This course is designed for professionals that are expected to do malware analysis. A skills focus enables the student to better absorb the subject matter and perform successfully on the job. This is not death by power point. The course is aligned with information assurance operators and executing hands-on labs. Lecture and labs walk the student through the knowledge required to truly understand the mechanics Reverse Engineering Malware.
Attendees to TN-999: Reverse Engineering Malware will receive TechNow approved course materials and expert instruction.
Date/Locations:
No Events
Duration: 5 days
Course Objectives:
Toolkit and Lab Assembly
Malware Code and Behavioral Analysis Fundamentals
Malicious Static and Dynamic Code Analysis
Collecting/Probing System and Network Activities
Analysis of Malicious Document Files
Analyzing Protected Executables
Analyzing Web-Based Malware
DLL Construction and API Hooking
Common Windows Malware Characteristics in x86 Assembly
Unpacking Protected Malware
In-Depth Analysis of Malicious Browser Scripts, Flash Programs and Office
In-Depth Analysis of Malicious Executables
Windows x86 Assembly Code Concepts for Revers-Engineering Memory Forensics for Rootkit Analysis
Prerequisites:
Strong understanding of core systems and network concepts
Exposure to programming and assembly concepts
Comfortable with command line access
Comments
Latest comments from students
User: marcus.osullivan
Instructor comments: Good stuff. I like the beginning half where there was help from an additional instructor to facilitate fixing computer errors that inevitably popped up.
Facilities comments: The baby deer were neat! I like the resort.
This course explores the VMware Infrastructure and related security, which consists of VMware ESX Server & VMware Virtual Center Server. We will look at both the design environments and operational processes of the VMware Infrastructure including security. This course provides IT architects with the insight needed to tackle tough issues in server virtualization such as virtual machine technologies, storage infrastructure, and designing clustered environments with security practices included. Extensive hands-on labs provide for a rich student experience.
Hypervisors and their supporting environment require attention to security due to the aggregated risk of hosting multiple virtual servers. This course explores the security of virtualized environments. Student configure ESXi by learning to manage the security and risk between ESXi, virtual servers and security integration of ESXi to the physical network infrastructure including appropriate segregation from other sensitive networks and management networks. How to configure virtual networks when some hosts are dual or multi homed, but internally segregate between the two or more connected networks with different security levels. Appropriate integration of zero-clients and thin clients. Configuration of defensive measures on hosts, servers, hypervisors within the virtual environment and practices for those guarding it externally. Integration of Active Directory and other AAA/CIA related services relative to a virtualized environment.
Students are also walked through DoD ESXi Security Technical Implementation Guide (STIG). Introduction to the impact of Intel Trusted Execution Technology integrated with ESXi to create a trusted platform for virtual machines. Additionally the instructor walks the students through NIST Special Publication 800-125A: Security Recommendations for Hypervisor Deployment on Servers, and NIST Special Publication 800-125B: Secure Virtual Network Configuration for Virtual Machine (VM) Protection.
Attendees to “VM-345: VMware Infrastructure Security: VMware Install, Configure, and Manage with Security Objectives” will receive TechNow approved course materials and expert instruction.
Dates/Locations:
No Events
Duration: 5 Days
Course Objectives:
• Virtual Infrastructure Overview
• ESX and ESXi Server Installation
• Configuration of Networking, Scalability and Security
• Storage
• Install and Configure vCenter Server and Components
• Creation, Deployment, Management, and Migration of Virtual Machines
• Utilize vCenter Server for Resource Management
• Utilize vCenter Server for Virtual Machine Access Control and User Managment
• Use vCenter Server to increase scalability
• Monitoring Your Environment
• Data & Availability Protection Troubleshooting
• Use VMware vCenter Update Manager to apply ESXi patches
• Use vCenter Server to manage vMotion, HA, DRS and data protection.
The UNIX Security Administrator Prep is a hands-on course that covers how to secure and audit UNIX and Linux operating systems. This includes concepts such as Rootkits, Buffer overflows, and monitoring UNIX/Linux systems.
Attendees to TN-959: Unix Security Administratorwill receive TechNow approved course materials and expert instruction.
Date/Locations:
No Events
Duration: 5 days
Course Objectives:
AIDE
Apache
Best Practices for Kernel Tuning and Warning Banners
Boot Services
Chroot()
DNS- BIND
DNSSec
Evidence Collection and Preservation
Forensic Analysis
Forensic Preparation and Incident Handling
Host Based Firewalls – iptables
Intro to Forensics
OS Install and Patching
Physical, User Account, and Password Access Control
AWS System Operations begins with a one day introduction to AWS products, services, and common solutions. It provides you with fundamentals to become more proficient in identifying AWS services so that you can make informed decisions about IT solutions based on your business requirements and get started working on AWS.
The AWS course continues to flow with teaching those in a Systems Administrator or Developer Operations (DevOps) role how to create automatable and repeatable deployments of networks and systems on the AWS platform. The course covers the specific AWS features and tools related to configuration and deployment, as well as common techniques used throughout the industry for configuring and deploying systems.
To continue to learn more about AWS, TechNow has the following course:
Attendees to CL-415: AWS System Operations will receive TechNow approved course materials and expert instruction.
