TN-575: Open Source Network Security Monitoring

 

Course Overview:

TN-575: Open Source Network Security Monitoring teaches students how to deploy, build, and run an NSM operation using open source software and vendor-neutral tools. No network is bullet proof and when attackers access your network, this course will show you how to build a security net to detect, contain, and control the attacker. Sensitive data can be monitored and deep packet and deep attachment analysis can be achieved. As organizations stand up a Security Operations Center (SOC) the enterprise NSM is the key ingredient to that SOC. This course not only teaches how to implement an NSM technologically, but how to effectively monitor an enterprise operationally. You will learn how to architect an NSM solution: where to deploy your NSM platforms and how to size them, stand-alone or distributed, and integration into packet analysis, interpret evidence, and integrate threat intelligence from external sources to identify sophisticated attackers. A properly implemented NSM is integral to incident response and provides the responders timely information to react to the incident. TN-575: Open Source Network Security Monitoring is a lab intensive environment with a cyber range that gives each student in-depth knowledge and practical experience monitoring live systems to include: Cisco, Windows, Linux, IoT, and Firewalls.

Attendees to TN-575: Open Source Network Security Monitoring class will receive TechNow approved course materials and expert instruction.

This Course is taught utilizing Security Onion or RockNSM as specified by the customer.

Dates/Locations:

No Events

Duration: 5 Days

Course Objective:

The focus of this course is to present a suite of Open Source security products integrated into a highly functional and scalable Network Security Monitoring solution.

Prerequisites:

Students should have a basic understanding of networks, TCP/IP and standard protocols such as DNS, HTTP, etc. Some Linux knowledge/experience is recommended, but not required

Course Outline:

  • Network Security Monitoring (NSM) Methodology
  • High Bandwidth Packet Capture Challenges
  • Installation of Security Onion
    • Use Cases (analysis, lab, stand-alone, distributed)
    • Resource Requirements
  • Configuration
    • Setup Phase I – Network Configuration
    • Setup Phase 2 – Service Configuration
    • Evaluation Mode vs. Configuration Mode
    • Verifying Services
  • Security Onion Architecture
    • Configuration Files and Folders
    • Network Interfaces
    • Docker Environment
    • Security Onion Containers
  • Overview of Security Onion Analyst Tools
    • Kibana
    • CapME
    • CyberChef
    • Squert
    • Sguil
    • NetworkMiner
  • Quick Review of Wireshark and Packet Analysis
    • Display and Capture Filters
    • Analyze and Statistics Menu Options
    • Analysis for Signatures
  • Analyzing Alerts
    • Replaying Traffic
    • 3 Primary Interfaces:
      • Squert
      • Sguil
      • Kibana
    • Pivoting Between Interfaces
    • Pivoting to Full Packet Capture
  • Snort and Surricata
    • Rule Syntax and Construction
    • Implementing Custom Rules
    • Implementing Whitelists and Blacklists
  • Hunting
    • Using Kibana to Slice and Dice Logs
    • Hunting Workflow with Kibana
  • Bro
    • Introduction and Overview
      • Architecture, Commands
    • Understanding and Examining Bro Logs
      • Using AWK, sort, uniq, and bro-cut
    • Working with traces/PCAPs
    • Bro Scripts Overview
      • Loading and Using Scripts
    • Bro Frameworks Overview
      • Bro File Analysis Framework FAF
    • Using Bro scripts to carve out more than files
  • RockNSM ( * If Applicable)
    •  Kafka
      • Installation and Configuration
      • Kafka Messaging
      • Brokers
      • Integration with Bro and FSF
    • File Scanning Framework FSF
      • Custom YARA Signatures
      • JSON Trees
      • Sub-Object Recursion
      • Bro and Suricata Integration
  • Elastic Stack
    • Adding new data sources in Logstash
    • Enriching data with Logstash
    • Automating with Elastalert
    • Building new Kibana dashboards
  • Production Deployment
    • Advanced Setup
    • Master vs Sensor
    • Node Types – Master, Forward, Heavy, Storage
    • Command Line Setup with sosetup.conf
    • Architectural Recommendations
    • Sensor Placement
    • Hardening
    • Administration
    • Maintenance
  • Tuning
    • Using PulledPork to Disable Rules
    • BPF’s to Filter Traffic
    • Spinning up Additional Snort / Suricata / Bro Workers to Handle Higher Traffic Loads

Comments

Latest comments from students

 

Liked the class?  Then let everyone know!

C-225: C++ Object Oriented Programming

 

Course Overview:

C-225: C++ Object Oriented Programming is a hands-on course that provides a complete introduction to the ANSI Standard C++ programming language, focusing on quickly developing the practical skills needed to create real-world solutions.  Our hands-on labs are designed to promote retention and challenge students to apply their skills to new situations.

