TN-911: Cyber Threat Intelligence (CTI) Analysis and 800-172 Seminar

Course Overview:

TechNow’s TN-911: Cyber Threat Intelligence (CTI) Analysis and 800-172 Updates Seminar, is a one day seminar that covers the objectives of TechNow’s TN-905: Cyber Threat Intelligence Analysis five day course in a one day seminar format plus some other security enhancements of 800-172. Upon request, this seminar can be presented in multi-day format based upon the depth of knowledge required. The NIST PUB 800-172 security enhancement update to 800-171 regarding 03.11.1 Risk Assessment, introduces the security enhancements of a Threat Awareness Program, Threat Hunting, and Predictive Cyber Analytics. TN-911 distills the TN-905 CTI five day course and aligns it to assessing compliance with 800-172. For the seminar, selected course labs are converted to demos, and the important points and outcomes of topics are presented. The TN-911 CTI Seminar discusses the applicability of the 800-172 security enhancements to the organization being assessed, and how to think about the the appropriate strength of the controls related to the organizations criticality of the information and the risk involved for contracted work with the DoD.

TechNow’s TN-911: Cyber Threat Intelligence Analysis Seminar addresses significant changes that have been made to SP 800-172 in transitioning to Revision 3, regarding new enhanced security requirements based on (1) the latest threat intelligence and (2) empirical data from cyber-attacks. With the intent of addressing CUI that may be associated with a critical program or a high value asset.

Those programs and assets are potential targets for advanced persistent threat (APT). Cyber Threat Intelligence supports the required functions of NIST 800-172 of Penetration Resistant Architecture (PRA), Damage Limiting Operations (DLO) and Cyber Resiliency (CRS).

Regarding 800-172 This seminar includes:

3.2.1E Awareness Training (rev 3 – Advanced Literacy and Awareness Training)
3.11.6E Supply Chain Risk Management SCRM (rev 3 withdrawn, moved to other controls)
3.11.7E SCRM Planning (rev 3 withdrawn, moved to other controls)
3.12.1E Penetration Testing
800-172, 3.11 Risk Assessment
- 03.11.01E Threat Awareness Program
- 03.11.02E Threat Hunting
- 03.11.03E Predictive Cyber Analytics.

TN-911 CTI Seminar directly discusses 3.11 topics:

03.11.01E Threat Awareness Program:

Share threat information, including threat events of 03.11.01E is specifically covered as:

Create Indicators of Compromise (IOCs) using STIX
Understand a solution for collecting, storing, distributing and sharing cyber security indicators and threats about cyber security incidents analysis and malware analysis.
How to assess an environment to validate:
- Support for day-to-day operations to share structured threat information efficiently.
- Confirming the presence of curated, frequently updated feeds, and the automation of enrichment workflow
- Contextualization of intelligence with internal data to prioritize alerts and improve detection
- Updated threat hunting based upon inbound Threat Intelligence

03.11.02E Threat Hunting:

Introduction to Threat Hunting practices to effectively search for indicators of compromise and to detect, track, and disrupt threats that evade existing controls.

How to assess an environment to validate:
A formalized process is being followed for Threat Hunting
- Phases of trigger (incident or CTI), SIEM utilization, and response
Integration of machine learning to provide proactive, automated, and scalable Threat Hunting
Leveraging threat intelligence for proactive threat hunting by querying historical logs for indicators of compromise (IOCs) from feeds to identify:
Dormant threats
Advance Persistent Threats (APT)

03.11.03E Predictive Cyber Analytics

Introduction leveraging data, machine learning, and real-time analysis with automation to anticipate threats before they occur.

How to assess an environment to validate:
- Data aggregation from network logs, user activities, system logs, and external threat intelligence feeds into a centralized platform like a SIEM
Use of machine learning algorithms to identify patterns, uncover correlations, and spot anomalies in real-time
Integration with incident response workflows
Staff skill competency level and integration into Predictive Cyber Analytics to mitigate advanced adversarial techniques against machine learning such as:
- Attacks of Evasion, Poisoning, and Model Tampering
- Utilization of exercises or Red Teaming to validate practices and effectiveness of Predictive Cyber Analytics.

3.2.1E Awareness Training (rev 3 – Advanced Literacy and Awareness Training)

Validate that training addresses APT

3.11.6E Supply Chain Risk Management SCRM (rev 3 withdrawn, moved to other controls)

Validate cybersecurity supply chain risk management C-SCRM:

Cross-functional team responsible for supply chain risk management (SCRM) and C-SCRM
Validating standard risk management with respect to supply chain
- FARM (Frame, Assess, Respond, and Monitor)
- Tasks outlined in NIST Pub 800-161

3.11.7E SCRM Planning (rev 3 withdrawn, moved to other controls)

This is discussed in topic 3.11.6E

3.12.1E Penetration Testing

Validate the organization is progressing through standardized Penetration Testing Protocols.

Evaluate Penetration Test reports for completeness and scope.

