CertNexus Certified CyberSec First Responder (CFR-410)

Gain a broad view of how to respond to a cybersecurity incident while preparing for the CyberSec First Responder certification.

Description

Overview

This course covers network defense and incident response methods, tactics, and procedures that are in alignment with industry frameworks such as NIST 800-61r2 (Computer Security Incident Handling Guide), US-CERT's National Cyber Incident Response Plan (NCIRP), and Presidential Policy Directive (PPD)-41 on Cyber Incident Coordination, NIST 800.171r2 (Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations). It is ideal for candidates who have been tasked with the responsibility of monitoring and detecting security incidents in information systems and networks, and for executing standardized responses to such incidents. The course introduces tools, tactics, and procedures to manage cybersecurity risks, defend cybersecurity assets, identify various types of common threats, evaluate the organization's security, collect and analyze cybersecurity intelligence, and remediate and report incidents as they occur. This course provides a comprehensive methodology for individuals responsible for defending the cybersecurity of their organization. This course is designed to assist students in preparing for the CertNexus CyberSec First Responder (Exam CFR-410) certification examination. What you learn and practice in this course can be a significant part of your preparation. In addition, this course and subsequent certification (CFR-410) meet all requirements for personnel requiring DoD directive 8570.01-M position certification baselines:

  • CSSP Analyst
  • CSSP Infrastructure Support
  • CSSP Incident Responder
  • CSSP Auditor

Course Objectives

In this course, you will identify, assess, respond to, and protect against security threats and operate a system and network security analysis platform. You will:

  • Assess cybersecurity risks to the organization
  • Analyze the threat landscape
  • Analyze various reconnaissance threats to computing and network environments
  • Analyze various attacks on computing and network environments
  • Analyze various post-attack techniques
  • Assess the organization's security posture through auditing, vulnerability management, and penetration testing
  • Collect cybersecurity intelligence from various network-based and host-based sources
  • Analyze log data to reveal evidence of threats and incidents
  • Perform active asset and network analysis to detect incidents
  • Respond to cybersecurity incidents using containment, mitigation, and recovery tactics
  • Investigate cybersecurity incidents using forensic analysis techniques

Who Should Attend

This course is designed primarily for cybersecurity practitioners preparing for or who currently perform job functions related to protecting information systems by ensuring their availability, integrity, authentication, confidentiality, and non-repudiation. It is ideal for those roles within federal contracting companies and private sector firms whose mission or strategic objectives require the execution of Defensive Cyber Operations (DCO) or DoD Information Network (DoDIN) operation and incident handling. This course focuses on the knowledge, ability, and skills necessary to provide for the defense of those information systems in a cybersecurity context, including protection, detection, analysis, investigation, and response processes. In addition, the course ensures that all members of an IT team—regardless of size, rank, or budget— understand their role in the cyber defense, incident response, and incident handling process.

Course Outline

Lesson 1: Assessing Cybersecurity Risk

  • Identify the Importance of Risk Management
  • Assess Risk
  • Mitigate Risk
  • Integrate Documentation into Risk Management

Lesson 2: Analyzing the Threat Landscape

  • Classify Threats
  • Analyze Trends Affecting Security Posture

Lesson 3: Analyzing Reconnaissance Threats to Computing and Network Environments

  • Implement Threat Modeling
  • Assess the Impact of Reconnaissance
  • Assess the Impact of Social Engineering

Lesson 4:

  • Assess the Impact of System Hacking Attacks
  • Assess the Impact of Web-Based Attacks
  • Assess the Impact of Malware
  • Assess the Impact of Hijacking and Impersonation Attacks
  • Assess the Impact of DoS Incidents
  • Assess the Impact of Threats to Mobile Security
  • Assess the Impact of Threats to Cloud Security

Lesson 5: Analyzing Post-Attack Techniques

  • Assess Command and Control Techniques
  • Assess Persistence Techniques
  • Assess Lateral Movement and Pivoting Techniques
  • Assess Data Exfiltration Techniques
  • Assess Anti-Forensics Techniques

Lesson 6: Assessing the Organization's Security Posture

  • Implement Cybersecurity Auditing
  • Implement a Vulnerability Management Plan
  • Assess Vulnerabilities
  • Conduct Penetration Testing