C++ is more than just C with classes.  It is a whole new language with a structure similar to C, but with significant differences to warrant a complete course to cover its features.

Attendees to C-225: C++ Oriented Programming will receive TechNow approved course materials and expert instruction.

Dates/Locations:

No Events

Duration: 5 Days

Course Objectives:

  • Classes
  • Casting in C++
  • Constructors & Destructors
  • Class Methods & Data
  • Inheritance
  • Overloaded Functions
  • Virtual Functions
  • Overloaded Operators
  • Pure Virtual Functions
  • Exception Handling
  • References & Constants
  • Standard Template Library
  • New and Delete
  • STL Containers

Prerequisites:

 

Comments

Latest comments from students

User: christinehejnal

Instructor comments: The material was made clear, however I don't agree that she shouldn't have catered towards the people not taking the exam.

Facilities comments: The facilities were cold and very noisy, I found it hard to concentrate.

User: mamacker1

Instructor comments: Informative instructor. Definitely not monotone. I'd recommend it to my sister if I had one.

Liked the class?  Then let everyone know!

VM-325: VMware View: Install, Configure and Manage

Course Overview:

This hands-on training course builds your skills in the VMware ViewTM suite of products: VMware View Manager, VMware View Composer, and VMware® ThinAppTM.  Based on customer specification, this course can be based on View 4.x or 5.x, and ThinApp 4.x or 5.x releases.

Attendees to VM-325: VMware View: Install, Configure and Manage will receive TechNow approved course materials and expert instruction.

At the end of this course, you should understand the features and operations of View and be able to:

  • Install and configure View components
  • Create and manage dedicated and floating desktop pools
  • Deploy and manage linked-clone virtual desktops
  • Configure and manage desktops that run in local mode
  • Configure secure access to desktops through a public network
  • Use ThinApp to package applications

Date/Locations:

No Events

Duration: 5 days

Course Objectives:

  • Module 1: Course Introduction
  • Module 2: Introduction to VMware View
  • Module 3: View Connection Server
  • Module 4: View Desktops
  • Module 5: View Client Options
  • Module 6: View Administratory
  • Module 7: Configuring and Managing Linked Clones
  • Module 8: Local-Mode Desktops
  • Module 9: Command-Line Tools and Backup Options
  • Module 10: Managing VMware View Security
  • Module 11: View Manager Performance and Scalability
  • Module 12: VMware® ThinAppTM

Prerequisites:

  • VM-315: VMware Infrastructure: Install, Configure and Manage
  • Experience in Microsoft Windows Active Directory Administration
  • Experience with VMware vSphereTM
  • Before attending the course, students must be able to perform the following tasks:
    • Create a template in VMware vCenterTM Server and deploy a virtual machine from it
    • Modify a template customization file
    • Open a virtual machine console in vCenter Server and access the guest operating system
    • Configure Active Directory services

 

Comments

Latest comments from students

Liked the class?  Then let everyone know!

N-505: CISCO DoD Comply to Connect (C2C)

Course Overview:

 Cisco DoD Comply-to-Connect (C2C) course teaches you how to implement and deploy a Department of Defense (DoD) Comply-to-Connect network architecture using Cisco Identity Services Engine (ISE). This training covers implementation of 802.1X for both wired and wireless devices and how Cisco ISE uses that information to apply policy control and enforcement. Additionally, other topics like supplicants, non-supplicants, ISE profiler, authentication, authorization, and accounting (AAA) and public key infrastructure (PKI) support, reporting and troubleshooting are covered. Finally, C2C specific use case scenarios are covered.

This training also earns you 32 Continuing Education (CE) credits toward recertification.

Dates/Locations:

No Events

Duration: 5 days

 

Course Outline: 

Section 1: C2C Fundamentals

  • Comply to Connect Overview
  • From C2C to ZTA
  • Steps to Implement C2C

Section 2: Cisco Identity-Based Networking Services

  • Cisco IBNS Overview
  • AAA Role in Cisco IBNS
  • Compare Cisco IBNS and Cisco ISE Solutions
  • Explore Cisco IBNS Architecture Components

Section 3: Introducing Cisco ISE Architecture

  • Cisco ISE as a Network Access Policy Engine
  • Cisco ISE Use Cases
  • Cisco ISE Functions

Section 4: Introducing Cisco ISE Deployment

  • Cisco ISE Deployment Models
  • Cisco ISE Licensing and Network Requirements
  • Cisco ISE Context Visibility Features
  • New Features in Cisco ISE 3.X

Section 5: Introducing Cisco ISE Policy Enforcement Components

  • 802.1X for Wired and Wireless Access
  • MAC Authentication Bypass for Wired and Wireless Access
  • Identity Management
  • Active Directory Identity Source
  • Additional Identity Sources
  • Certificate Services