Attendees to TN-911: Cyber Threat Intelligence (CTI) Analysis and 800-172 Seminar will receive TechNow approved course materials and expert instruction.

Seminar Duration: 1 day (more upon request)

Seminar Objectives:

Learn to comprehend and develop complex scenarios
Identify and create intelligence requirements through practices such as threat modeling
Utilize threat modeling to drive intelligence handling and practices
Breakdown tactical, operational, and strategic-level threat intelligence
Generate threat intelligence to detect, respond to, and defeat focused and targeted threats
How to collect adversary information creating better value CTI
How to filter and qualify external sources, mitigating low integrity intelligence
Create Indicators of Compromise (IOCs) in STIX
Move security maturity past IOCs into understanding and countering the behavioral tradecraft of threats
Breaking down threats mapped against their tradecraft to tweak IOCs
Establish structured analytical techniques to be successful in any security role
Learn and apply structured principles in support of CTI and how to communicate that to any security role.

Seminar Prerequisites:

Security+, or equivalent experience

CT-395: CySA+ Cybersecurity Analyst

Course Overview:

CT-395: CompTIA CySA+ Cybersecurity Analyst is for IT professionals looking to gain IT security analyst skills, and for those following the recommended skills pathway to achieve cybersecurity mastery. It provides a bridge between CompTIA Security+ (CT-325) and CompTIA Advanced Security Practitioner (CASP,CT-425), thus completing a certification path within the CompTIA family of certifications. As attackers have learned to evade traditional signature-based solutions, an analytics-based approach has become extremely important. CySA+ applies behavioral analytics to the IT security market to improve the overall state of security. The CompTIA Cybersecurity Analyst (CySA+) certification verifies that successful candidates have the knowledge and skills required to configure and use threat detection tools, perform data analysis and interpret the results to identify vulnerabilities, threats and risks to an organization, with the end goal of securing and protecting applications and systems within an organization. Let us help you bridge this gap, and leave you prepared for the certification exam (CS0-002).

TechNow is a CompTIA partner uses official CompTIA CySA+ curriculum.

Dates/Locations:

Date/Time	Event
09/08/2025 - 09/12/2025 08:00 -16:00	CT-395: CySA+ Cybersecurity Analyst TechNow, Inc, San Antonio TX
12/01/2025 - 12/05/2025 08:00 -16:00	CT-395: CySA+ Cybersecurity Analyst TechNow, Inc, San Antonio TX

Duration: 5 Days

Course Objectives:

Threat Management
Vulnerability Management
Cyber Incident Response
Security Architecture and Tool Sets

Prerequisites:

While there is no required prerequisite, the CompTIA CySA+ certification is intended to follow CT-325: Security+ or equivalent experience. It is recommended for CompTIA CySA+ candidates to have the following:

3-4 years of hands-on information security or related experience
Network+, Security+, or equivalent knowledge.

Comments

Latest comments from students

Liked the class? Then let everyone know!

TN-825: Certified Information Security Manager (CISM) Seminar

Course Overview:

The Certified Information Security Manager (CISM) certification program is developed specifically for experienced information security managers & those who have information security management responsibilities. The CISM certification is for the individual who manages, designs, oversees and/or assesses an enterprise’s information security (IS). The CISM certification promotes international practices & provides executive management with assurance that those earning the designation have the required experience & knowledge to provide effective security management & consulting services. Individuals earning the CISM certification become part of an elite peer network, attaining a one-of-a-kind credential. The CISM job practice also defines a global job description for the information security manager & a method to measure existing staff or compare prospective new hires.

This course is designed to assist in your exam preparation for the CISM exam.

Attendees to TN-825: Certified Information Security Manager (CISM) Seminar will receive TechNow approved course materials and expert instruction.

Dates/Locations:

Date/Time	Event
11/17/2025 - 11/21/2025 08:00 -16:00	TN-825: Certified Information Security Manager (CISM) Seminar TechNow, Inc, San Antonio TX

Duration: 5 Days

Course Objectives:

Information Security Governance (24%)
Establish and/or maintain an information security governance framework and supporting processes to ensure that the information security strategy is aligned with organizational goals and objectives
Information Risk Management (30%)
Manage information risk to an acceptable level based on risk appetite to meet organizational goals and objectives
Information Security Program Development and Management (27%)
Develop and maintain an information security program that identifies, manages and protects the organization’s assets while aligning to information security strategy and business goals, thereby supporting an effective security posture
Information Security Incident Management (19%)
Plan, establish and manage the capability to detect, investigate, respond to and recover from information security incidents to minimize business impact

Prerequisites:

A minimum of five years of information security work experience, with a minimum of three years of information security management work experience in three or more of the job practice analysis areas.

Comments

Latest comments from students

User: tracycampbell

Instructor comments: Dave had great command of the class and the flow of information. The lessons seem relevant to the exam and the course material should assist greatly with passing. As a bonus, his breakdown of PKI helped with my current job requirements.

Facilities comments: The Home2Suites by Hilton was FANTASTIC!

Liked the class? Then let everyone know!

