 13. Enterprise Wireless Network Security
  • Module 14. Network Traffic Monitoring and Analysis
  • Module 15. Network Logs Monitoring and Analysis
  • Module 16. Incident Response and Forensic Investigation
  • Module 17. Business Continuity and Disaster Recovery
  • Module 18. Risk Anticipation with Risk Management
  • Module 19. Threat Assessment with Attack Surface Analysis
  • Module 20. Threat Prediction with Cyber Threat Intelligence

 

Prerequisites:

  • Basic network and host operations knowledge
  • Experience commensurate with one to five years of network, host, or application administration
  • TN-325:Security+   or equivalent

 

Courses to follow:

 

Target Audience:

Network Administrators, Network Security Administrators, Network Security Engineer, Network Defense Technicians, Network Analyst, Security Analyst, Security Operator, and anyone involved in network operations

 

About us:

TechNow has taught security courses for almost 30 years, before most certifications existed and has successfully moved students through certification programs associated with IAPP, SANS, EC-Council and ISC2. Our instructor maintains over a dozen security certifications and has been the director of a company with internationals sales in security training, consulting, and compliance.

Tech Now, Inc. is an accredited Training Center with Ec-Council.

Comments

Latest comments from students


Liked the class?  Then let everyone know!

Happy Veterans Day!

TechNow would like to honor and remember all those who have served and sacrificed for our country.  We would also like to give a big Thank You to all the men and women who are still serving and fighting for our Country today!

New Courses Offered!

We are now offering a variety of new specialized courses!  The following of which are featured:

RH-245: Linux System Administrator I: This course gives direct experience with the most essential system administration tasks in RedHat. The course also instructs crucial system management skills including: configuring network interfaces, client set up of network protocols, managing local devices, installation, package management, performing system boot procedures, grub and controlling system processes.
RH-245: Linux System Administrator I

RH-295: Linux System Administrator II: This course provides hands-on experience working with more complex and integrated administration concepts, and builds upon the Part I course. Instructs essential local system administration skills including: Logical Volumes, Raid Management, and System Logging, SELinux and Virtual Machines.
RH-295: Linux System Administrator II

S-325: Solaris 10 Features for Experienced Solaris Systems Administrators: Students will be instructed and have labs in how to set up, configure, and administer the new features of the Solaris 10 Update 4 and Nevada Operating System releases including: Solaris Zones, ZFS, Dtrace, Predictive Self-Healing, Solaris Trusted Extensions, and operating system installation.
S-325: Solaris 10 Features for Experienced Solaris Systems Administrators

S-395: Configuring Security on the Solaris 10 OS: Provides enterprise-class features to help protect applications and data. Security Administrators can minimize and harden Oracle Solaris to implement a secure foundation for deploying services.
S-395: Configuring Security on the Solaris 10 OS

S-493: New Features of Solaris 11: This course demonstrates the enhancements to zones and ZFS as well as the new features. During the course, students will examine, through lecture and extensive hands-on work, the Automated Installer (AI), Image Packaging System (IPS) and network virtualization.
S-493: New Features of Solaris 11

S-495: Labeled Security Programming with Trusted Extensions: In this course, students will learn Label APIs to write programs to manage labeled data processes, including Solaris library routines and system calls that use Trusted Extensions parameters.
S-495: Labeled Security Programming with Trusted Extensions

S-595: Solaris Trusted Extensions Installation & Configuration: This course teaches how to design and configure Trusted Extensions security label mechanisms, use extended security features of the two graphical desktops, compartmentalize system administrator powers and control privileges and authorizations.  
S-595: Solaris Trusted Extensions Installation & Configuration

N-495: Voice Over IP Foundations: In this course, students will learn how VoIP works, why VoIP works and how to use VoIP.  This course will include configuring an IP Network using Cisco Routers and switches, learning IP fundamentals in order to make VoIP easier to understand.  The last four days of class will focus on VoIP and IP Telephony.
N-495: Voice Over IP Foundations

N-595: VoIP Security Analysis and Design: In this course, the student delves into the dark world of attacking VoIP. Strategies cover attacks at all layers and demonstrate many vectors that work! Topics include how VoIP works, its interactions with the network, its vulnerabilities and mitigations.  Focus is on the leading open source and proprietary technologies utilizing Asterisk and Cisco and the protocols SIP, H.323, RTP, MGCP, and Skinny.
N-595: VoIP Security Analysis and Design

Solaris 11 Is Here!

