TN-905: Cyber Threat Intelligence Analysis

 

Course Overview:

TechNow has worked worldwide enterprise infrastructures for over 30 years and has developed demos and labs to exemplify the techniques required to demonstrate technologies that effectively support CTI.  This course integrates well with our courses TN-575: Open Source Network Security Monitoring and TN-865: Wireshark Network Traffic and Security Analysis .

TechNow develops Cyber Ranges and makes them available for conferences in support of annual meetings for Cyber Threat Response Teams.  Developing scenarios and reacting to them appropriately is a big part of the value in understanding the contexts required to comprehend valuable CTI.   As with many advanced TechNow security courses, there is a large hands-on ratio.  This course helps Cyber Protection Teams (CPT), Defensive Cyber Operations (DCO), and Mission Defense Teams (MDT) to collect, analyze and apply targeted cyber intelligence to defensive operations in order to proactively act on and tune response to attacks by cyber adversaries.  CPT, DCO, and MDT can take preemptive action by utilizing CTI, understanding CTI tools, techniques and procedures (TTPs) needed to generate and consume timely and relevant intelligence to improve resilience and prevention.

This course focuses on the collection, classification, and exploitation of knowledge about adversaries and their TTPs. .  MDT puts us close the mission and helps define the internal context to be analyzed against the CTI.  TechNow pushes the student to truly understand how to think about and use CTI to make a difference.

Attendees to TN-905: Cyber Threat Intelligence Analysis will receive TechNow approved course materials and expert instruction.

Date/Locations:

No Events

Course Duration: 5 days

Course Objectives:

  • Learn to comprehend and develop complex scenarios
  • Identify and create intelligence requirements through practices such as threat modeling
  • Utilize threat modeling to drive intelligence handling and practices 
  • Breakdown tactical, operational, and strategic-level threat intelligence
  • Generate threat intelligence to detect, respond to, and defeat focused and targeted threats
  • How to collect adversary information creating better value CTI
  • How to filter and qualify external sources, mitigating low integrity intelligence
  • Create Indicators of Compromise (IOCs) in formats such as YARA, OpenIOC, and STIX
  • Move security maturity past IOCs into understanding and countering the behavioral tradecraft of threats
  • Breaking down threats mapped against their tradecraft to tweak IOCs
  • Establish structured analytical techniques to be successful in any security role
  • Learn and apply structured principles in support of CTI and how to communicate that to any security role.

Course Prerequisites:

Comments

Latest comments from students

 

Liked the class?  Then let everyone know!

PA-232: Palo Alto Networks Panorama Manage Multiple Firewalls (EDU-221)

  

 

Course Overview:  PA-232: Palo Alto Networks Panorama Manage Multiple Firewalls (EDU-221) Training Class is a two-day course.  Students attending this course will gain an in-depth knowledge of how to configure and manage their Palo Alto Networks Panorama Management Server.  Upon completion of this course, administrators will understand the Panorama server’s role in managing and securing their overall network.  Network professionals will learn to use Panorama’s aggregated reporting to provide them with a holistic view of a network of Palo Alto Networks next-generation firewalls.  This is not a virtualized theoretical course.  This is hands-on, real world instruction, directly relevant to the DoD and Commercial implementations of Palo Alto Networks next-generation firewalls.

Each student is issued a physical Palo Alto firewall and a Cisco layer 3 switch at their desk.  Real hardware per student for real experience and real skill development.

TechNow provides a very comprehensive client infrastructure that includes Windows, Linux, and multiple packet sniffer agents.  The instructor for this course has been a lead in Unix kernel development to implement firewall and intrusion detection technologies.  Additionally, the instructor has taught several security appliance products and carries several SANS, ISC2, ISACA, Cisco, Unix, and Windows certifications.

Attendees to the PA-232: Palo Alto Networks Panorama Manage Multiple Firewalls (EDU-221) Training Course will receive TechNow approved course materials and expert instruction.