CL-315: CCSP – Certified Cloud Security Professional Preparation Seminar

Course Overview:

TechNow’s CCSP Certification Preparation Seminar is an accelerated course designed to meet the high demands of the information security industry by preparing students for the industry standard Certified Cloud Security Professional exam. The exam covers (ISC)²’s 6 Domains from the Common Body of Knowledge, which encompass the whole of cloud security.

This course is an intense 5 day program. TechNow has a proven training and certification track record that you can depend on. CCSP test is 125 questions that typically require more comprehension than CISSP questions. The instructor takes time to walk through scenarios that assume comprehensive knowledge of enterprise infrastructures.

Attendees to CL-315: CCSP Certification Preparation Seminar will receive TechNow approved course materials and expert instruction.

The 6 domains of the CCSP CBK:

Architectural Concepts & Design Requirements
Cloud Data Security
Cloud Platform & Infrastructure Security
Cloud Application Security
Operations
Legal & Compliance

Duration: 5 days

Audience: Mid-level to advanced professionals involved with IT architecture, web and cloud security engineering, information security, governance, risk and compliance, and even IT auditing. CCSPs will be responsible for cloud security architecture, design, operations, and/or service orchestration.

DoD 8140: Not Mandated

Course Prerequisites: IT professional with 5 years of experience, 3 years of security experience, and at least 1 year of cloud security experience. GSEC, CISSP, CASP or equivalent experience in managing enterprise infrastructures. CCSP test is 125 questions that typically require more comprehension than CISSP questions. This course is for those who are already qualified at the enterprise level for IT infrastructures, have Cloud experience, and are looking for a Cloud Security certification.

Course Objectives:

Domain 1: Architectural Concepts and Design Requirements

Module 1: Understand cloud computing concepts
Module 2: Describe cloud reference architecture
Module 3: Understand security concepts relevant to cloud computing
Module 4: Understand design principles of secure cloud computing
Module 5: Identify trusted cloud services

Domain 2: Cloud Data Security

Module 1: Understand Cloud Data Life Cycle
Module 2: Design and Implement Cloud Data Storage Architectures
Module 3: Understand and implement Data Discovery and Classification Technologies
Module 4: Design and Implement Relevant Jurisdictional Data Protection for Personally Identifiable Information (PII)
Module 5: Design and implement Data Rights Management
Module 6: Plan and Implement Data Retention, Deletion, and Archival policies
Module 7: Design and Implement Auditability, Traceability, and Accountability of Data Events

Domain 3: Cloud Platform Infrastructure Security

Module 1: Comprehend Cloud Infrastructure Comp
Module 2: Analyze Risks Associated to Cloud Infrastructure
Module 3: Design and Plan Security Controls
Module 4: Plans Disaster Recovery & Business Continuity Management

Domain 4: Cloud Application Security

Module 1: Recognize Need for Training and Awareness in Application Security
Module 2: Understand Cloud Software Assurance and Validation
Module 3: Use Verified Secure Software
Module 4: Comprehend the Software Development Life Cycle (SDLC) Process
Module 5: Apply the Secure Software Development Life Cycle
Module 6: Comprehend the Specifics of Cloud Application Architecture
Module 7: Design Appropriate Identity and Access Management (IAM) Solutions

Domain 5: Operations

Module 1: Support the Planning Process for the Data Center Design
Module 2: Implement and Build Physical Infrastructure for Cloud Environment
Module 3: Run Physical Infrastructure for Cloud Environment
Module 4: Manage Physical Infrastructure for Cloud Environment
Module 5: Build Logical Infrastructure for Cloud Environment
Module 6: Run Logical Infrastructure for Cloud Environment
Module 7: Manage Logical Infrastructure for Cloud Environment
Module 8: Ensure Compliance with Regulations and Controls
Module 9: Conduct Risk Assessment to Logical and Physical Infrastructure
Module 10: Understand the Collection and Preservation of Digital Evidence
Module 11: Manage Communications with Relevant Parties

Domain 6: Legal and Compliance

Module 1: Understand Legal Requirements and Unique Risks Within the Cloud Environment
Module 2: Understand Privacy Issues, Including Jurisdictional Variances
Module 3: Understand Audit Process, Methodologies, and Required Adaptions for a Cloud Environment
Module 4: Understand Implication of Cloud to Enterprise Risk Management
Module 5: Understand Outsourcing and Cloud Contract Design
Module 6: Execute Vendor Management

Dates/Locations:

No Events

DoD 8570

DoD 8570 Training

The Department of Defense requires that all information assurance personnel must become compliant with IT and security certification standards.

DoD 8570 training, also called Information Assurance training, is available through TechNow to provide you with the certification that is required. Your DoD 8570 training ( information assurance training ) at TechNow will provide you with all of the courses necessary to receive your DoD 8570.01-M certification.

Ongoing open enrollment through TechNow is available for our DoD 8570.01-M courses.

Please review the full & updated DoD approved IA baseline certifications aligned to each category & level of the IA workforce.

For further information or to schedule for classes, call us at 800-324-2294