Security Course Flow
Here is our list of security related courses.
Over twenty years experience in the area of Solaris, Linux, and Unix ensures that you are benefiting from a very mature and successful Solaris, Linux, and Unix training program. TechNow offers the full suite of Solaris, Linux, and Unix courses utilizing real hardware. This is not virtualized Solaris on Intel processors, or remote connection to a distant system. The student learns to deal with real hardware taking advantage of Sparc T series processors. Solaris 10 and Solaris 11 is taught hands-on with data center skills as the focus. We also offer Solaris 10 migration courses to Solaris 10 or Solaris 11.
The following is a list of our Unix/Linux training courses:
Course Overview:
What a great course that is slightly misnamed! This course may be labeled Security Essentials, but covers much of the subject matter of CISSP! This course does more than just cover the basics. TechNow takes the time to give the student hands on labs to exemplify an objective. Security Essentials Prep Training Course sets the foundation for your security career and sets the expectation of comprehension with more detail than Security+ and more on par with CISSP.
This course provides students skills to take courses that prepare for higher level certifications.
Attendees to TN-929: Security Essentials Training Course will receive TechNow approved course materials and expert instruction.
Date/Locations:
No Events
Duration: 9 days
Course Objectives:
- 802.11 Suite of Protocols
- Access Control Theory
- Alternate Network Mapping Techniques
- Authentication and Password Management
- Contingency Planning
- Crypto Concepts
- Crypto Fundamentals
- Defense-in-Depth
- DNS
- Firewall Subversion
- Firewalls
- HIDS Overview
- Honeypots
- ICMP
- IDS Overview
- Incident Handling Fundamentals
- Information Warfare
- Introduction to OPSEC
- IP Packets
- IPS Overview
- IPv6
- Legal Aspects of Incident Handling
- Linux/Unix Configuration Fundamentals
- Linux/Unix Logging and Log Management
- Linux/Unix OS Security Tools and Utilities
- Linux/Unix Overview
- Linux/Unix Patch Management
- Linux/Unix Process and Service Management
- Mitnick-Shimomura
- Network Addressing
- Network Design
- Network Hardware
- Network Mapping and Scanning
- Network Plumbing
- Network Protocol
- NIDS
- OverviewPhysical Security
- Policy Framework
- Protecting Data at Rest
- Public Key Infrastructure
- PKI
- Reading Packets
- Risk Management
- Safety Threats
- Securing Windows Server Services
- Steganography
- OverviewTCPUDP
- Virtual Machines
- Virtual Private Networks VPNs
- Viruses and Malicious Code
- VoIP
- Vulnerability Management Overview
- Vulnerability Scanning
- Web Application Security
- Windows Auditing
- Windows Automation and Configuration
- Windows Family of Products
- Windows Network Security Overview
- Windows Permissions & User Rights
- Windows Security Templates & Group Policy
- Windows Service Packs, Hotfixes and Backups
- Windows Workgroups, Active Directory and Group Policy Overview
- Wireless Overview
Prerequisites:
- Passed CompTIA Security+
Comments
Latest comments from students
User: sjsmith2262
Instructor comments: without question, Dave Askey knows his material!!! great instructor that gave a personalized approach.
Facilities comments: class was taught in a hotel reception area, very nice, quiet and convenient for all people
User: synistry
Instructor comments: Dave was great! (as always). Wealth of knowledge and a master at customizing course content to match the education level of his students. The class kept entirely in pace with where we were at as a group overall on a day to day basis.
Facilities comments: Facilities were overall really nice. The only complaint is that the hotel / conference center had us move rooms on one occasion, and kicked us out early on two others. I would assume this is due to the last minute location change, so I don't think there is anything anyone could have done better in the situation.
Liked the class? Then let everyone know!
Course Overview:
TN-575: Open Source Network Security Monitoring teaches students how to deploy, build, and run an NSM operation using open source software and vendor-neutral tools. No network is bullet proof and when attackers access your network, this course will show you how to build a security net to detect, contain, and control the attacker. Sensitive data can be monitored and deep packet and deep attachment analysis can be achieved. As organizations stand up a Security Operations Center (SOC) the enterprise NSM is the key ingredient to that SOC. This course not only teaches how to implement an NSM technologically, but how to effectively monitor an enterprise operationally. You will learn how to architect an NSM solution: where to deploy your NSM platforms and how to size them, stand-alone or distributed, and integration into packet analysis, interpret evidence, and integrate threat intelligence from external sources to identify sophisticated attackers. A properly implemented NSM is integral to incident response and provides the responders timely information to react to the incident. TN-575: Open Source Network Security Monitoring is a lab intensive environment with a cyber range that gives each student in-depth knowledge and practical experience monitoring live systems to include: Cisco, Windows, Linux, IoT, and Firewalls.