Section 6: Introducing Cisco ISE Policy Configuration

  • Cisco ISE Policy
  • Cisco ISE Authentication Rules
  • Cisco ISE Authorization Rules

Section 7: PKI and Advanced Supplicants

  • Public Key Infrastructure (PKI)
  • TEAP in Comply to Connect (C2C)
  • Secure Client ISE features and Configuration for C2C

Section 8: Introducing the Cisco ISE Profiler

  • Web Access with Cisco ISE
  • ISE Profiler
  • Cisco ISE Probes
  • Profiling Policy
  • Custom Attributes in Profile

Section 9: Introducing Cisco ISE Endpoint Compliance Services

  • Endpoint Compliance Services Overview

Section 10: Configuring Client Posture Services and Compliance

  • Client Posture Services and Provisioning Configuration

Section 11: Introducing Profiling Best Practices and Reporting

  • Profiling Best Practices

Section 12: C2C Use Cases

  • Cisco CX ISE Reporting Tool
  • ISE Reporting
  • ISE Hardening
  • Profiling Best Practices for C2C

Section 13: C2C Third-Party Integrations-Tenable

  • Tenable Use Case
  • Tenable Overview and Capabilities
  • Tenable Integration Prerequisites
  • Tenable Integration Configuration
  • Policy Design
  • Policy Enforcement
  • Enforcement Verification

Section 14: C2C Third-Party Integrations-MECM

  • MECM Use Case
  • MECM Overview and Capabilities
  • MECM Integration Prerequisites
  • MECM Integration Configuration
  • Policy Design
  • Policy Enforcement
  • Enforcement Verification

Section 15: C2C Third-Party Integrations-Trellix

  • Trellix Use Case
  • Trellix Overview and Capabilities
  • Trellix Integration Prerequisites
  • Trellix Integration Configuration
  • Policy Enforcement
  • Enforcement Verification

Section 16: Troubleshooting Cisco ISE Policy and Third-Party NAD

  • Cisco ISE Third-Party Network Access Device Support
  • Troubleshooting Cisco ISE Policy Configuration

Section 17: Exploring Cisco TrustSec

  • Cisco TrustSec Overview
  • Cisco TrustSec Enhancements
  • Cisco TrustSec Configuration

Section 18: Working with Network Access Devices

  • Reviewing AAA
  • Cisco ISE TACACS+ Device Administration
  • Configuring TACACS+ Device Administration
  • TACACS+ Device Administration Guidelines and Best Practices

 

Course Prerequisites: 

There are no prerequisites for this training. However, the knowledge and skills you are recommended to have before attending this training are:

  • Familiarity with 802.1X
  • Familiarity with Microsoft Windows Operating Systems
  • Familiarity with Cisco IOS CLI for wired and wireless network devices
  • Familiarity with Cisco Identity Service Engine

TN-305: Designing, Implementing, Administering and Securing Wireless Local Area Networks (LANs)

Course Overview:

This course, TN-305: Designing, Implementing, Administering and Securing Wireless Local Area Networks (LANs), covers the two main objectives for those entering the wireless world, understanding the technology & addressing its security.  TN-305: Designing, Implementing, Administering and Securing Wireless Local Area Networks (LANs) takes advantage of the student’s existing expertise to provide a challenging introductory course. Covering a broad range of wireless networking topics & an introduction on how to secure a wireless LAN from hackers. To insure wireless availability you need to understand proper design choices & administration practices. To protect valuable information on your network you need to know how attacks occur & techniques used to secure your wireless network.

Attendees to TN-305: Designing, Implementing, Administering and Securing Wireless Local Area Networks (LANs) will receive TechNow approved course materials and expert instruction.

Dates/Locations:

No Events

Duration: 5 Days

Course Objectives:

  • Radio Frequency (RF) Fundamentals
  • Spread Spectrum Technologies
  • 802.11 Network Architecture
  • Physical & MAC Layers
  • Hardware Installation, Configuration, & Management
  • Antennas & Accessories
  • Wireless Network Management
  • Troubleshooting Wireless LANs
  • Site Surveying
  • Wireless LAN Security
  • Organizations & Standards

Prerequisites:

Attendees should have network administration skills.  These skills can be obtained through TechNow’s N-205 & N-305: CCNA/ICND Training program or our highly respected cross platform TN-385: TCP/IP Analysis & Implementation course.

Comments

Latest comments from students

User: TMPRIESTLEY

Instructor comments: The instructor was very well versed on the topic and knew how to apply it to real-life examples. He led the labs and was very excited about the topic which kept the interest of myself and other class members. Sometimes his volume level was a little high- however the room the class was in was very small. Too small for a big personality!

Facilities comments: I was unaware of the facility changes, but that was at no fault of anyone since I was a drop-in for the course. They were very helpful and quick to mediate the issue.

Liked the class?  Then let everyone know!