 

Dates/Locations: No Events

Duration: 2 days

Course Objectives:   Students attending this foundational-level training course will gain an in-depth knowledge of how to configure and manage their Palo Alto Networks Panorama Management Server.

Day 1

  • Module 0 – Introduction & Overview
  • Mod 1: Overview
    • Panorama Solution
    • Deployment Design
  • Mod 2: Initial Configuration
    • Interface Configuration
    • Setup Configurations
    • Device Deployment
    • Configuration Management
  • Mod 3: Templates
    • Templates Overview
    • Common Organization
    • Strategies
    • Configuring Templates
  • Mod 4: Device Groups
    • Device Groups
    • Objects
    • Policies
    • Device Group Commit

 

Day 2

  • Mod 5: Administration
    • Admin Roles and Access
    • Control
    • Commit Procedure
  • Mod 6: Logging and
    • Reporting
    • Logging
    • Application Command
    • Center
    • App-Scope
    • Correlation Objects
    • Reports
  • Mod 7: Log Collectors
    • Plan a Log Collection
    • Deployment
    • Distributed Data Collection
    • Log Deployment
    • Configure Dedicated Log
    • Collector
    • Managed Collector Groups
  • Mod 8: Business Continuity
    • Panorama High Availability
    • Collector Group
    • Redundancy
    • Export Configuration
    • Disk Installation

 

Prerequisites:

This course is in no way associated with Palo Alto Networks, Inc.

Comments

Latest comments from students

Like the class?  Then let everyone know!

TN-939: Hacker Techniques, Exploits, and Incident Handling Course

Course Overview:

A skills focus enables the student to better absorb the subject matter and perform successfully on the exam.   This is not death by power point. The course is aligned with information assurance operators and executing hands-on labs. Lecture and labs walk the student through the knowledge required to truly understand the mechanics of the attacks and the effectiveness.  Students then gain network experience and use sniffing to help exemplify the benefit of learning wired and wireless security configurations. The course concludes with exercising real attack strategies to demonstrate the techniques acquired throughout the course.

Attendees to TN-939:  Hacker Techniques, Exploits, and Incident Handling will receive TechNow approved course materials and expert instruction.

Date/Locations:

No Events

Duration: 9 days

Course Objectives:

  • Backdoors & Trojan Horses
  • Buffer Overflows
  • Covering Tracks: Networks
  • Covering Tracks: Systems
  • Denial of Service Attacks
  • Exploiting Systems Using Netcat
  • Format String Attacks
  • Incident Handling Overview and Preparation
  • Incident Handling Phase 2: Identification
  • Incident Handling Phase 3: Containment
  • Incident Handling: Recovering and Improving Capabilities
  • IP Address Spoofing
  • Network Sniffing
  • Password Attacks
  • Reconnaissance
  • Rootkits
  • Scanning: Host Discovery
  • Scanning: Network and Application Vulnerability scanning and tools
  • Scanning: Network Devices (Firewall rules determination, fragmentation, and IDS/IPS evasion)
  • Scanning: Service Discovery
  • Session Hijacking, Tools and Defenses
  • Types of Incidents
  • Virtual Machine Attacks
  • Web Application Attacks
  • Worms, Bots & Bot-Nets

Prerequisites:

  • GSEC or equivalent experience
  • UNIX, Windows, Networking, and Security Experience
  • This is a hands-on skill course requiring comfort with command line interaction and network communications

Comments

Latest comments from students

User: m_jurrens

Instructor comments: Both instructors Mr. Askey and Mr. Hackney, were very good. the open learning environment was extremely productive and I felt we all learned far more that we ever would out of a structured rote memorization course.

User: natebonds

Instructor comments: Both Mr. Askey and Hackney were extremely knowledgeable. They were also extremely interested in helping each student learn. I was particularly impressed with the way they tailored the course to optimize our time since we weren't testing. I feel like I know much much more than I did when the class started.

