CT-415: CompTIA SecAI+

CompTIA SecAI+ is the first certification in CompTIA’s expansion series, designed to help you secure, govern and responsibly integrate artificial intelligence into your cybersecurity operations. You’ll build the skills to defend AI systems, meet global compliance expectations and use AI to enhance threat detection, automation and innovation—so you can strengthen your expertise and help keep your organization’s systems and data secure.

SecAI+ helps you build practical AI security and automation skills on top of your existing expertise, so you can secure AI deployments, use AI‑assisted security tools with confidence, and stay ready for the next step in your cybersecurity career.

Course Objectives:

  • Apply AI concepts to strengthen your organization’s cybersecurity posture
  • Secure AI systems using advanced controls and protections to safeguard data, models, and infrastructure
  • Leverage AI technologies to automate workflows, accelerate incident response, and scale security operations
  • Navigate global GRC frameworks to ensure ethical and compliant AI adoption across industries
  • Defend against AI-driven threats like adversarial attacks, automated malware, and malicious use of generative AI
  • Integrate AI securely into DevSecOps pipelines and enterprise security strategies.

Dates/Locations:

No Events

Prerequisites: Recommended experience: 3–4 years in IT and 2+ years hands-on cybersecurity; Security+, CySA+, PenTest+, or equivalent recommended

SecAI+ (V1) exam objectives summary

     Basic AI concepts related to cybersecurity (17%)

  • Explain core AI principles and terminology: Machine learning, deep learning, natural language processing, and automation.
  • Identify AI applications in security: Use cases for AI in threat detection, defense, and security operations. 
  • Recognize AI-driven threats: Automated phishing, polymorphic malware, adversarial machine learning, and malicious use of generative AI.

Securing AI systems (40%)

  • Implement security controls: Protect AI systems, data, and models using robust technical safeguards. 
  • Secure AI deployment environments: Apply best practices across on-premises, cloud, and hybrid infrastructures. 
  • Mitigate adversarial risks: Defend against attacks targeting AI models, data pipelines, and inference layers. 

AI-assisted security (24%)

  • Enhance detection and response: Use AI-driven tools to identify anomalies, detect threats, and accelerate incident remediation. 
  • Automate security workflows: Integrate AI for event triage, alert correlation, and response orchestration. 
  • Apply AI techniques in operations: Incorporate AI into threat modeling, behavior analysis, and continuous monitoring. 

AI governance, risk, and compliance (19%)

  • Understand regulatory frameworks: Identify global governance requirements and their implications for AI adoption. 
  • Integrate GRC into AI projects: Incorporate governance, risk management, and compliance practices throughout the AI lifecycle. 
  • Ensure responsible AI use: Apply ethical guidelines, legal standards, and industry frameworks such as GDPR and NIST AI RMF.

TN-855: Advanced and In-Depth ICD 503 RMF, Controls, and Assessments

Course Overview:

This course is very hands-on with respect to SP 800-53 controls as related to ICD-503, leveraging experience with DCD 6/3, and incorporating a broad array of technologies found in the field.  Assessors and Auditors have to face many technologies that are not part of the main stream.  TechNow has gone to great efforts to build a very broad, comprehensive, and complex lab to simulate many scenarios and architectures.  Technologies such as a network appliance that is not a typical infrastructure product, a radio/satellite communications device, or many other technologies that build up a weapon system.  Students learn how controls are integrated into many different devices and how they fit in the overall security architecture of monitoring, reporting, and compliance testing.

Directly discussed are overlays for different requirements i.e.: tactical, medical, network type: JWICS, SIPR; IC or AF.  TechNow has developed a funnel concept to overlays to exemplify the encapsulation of a control within different requirements.  TechNow has over 15 years experience in Trusted Solaris/Trusted Extensions and labeled security.  Cross Domain overlays are presented that fits the work flow of an assesor.  PII overlays and any overlays that an organization uses and can be made available are also presented.  

This course allows the student to leverage years of experience in DoD DCD 6/34 for transition to the Risk Management Framework (RMF) applied to the Intelligence Community as mandated by ICD 503.  Utilizing NIST SP 800-37 to establish a baseline of RMF knowledge, the student learns how to integrate the NIST pubs to provide cohesive information assurance architectures and compliance.  ICD 503 scorecard evaluations are integral in demonstrating a successful ICD 503 compliance program.  TechNow's ICD 503 course provides students with the skill to assess security programs and evaluate ICD 503 compliance to build an improvement and sustainable program for score consistency.  TechNow's instructors have unparralleled expertise in federal compliance initiatives, and we bring this expertise instructing students on the complete life cycle of RMF.