Attendees to TN-575: Open Source Network Security Monitoring class will receive TechNow approved course materials and expert instruction.
This Course is taught utilizing Security Onion or RockNSM as specified by the customer.
Dates/Locations:
No Events
Duration: 5 Days
Course Objective:
The focus of this course is to present a suite of Open Source security products integrated into a highly functional and scalable Network Security Monitoring solution.
Prerequisites:
Students should have a basic understanding of networks, TCP/IP and standard protocols such as DNS, HTTP, etc. Some Linux knowledge/experience is recommended, but not required
Course Outline:
- Network Security Monitoring (NSM) Methodology
- High Bandwidth Packet Capture Challenges
- Installation of Security Onion
- Use Cases (analysis, lab, stand-alone, distributed)
- Resource Requirements
- Configuration
- Setup Phase I – Network Configuration
- Setup Phase 2 – Service Configuration
- Evaluation Mode vs. Configuration Mode
- Verifying Services
- Security Onion Architecture
- Configuration Files and Folders
- Network Interfaces
- Docker Environment
- Security Onion Containers
- Overview of Security Onion Analyst Tools
- Kibana
- CapME
- CyberChef
- Squert
- Sguil
- NetworkMiner
- Quick Review of Wireshark and Packet Analysis
- Display and Capture Filters
- Analyze and Statistics Menu Options
- Analysis for Signatures
- Analyzing Alerts
- Replaying Traffic
- 3 Primary Interfaces:
- Squert
- Sguil
- Kibana
- Pivoting Between Interfaces
- Pivoting to Full Packet Capture
- Snort and Surricata
- Rule Syntax and Construction
- Implementing Custom Rules
- Implementing Whitelists and Blacklists
- Hunting
- Using Kibana to Slice and Dice Logs
- Hunting Workflow with Kibana
- Bro
- Introduction and Overview
- Architecture, Commands
- Understanding and Examining Bro Logs
- Using AWK, sort, uniq, and bro-cut
- Working with traces/PCAPs
- Bro Scripts Overview
- Loading and Using Scripts
- Bro Frameworks Overview
- Bro File Analysis Framework FAF
- Using Bro scripts to carve out more than files
- Introduction and Overview
- RockNSM ( * If Applicable)
- Kafka
- Installation and Configuration
- Kafka Messaging
- Brokers
- Integration with Bro and FSF
- File Scanning Framework FSF
- Custom YARA Signatures
- JSON Trees
- Sub-Object Recursion
- Bro and Suricata Integration
- Kafka
- Elastic Stack
- Adding new data sources in Logstash
- Enriching data with Logstash
- Automating with Elastalert
- Building new Kibana dashboards
- Production Deployment
- Advanced Setup
- Master vs Sensor
- Node Types – Master, Forward, Heavy, Storage
- Command Line Setup with sosetup.conf
- Architectural Recommendations
- Sensor Placement
- Hardening
- Administration
- Maintenance
- Tuning
- Using PulledPork to Disable Rules
- BPF’s to Filter Traffic
- Spinning up Additional Snort / Suricata / Bro Workers to Handle Higher Traffic Loads
Comments
Latest comments from students
Liked the class? Then let everyone know!
Course Overview:
This course delivers the technical knowledge, insight, and hands-on training to receive in-depth knowledge on Wireshark® and TCP/IP communications analysis. You will learn to use Wireshark to identify the most common causes of performance problems in TCP/IP communications. You will learn about the underlying theory of TCP/IP and the most used application protocols, so that you can intelligently examine network traffic for performance issues or possible Indicators of Compromise (IoC).
Duration: 5 Days
Audience:
Anyone interested in learning to troubleshoot and optimize TCP/IP networks and analyze network traffic with Wireshark, especially network engineers, information technology specialists, and security analysts.
Course Prerequisites:
We recommend that attendees of this course have the following prerequisite:
• Network+
Dates/Locations:
No Events
Course Outline:
DAY ONE
Course Set Up and Analyzer Testing
Network Analysis Overview
Wireshark Functionality Overview
Capturing Wired and Wireless Traffic
Define Global and Personal Preferences for Faster Analysis
Defined Time Values and Interpret Summaries
Interpret Basic Trace File Statistics to Identify Trends
Create and Apply Display Filters for Efficient Analysis
DAY TWO
Follow Streams and Reassemble Data
Use Wireshark’s Expert System to Identify Anomalies
TCP/IP Analysis Overview
Analyze Common TCP/IP Traffic Patterns
DAY THREE
Graph I/O Rates and TCP Trends
802.11 (WLAN) Analysis Fundamentals
Voice over IP (VoIP) Analysis Fundamentals
Network Forensics Fundamentals
DAY FOUR
Detect Scanning and Discovery Processes
Analyze Suspect Traffic
DAY FIVE
Use Command‐Line Tools