Duration: 5 Days
Audience:
This course is intended for:
• System Administrators
• Software Developers, especially those in a Developer Operations (DevOps) role
DoD 8140: Not Mandated
Course Prerequisites:
We recommend that attendees of this course have the following prerequisites:
• Background in either software development or systems administration
• Some experience with maintaining operating systems at the command line (shell scripting in Linux environments, cmd or PowerShell in Windows)
• Basic knowledge of networking protocols (TCP/IP, HTTP)
Course Objectives:
This course is designed to teach you how to:
• Understand basic data center design concepts.
• Recognize terminology and concepts as they relate to the AWS platform and navigate the AWS Management Console.
• Understand the foundational infrastructure services, including Amazon Virtual Private Cloud (VPC), Amazon Elastic Compute Cloud (EC2), Amazon Elastic Block Store (EBS), Amazon Simple Storage Service (S3), Auto Scaling, and Elastic Load Balancing (ELB).
• Understand the security measures AWS provides and key concepts of AWS Identity and Access Management (IAM).
• Understand AWS database services, including Amazon DynamoDB and Amazon Relational Database Service (RDS).
• Understand AWS management tools, including Amazon CloudWatch and AWS Trusted Advisor.
• Use standard AWS infrastructure features such as Amazon Virtual Private Cloud (VPC), Amazon Elastic Compute Cloud (EC2), Elastic Load Balancing, and Auto Scaling from the command line
• Use AWS CloudFormation and other automation technologies to produce stacks of AWS resources that can be deployed in an automated, repeatable fashion
• Build functioning virtual private networks with Amazon VPC from the ground up using the AWS Management Console
• Deploy Amazon EC2 instances using command line calls and troubleshoot the most common problems with instances
• Monitor the health of Amazon EC2 instances and other AWS services
• Manage user identity, AWS permissions, and security in the cloud
• Manage resource consumption in an AWS account using tools such as Amazon CloudWatch, tagging, and Trusted Advisor
• Select and implement the best strategy for creating reusable Amazon EC2 instances
• Configure a set of Amazon EC2 instances that launch behind a load balancer, with the system scaling up and down in response to demand
• Edit and troubleshoot a basic AWS CloudFormation stack definition
Dates/Locations:
No Events
Course Outline:
Day 1
• Introduction and History of AWS
• AWS Infrastructure: Compute, Storage, and Networking
• AWS Security, Identity, and Access Management
• AWS Databases
• AWS Management Tools
Day 2
• System Operations on AWS Overview
• Networking in the Cloud
• Computing in the Cloud Day 3
• Storage and Archiving in the Cloud
• Monitoring in the Cloud
• Managing Resource Consumption in the Cloud Day 4
• Configuration Management in the Cloud
• Creating Scalable Deployments in the Cloud
• Creating Automated and Repeatable Deployments Day 5 Full Day Lab
• Select the appropriate AWS service based on compute, data, or security requirements
• Execute steps required to provision cloud resources for selected deployment
• Identify and implement data protection, encryption, and capacity planning
• Implement and manage security policies, access controls, and role
• Implement Automation
TN-542: Establishing a Security Operations Center (SOC) People, Processes, and Technologies is the big picture overview of a SOC, other courses provide a deep dive into the technologies that a SOC may utilize. This course addresses the internal workings of staff, skills required, required authorizations, internal agreements, and setting appropriate expectation levels of a SOC within budget constraints. A SOC is not a one size fits all, the instructor has decades of security experience and brings to the table opportunities to discuss what can work within constraints. Many organizations are coming to the realization that some level of a SOC is now required and to learn just what decisions need to be made: Out-sourced, In-sourced, budgets, capabilities and many more. Students leave with a worksheet of how to progress when they get back to their organization.
TN-542: Establishing a Security Operations Center (SOC) People, Processes, and Technologies – Is a course that incorporates lecture, demos, and group exercises for standing up a Security Operations Center (SOC). Students learn strategies and resources required to deploy, build, and run Network Security Monitoring (NSM) and work roles and flows for a SOC. No network is bullet proof and when attackers access your network, this course will show you options and resources to build a security net to detect, contain, and control the attacker. Examples on what it takes to architect an NSM solution to identify sophisticated attackers and a response strategy. Properly implemented detection and response technologies is integral to incident response and provides the responders timely information and tools to react to the incident. Effective demonstrations are given of Open Source technologies that build up a SOC, but any software can be used and demonstrations are provided to demonstrate technology families not push a specific solution.
TN-542: Establishing a Security Operations Center (SOC) People, Processes, and Technologies demonstrations utilize a cyber range that gives each student in-depth knowledge of monitoring live systems to include: Cisco, Windows, Linux, IoT, and Firewalls; and software and services to provide orchestrate Incident Response, Intelligence Analysis, and Hunt Operations.
Attendees to TN-542: Establishing a Security Operations Center (SOC) People, Processes, and Technologies class will receive TechNow approved course materials and expert instruction.
Dates/Locations:
No Events
Duration: 2 Days
Course Objective:
To provide management an overview of what it takes to stand up a SOC.
Prerequisites:
Students should have an understanding of the security field.
Course Outline:
What threats does my organization care about?
What does a threat look like?
What does a threat look like?
How to present the SOC internally.
Communication with Stakeholders and Executives
Leveraging and integrating existing security measures
People
Establishing a skill matrix and work roles for SOC members