More than a simple checklist, we instruct students not only how to validate essential security controls, programs, and metrics, but that they are operating effectively.  The student leaves the course knowing how to: identify gaps where controls, programs, or metrics are incomplete, missing or ineffective, and provide actionable findings and recommend remediation strategies.  Students learn to internalize NIST pubs to meaningul and effective IA guidelines and work with the Body of Evidence templates which include: Risk Assessment Report (RAR), Systems Security Plan (SSP), Security Assessment Report (SAR), and Plans of Action and Milestone (POAM).

TechNow training materials are aligned with the most recent set of National Institute of Standards and Technology (NIST), Committee on National Security Systems (CNSS), and Office of the Director of National Intelligence (ODNI) policies standards, processes, policies and instructions to be addressed/explained include ICD 503, ICS 503-1, ICS 500-16, ICS 500-18, ICS 500-27, ICD 502, NIST SP 800-37, NIST SP 800-30, NIST SP 800-53, NIST SP 800-53A, NIST SP 800-137, NIST SP 800-47, CNSSP 22, CNSSI 1253, and CNSSI 4009.

A majority of time is spent on in-depth compliance review of NIST SP 800-53 controls.  Instruction discusses which method should be used to test and validate each security control and what evidence should be gathered.  This course is not theory or death by power point.  Real scenarios are presented as exercises.  A complete live cyber range simulating the IC is utilized for hands-on labs for techniques of validating and documenting compliance of NIST SP 800-53 controls as related to ICD 503.

Date/Locations:

No Events

Duration: 5 days

Course Objectives:

  • Establish a baseline of RMF knowledge
  • Validate essential security controls, programs, and metrics
  • DoD DCD 6/3 to ICD 503 Transition
  • Lab Environtment and the Cyber Range
  • Overlays: Tactical, Medical, Network type(JWICS, SIPR; IC or AF), Cross Domain, PII
  • Risk Assessment Report (RAR)
  • Systems Security Plan (SSP)
  • Security Assessment Report (SAR)
  • Plans of Action and Milestone (POAM)

Prerequisites:

Experience in the field of auditing and assesments.

Comments

Latest comments from students

Liked the class?  Then let everyone know!

DO-375: Automation with Ansible and Ansible Tower

 

Course Overview:

Through hands-on labs, you will learn to automate system administration tasks on managed hosts with Ansible, learn how to write Ansible playbooks to standardize task execution, and manage encryption for Ansible with Ansible Vault. This course will also teach you how to deploy and use Red Hat® Ansible Tower to centrally manage existing Ansible projects, playbooks, and roles; perform basic maintenance and administration of the Ansible Tower installation; and configure users and teams and use them to control access to systems, projects, and other resources through role-based access controls. You will learn to use Ansible Tower’s visual dashboard to launch, control, and monitor Ansible jobs; use the Ansible Tower application programming interface (API) to launch jobs from existing templates; automatically schedule Ansible jobs; and dynamically update host inventories.

Course Objectives:

  • Install and troubleshoot Ansible on central nodes and managed hosts
  • Automate administration tasks with Ansible playbooks and ad hoc commands
  • Write effective Ansible playbooks
  • Protect sensitive data used by tasks with Ansible Vault.
  • Install and configure Ansible Tower for enterprise Ansible management
  • Use Ansible Tower to control access to inventories and machine credentials by users and teams
  • Create job templates in Ansible Tower to standardize playbook execution.
  • Centrally launch playbooks and monitor and review job results with Ansible Tower

 

Course Outline:

  • Introduce Ansible
  • Deploy Ansible
  • Implement playbooks
  • Manage variables and inclusions
  • Implement task control
  • Implement Jinja2 templates
  • Implement roles
  • Configure complex playbooks
  • Implement Ansible Vault
  • Troubleshoot Ansible
  • Install Ansible Tower and describe Ansible Tower’s architecture
  • Create users and teams for role-based access control
  • Create and manage inventories and credentials
  • Manage projects for provisioning with Ansible Tower
  • Construct advanced job workflows
  • Update inventories dynamically and compare inventory members
  • Maintenance and administration of Ansible Tower

 
Dates/Locations:

No Events

Duration: 5 Days

Prerequisites:

  • Become a Red Hat Certified System Administrator, or demonstrate equivalent experience

Target Audience:

This course is designed for Linux system administrators, cloud administrators, and network administrators needing to automate configuration management, application deployment, and intraservice orchestration at an enterprise scale.