Oracle will be releasing Solaris 11 in November of 2011.  Even before the release date, Oracle Solaris 11 Express has been available for developers and testers to make the transition easy and smooth.  As instructors getting ready for the change, we have already been working with at Solaris 11 Express, and before that OpenSolaris.

Some of these changes include the cool GUI TimeSlider, similar to Apple Time Machine, utilizing ZFS snapshots; which allows a user to go back in time.  For the administrator this is nothing more than a rollback to a ZFS snapshot.  Other features in ZFS are DEDUP, encryption, and network virtualization, for easier implementation of QOS. 

Transitions are always interesting, especially for instructors.  We have to deal with the issues that involve architecting, implementing, and configuring a new operating system.  We hope we can leverage our previous experience to help ease our students understanding.  It is not just about learning the new commands, options or arguments; it is learning about the "big picture."

Solaris 10 was a good example of this.  It had a variety of new commands to teach, but also a change in the way we approach administration.  For example, Solaris 10 introduced Zones, Service Management Facility (SMF), and Zettabyte File System (ZFS).

Leveraging the previous experience with Solaris 10 is going to be key for a better understanding of Solaris 11.  Enhancements to these same Zones and ZFS requires a strong background in Solaris 10.  Even live upgrade experience to deal with multiple boot environments that involve root on ZFS (now the default behavior) and how we can snapshot, clone and patch the clones are now going to be considered normal procedures.

Two new features in Solaris 11, CrossBow and the Image Packaging System, may not necessarily require Solaris 10 background.  Solaris 10 background just adds a little extra experience.  CrossBow will allow for true virtualization of networks, allowing for easier implementation of quality of service for applications and zones.  If these zones need to network within themselves, we can now efficiently create virtual switches.  Going to a network aware automated update for packages, Solaris 11 promises to make upgrade and patch management much less painful whether you have Zones installed or not. 

In the upcoming months, as Solaris 11 is officially released, look for more blogs to expand on all of these features.  

We look forward to seeing you in our new courses being offered, including our newest Solaris class (S-493: New Features of Solaris 11).

Best Regards,
Bill Peterson
TechNow
(800) 324-2294

Course Overview:

This course begins by introducing you to fundamental cloud computing and AWS security concepts including AWS access control and management, governance, logging, and encryption methods. It also covers security-related compliance protocols and risk management strategies, as well as procedures related to auditing your AWS security infrastructure.

The course continues to teach students how to efficiently use AWS security services to stay secure and compliant in the AWS cloud. The course focuses on the AWS-recommended security best practices that you can implement to enhance the security of your data and systems in the cloud. The course highlights the security features of AWS key services including compute, storage, networking, and database services. This course also refers to the common security control objectives and regulatory compliance standards and examines use cases for running regulated workloads on AWS across different verticals, globally. You will also learn how to leverage AWS services and tools for automation and continuous monitoring—taking your security operations to the next level.

Attendees to CL-425: AWS Security Operations and Architecture will receive TechNow approved course materials and expert instruction.

Duration: 5 Days

Audience:
• Security engineers
• Security architects
• Security analysts
• Security auditors
• Individuals who are responsible for governing, auditing, and testing an organization’s IT infrastructure, and ensuring conformity of the infrastructure to security, risk, and compliance guidelines

DoD 8140: Not Mandated

Course Prerequisites:

We recommend that attendees of this course have the following prerequisites:
This course assumes you have the equivalent experience or have taken the AWS operational courses that are in the TechNow AWS track.
CL-415: AWS Security Operations

The above courses encapsulate prerequisite knowledge:
• Experience with governance, risk, and compliance regulations and control objectives
• Working knowledge of IT security practices
• Working knowledge of IT infrastructure concepts
• Familiarity with cloud computing concepts

Course Objectives:

This course teaches you how to:
• Identify the security and compliance benefits of using the AWS cloud.
• Discuss the AWS Shared Responsibility Model.
• Describe the access control and access management features of AWS.
• Use AWS services for security logging and monitoring.
• Describe data encryption methods to secure sensitive data.
• Describe AWS services used to protect network security.
• Describe the basic steps to ensure strong governance of your AWS resources.
• Identify AWS services used to maintain governance of control environments.
• Use the AWS audit features.
• Explain how to audit an AWS environment.
• Explain the AWS compliance and assurance programs.
• Describe how AWS audits and attestations validate that security controls are implemented and operating effectively.
• Assimilate and leverage the AWS shared security responsibility model.
• Mange user identity and access management in the AWS cloud.
• Use AWS security services such as AWS Identity and Access Management, Amazon Virtual Private Cloud, AWS Config, AWS CloudTrail, AWS Key Management Service, AWS CloudHSM, and AWS Trusted Advisor.
• Implement better security controls for your resources in the AWS cloud.
• Manage and audit your AWS resources from a security perspective.
• Monitor and log access and usage of AWS compute, storage, networking, and database services.
• Analyze events by capturing, monitoring, processing, and analyzing logs.
• Identify AWS services and tools to help automate, monitor, and manage security operations on AWS.
• Perform security incident management in the AWS cloud.
• Perform security assessments to ensure that common vulnerabilities are patched and security best practices are applied. The assessment outline deals both with AWS specifics and also lays down the workflow of NIST, FedRAMP, and Cloud Security Alliance STAR compliance for a deployed AWS solution.

Dates/Locations: No Events

Course Outline:

Day 1
• Introduction to Cloud Computing and AWS Security
• Access Control and Management
• AWS Security: Governance, Logging, and Encryption
• Compliance and Risk Management

Day 2
• Introduction to Cloud Security Course Objectives
• Security of the AWS Cloud: Entry Points, Web Application, Communications, and Incident Response.
• Cloud Aware Governance and Compliance and related control frameworks.
• Identity and Access Management
Day 3
• Securing AWS Infrastructure Services
• Securing AWS Container Services
• Securing AWS Abstracted Services
• Using AWS Security Services
Day 4
• Data Protection in the AWS Cloud
• Managing security in a hybrid environment
• Deep dive into AWS monitoring and log analysis
• Protecting against outside threats to AWS VPC
Day 5
• How to carry out a Pentest on an AWS solution
• Security Incident Management and Automating security and incident response
• Threat detection and monitoring sensitive data
• Lets Do it! Building Compliant Workloads on AWS—Case Study

 

 

Course Overview:

TN-575: Open Source Network Security Monitoring teaches students how to deploy, build, and run an NSM operation using open source software and vendor-neutral tools. No network is bullet proof and when attackers access your network, this course will show you how to build a security net to detect, contain, and control the attacker. Sensitive data can be monitored and deep packet and deep attachment analysis can be achieved. As organizations stand up a Security Operations Center (SOC) the enterprise NSM is the key ingredient to that SOC. This course not only teaches how to implement an NSM technologically, but how to effectively monitor an enterprise operationally. You will learn how to architect an NSM solution: where to deploy your NSM platforms and how to size them, stand-alone or distributed, and integration into packet analysis, interpret evidence, and integrate threat intelligence from external sources to identify sophisticated attackers. A properly implemented NSM is integral to incident response and provides the responders timely information to react to the incident. TN-575: Open Source Network Security Monitoring is a lab intensive environment with a cyber range that gives each student in-depth knowledge and practical experience monitoring live systems to include: Cisco, Windows, Linux, IoT, and Firewalls.

Attendees to TN-575: Open Source Network Security Monitoring class will receive TechNow approved course materials and expert instruction.

This Course is taught utilizing Security Onion or RockNSM as specified by the customer.

Dates/Locations:

No Events

Duration: 5 Days

Course Objective:

The focus of this course is to present a suite of Open Source security products integrated into a highly functional and scalable Network Security Monitoring solution.

Prerequisites:

Students should have a basic understanding of networks, TCP/IP and standard protocols such as DNS, HTTP, etc. Some Linux knowledge/experience is recommended, but not required

Course Outline:

  • Network Security Monitoring (NSM) Methodology
  • High Bandwidth Packet Capture Challenges
  • Installation of Security Onion
    • Use Cases (analysis, lab, stand-alone, distributed)
    • Resource Requirements
  • Configuration
    • Setup Phase I – Network Configuration
    • Setup Phase 2 – Service Configuration
    • Evaluation Mode vs. Configuration Mode
    • Verifying Services
  • Security Onion Architecture
    • Configuration Files and Folders
    • Network Interfaces
    • Docker Environment
    • Security Onion Containers
  • Overview of Security Onion Analyst Tools
    • Kibana
    • CapME
    • CyberChef
    • Squert
    • Sguil
    • NetworkMiner
  • Quick Review of Wireshark and Packet Analysis
    • Display and Capture Filters
    • Analyze and Statistics Menu Options
    • Analysis for Signatures
  • Analyzing Alerts
    • Replaying Traffic
    • 3 Primary Interfaces:
      • Squert
      • Sguil
      • Kibana
    • Pivoting Between Interfaces
    • Pivoting to Full Packet Capture
  • Snort and Surricata
    • Rule Syntax and Construction
    • Implementing Custom Rules
    • Implementing Whitelists and Blacklists
  • Hunting
    • Using Kibana to Slice and Dice Logs
    • Hunting Workflow with Kibana
  • Bro
    • Introduction and Overview
      • Architecture, Commands
    • Understanding and Examining Bro Logs
      • Using AWK, sort, uniq, and bro-cut
    • Working with traces/PCAPs
    • Bro Scripts Overview
      • Loading and Using Scripts
    • Bro Frameworks Overview
      • Bro File Analysis Framework FAF
    • Using Bro scripts to carve out more than files
  • RockNSM ( * If Applicable)
    •  Kafka
      • Installation and Configuration
      • Kafka Messaging
      • Brokers
      • Integration with Bro and FSF
    • File Scanning Framework FSF
      • Custom YARA Signatures
      • JSON Trees
      • Sub-Object Recursion
      • Bro and Suricata Integration
  • Elastic Stack
    • Adding new data sources in Logstash
    • Enriching data with Logstash
    • Automating with Elastalert
    • Building new Kibana dashboards
  • Production Deployment
    • Advanced Setup
    • Master vs Sensor
    • Node Types – Master, Forward, Heavy, Storage
    • Command Line Setup with sosetup.conf
    • Architectural Recommendations
    • Sensor Placement
    • Hardening
    • Administration
    • Maintenance
  • Tuning
    • Using PulledPork to Disable Rules
    • BPF’s to Filter Traffic
    • Spinning up Additional Snort / Suricata / Bro Workers to Handle Higher Traffic Loads

Comments

Latest comments from students


 

Liked the class?  Then let everyone know!

Course Overview:

This Solaris training course is for the student who requires in-depth skills to manage a complex Solaris environment.  This training class is an aggressive accelerated course that gets under the hood of Solaris.

Attendees to S-410: Solaris 10 Administration In-Depth and Troubleshooting will receive TechNow approved course materials and expert instruction.

Date/Locations:

No Events

Duration: 10 days

Course Objectives:

  • Day 1 and 2: Accelerated Solaris Skills
    • UNIX Overview
    • UNIX Command Line Skills
    • Managing and Controlling Access to Files
    • Batch Scripting and Tools
    • Regular Expressions, Pipelines, and IO Redirection
    • Text File Manipulation
    • Network Commands
    • Managing UNIX Processes
    • GNOME Graphical Desktop
       
  • Days 3-5: Solaris Administration
    • Installation
    • Performing Systems Boot Procedures
    • Performing File System Administration
    • Performing Disk Management
    • Performing User Administration
    • Performing Security Administration
    • Managing Network Printers & System Processes
    • Performing System Backups & Restores
    • Working with the Solaris Network Environment
    • Managing Virtual File Systems & Core Dumps
    • Managing Storage Volumes
       
  • Days 6-8: Advanced Solaris Administration
    • Managing Access Control & System Messaging
    • Managing Naming Services
    • Configuring and Managing Solaris Zones
    • Solaris Zones Configuration and Administration
    • Overview and Advanced Techniques Utilizing ZFS
    • Custom Configuration of Service Management Facility (SMF)
    • Utilizing the Advanced Privileges Model of Solaris 10
       
  • Days 9 and 10: Solaris Troubleshooting
    • General Troubleshooting
    • Methodology
    • Root Cause Analysis
    • Intermittent Problems
    • Service Management Facility
    • Zones
    • UFS File Systems
    • ZFS File Systems
    • Performance and System Monitoring Commands

Prerequisites:

  • None

Comments

Latest comments from students


User: kcicoria

Instructor comments: Great Instructor

Facilities comments: The chairs were not very comfortable.


Liked the class?  Then let everyone know!