Facilities comments: The facilities were fine. I would have preferred it be closer to Lackland.

Liked the class?  Then let everyone know!

TN-949: Certified Firewall Analyst Course

Course Overview:

This is a hands-on course that covers many of the concepts of securing the perimeter of an organization. This includes concepts such as intrusion detection, packet filtering, and central logging.

A skills focus enables the student to better absorb the subject matter and perform better on the job.   This is not death by power point. The course is aligned with information assurance operators and executing hands-on labs. Lecture and labs walk the student through the knowledge required to truly understand the mechanics of Firewalls.

This course is an excellent precursor to PA-215 Palo Alto Firewall Essentials FastTrack.

Attendees to TN-949: Certified Firewall Analyst Prep will receive TechNow approved course materials and expert instruction.

Date/Locations:

No Events

Duration: 5 days

Course Objectives:

  • Analyzing Network and Wireless Design
  • Creating and Auditing a Rulebase
  • Firewall Assessment and Penetration Testing
  • Host-Based Detection and DLP
  • Incident Detection and Analysis
  • IOS and Router Security
  • IPv6 and ICMPv6
  • Log Collection and Analysis
  • NAT and Proxies
  • Netfilter IPtables
  • Network Access Control
  • Network-Based Intrusion Detection
  • Packet Filters and Inspection
  • Packet Fragmentation
  • Perimeter Concepts and IP Fundamentals
  • Securing Hosts and Services
  • TCP/IP Protocols
  • VPN Design and Auditing
  • VPN Implementation

Course Prerequisites:

  • GSEC or equivalent experience
  • UNIX, Windows, networking and security  experience
  • This is a hands-on skill course requiring comfort with command line interaction and network communications

Comments

Latest comments from students

Liked the class?  Then let everyone know!

TN-979: Intrusion Analyst Course

Course Overview:

Intrusion Analyst is a hands-on course that covers intrusion detection in-depth. This includes concepts such as the use of Snort, network traffic analysis, and IDS signatures.

A skills focus enables the student to better absorb the subject matter and perform successfully on the job.   This is not death by power point. The course is aligned with information assurance operators and executing hands-on labs. Lecture and labs walk the student through the knowledge required to truly understand the mechanics of packet and intrusion analysis.

Attendees to TN-979: Intrusion Analyst will receive TechNow approved course materials and expert instruction.

Date/Locations:

No Events

Duration: 5 days

Course Objectives:

  • Advanced Snort Concepts
  • Analyst Toolkit
  • Domain Name System (DNS)
  • Examining Packet Crafting
  • Examining Packet Header Fields
  • Fragmentation
  • ICMP Theory
  • IDS Interoperability
  • IDS Patterns
  • IDS/IPS Management & Architecture Issues
  • Indications, Warnings & Traffic Correlation
  • IPv6
  • Microsoft Protocols
  • Network Traffic Analysis
  • NIDS Evasion, Instertion & Checksums
  • Snort Fundamentals & Configuration
  • Snort GUIs & Sensor Management
  • Snort Performance, Active Response & Tagging
  • Snort Rules
  • Stimulus Response
  • TCPdump Fundamentals
  • TCP/IP Fundamentals
  • Wireshark Fundamentals
  • Writing TCPdump Filters

Course Prerequisites:

  • GSEC or equivalent experience
  • UNIX, Windows, Networking, and Security Experience
  • This is a hands-on skill course requiring comfort with command line interaction and network communications

Comments

Latest comments from students

User: Tosha

Instructor comments: Dave was an excellent instructor. He is very informative and knowledgeable in the course and the material. I have enjoyed the class and I would take another course with him as the instructor.

Facilities comments: Very nice and clean hotel.

User: buckey26

Instructor comments: Dave was one of the best instructors I have ever had for a tech course. He broke down everything to the point where you can understand it internally.

Liked the class?  Then let everyone know!