TN-535: Certified Forensic Computer Examiner (CFCE)

CCFE Core Competencies

  • Procedures and Legal Issues
  • Computer Fundamentals
  • Partitioning Schemes
  • Data Recovery
  • Windows File Systems
  • Windows Artifacts
  • Report writing (Presentation of Finding)
  • Procedures and Legal issues
  1. Knowledge of search and subjection and rules for evidence as applicable to computer forensics.
  2. Ability to explain the on-scene action taken for evidence preservation.
  3. Ability to maintain and document an environment consolidating the computer forensics.
  • Computer Fundamentals
  1. Understand BIOS
  2. Computer hardware
  3. Understanding of numbering system (Binary, hexadecimal, bits, bytes).
  4. Knowledge of sectors, clusters, files.
  5. Understanding of logical and physical files.
  6. Understanding of logical and physical drives.
  • Partitioning schemes
  1. Identification of current partitioning schemes.
  2. Understanding of primary and extended partition.
  3. Knowledge of partitioning schemes and structures and system used by it.
  4. Knowledge of GUID and its application.
  • Windows file system
  1. Understanding of concepts of files.
  2. Understanding of FAT tables, root directory, subdirectory along with how they store data.
  3. Identification, examination, analyzation of NTFS master file table.
  4. Understanding of $MFT structure and how they store data.
  5. Understanding of Standard information, Filename, and data attributes.
  • Data Recovery
  1. Ability to validate forensic hardware, software, examination procedures.
  2. Email headers understanding.
  3. Ability to generate and validate forensically sterile media.
  4. Ability to generate and validate a forensic image of media.
  5. Understand hashing and hash sets.
  6. Understand file headers.
  7. Ability to extract file metadata from common file types.
  8. Understanding of file fragmentation.
  9. Ability to extract component files from compound files.
  10. Knowledge of encrypted files and strategies for recovery.
  11. Knowledge of Internet browser artifacts.
  12. Knowledge of search strategies for examining electronic
  • Windows Artifacts
  1. Understanding the purpose and structure of component files that create the windows registry.
  2. Identify and capability to extract the relevant data from the dead registry.
  3. Understand the importance of restore points and volume shadow copy services.
  4. Knowledge of the locations of common Windows artifacts.
  5. Ability to analyze recycle bin.
  6. Ability to analyze link files.
  7. Analyzing of logs
  8. Extract and view windows logs
  9. Ability to locate, mount and examine VHD files.
  10. Understand the Windows swap and hibernation files.
  • Report Writing (Presentation of findings)
  1. Ability to conclude things strongly based on examination observations.
  2. Able to report findings using industry standard technically accurate terminologies.
  3. Ability to explain the complex things in simple and easy terms so that non-technical people can understand clearly.
  4. Be able to consider legal boundaries when undertaking a forensic examination

Palo Alto Networks Firewall Training Course Lab

Working with the TechNow lab for the PA-215: Palo Alto Networks Firewall Essentials FastTrack course has been nothing less than a techie's idea of fun.  When students come in we are immediatly configuring the Cisco 3750 switches for access ports, VLANS, and trunks.  We then cable the switch to the Palo Alto Networks Firewall.  Each student gets their own Palo Alto Firewall Pod of hardware and software.  What we find as fun is the VLAN environment, with an array of virtual machines hosted on an ESXi server that can really exercise the abilities of the Palo Alto Firewall.  The DMZ VLAN hosts virtual machines that support enterprise services and also potentialy vulnerable web services.  The Trust VLAN has Windows and Linux clients.  The UnTrust VLAN has Web services and a VM of Kali. The hardware Firewall is additionally connected to a Management VLAN.  All those VLANs are trunked into an ESXi server where the student also has a VM-Series Palo Alto Networks Firewall for High Availability.  

After configuring all the trunking, VLANs, and network interfaces we learn about the firewall and configure it for the lab environment.  Using Metasploitable and Kali/Metasploit nefarious penetration attempts are executed.  Using packet captures, custom APP-ID's  and custom signatures are generated.  Custom logging and reporting are created to similate and enterprise and assist the desired Incident Response.  It is always fun in a training environment to learn all about the controls available in a product, even though specific controls may not be used in the operational environment.  In the end we have a good understanding of the Palo Alto Networks Firewall.