Lesson 7: Collecting Cybersecurity Intelligence

  • Deploy a Security Intelligence Collection and Analysis Platform
  • Collect Data from Network-Based Intelligence Sources
  • Collect Data from Host-Based Intelligence Sources

Lesson 8: Analyzing Log Data

  • Use Common Tools to Analyze Logs
  • Use SIEM Tools for Analysis

Lesson 9: Performing Active Asset and Network Analysis

  • Analyze Incidents with Windows-Based Tools
  • Analyze Incidents with Linux-Based Tools
  • Analyze Indicators of Compromise

Lesson 10: Responding to Cybersecurity Incidents

  • Deploy an Incident Handling and Response Architecture
  • Mitigate Incidents
  • Hand Over Incident Information to a Forensic Investigation

Lesson 11: Investigating Cybersecurity Incidents

  • Apply a Forensic Investigation Plan
  • Securely Collect and Analyze Electronic Evidence
  • Follow Up on the Results of an Investigation

Prerequisites

To ensure your success in this course, you should meet the following requirements:

  • At least two years (recommended) of experience or education in computer network security technology or a related field.
  • The ability or curiosity to recognize information security vulnerabilities and threats in the context of risk management.
  • Foundational knowledge of the concepts and operational framework of common assurance safeguards in network environments. Safeguards include, but are not limited to, firewalls, intrusion prevention systems, and VPNs.
  • General knowledge of the concepts and operational framework of common assurance safeguards in computing environments. Safeguards include, but are not limited to, basic authentication and authorization, resource permissions, and anti-malware mechanisms.
  • Foundation-level skills with some of the common operating systems for computing environments.
  • Entry-level understanding of some of the common concepts for network environments, such as routing and switching.
  • General or practical knowledge of major TCP/IP networking protocols, including, but not limited to, TCP, IP, UDP, DNS, HTTP, ARP, ICMP, and DHCP.

Similar courses

This course was built to incorporate a unique, in-depth, and interactive hands-on environment and systematic process across each ethical hacking domain and methodology, giving you the opportunity to work towards proving the required knowledge and skills needed to achieve the CEH credential.

More Information

CompTIA A+ is the industry standard for launching IT careers into today’s digital world. CompTIA A+ Core 1 (Exam 220-1101) covers mobile devices, networking technology, hardware, virtualization, cloud computing and network troubleshooting.

More Information

The CCISO program is a first-of-its-kind training and certification course that aims to produce cybersecurity executives of the highest caliber and ethics.

More Information

The principles of Scrum and be able to identify Scrum-appropriate projects The various Scrum roles, ceremonies, and artifacts The responsibilities and the core competencies of an effective Scrum Master Best-practices on how to build and guide an effective Scrum team An understanding of user stories and techniques to prioritize and manage a product backlog Ways to communicate Scrum team progress throughout all levels of the organization Everything you need to know to pass the 50 question CSM test.

More Information

This course introduces tools and tactics to manage cybersecurity risks, identify various types of common threats, evaluate the organization's security, collect and analyze cybersecurity intelligence, and handle incidents as they occur.

More Information

This course will build on existing knowledge from the CompTIA A+ 1101 course. This course will provide fundamental level skills and theoretical concepts to prepare you for real-world experiences on the job as a technician. CompTIA A+ is the industry standard for launching IT careers into today’s digital world. CompTIA A+ Core 2 (Exam 220-1102) covers installing and configuring operating systems, expanded security, software troubleshooting and operational procedures.

More Information

This course was designed for people who work in a Security Operations job role and helps learners prepare for the exam SC-200: Microsoft Security Operations Analyst.

More Information

Certified Information Systems Auditor (CISA) Boot Camp is a five-day training focused on preparing you for the ISACA CISA exam. You’ll leave with the knowledge and domain expertise needed to pass the CISA exam the first time you take it.

More Information

CEH provides an in-depth understanding of ethical hacking phases, various attack vectors, and preventative countermeasures. This course was built to incorporate a unique, in-depth, and interactive hands-on environment and systematic process across each ethical hacking domain and methodology, giving you the opportunity to work towards proving the required knowledge and skills needed to achieve the CEH credential.

More Information

CompTIA Cloud+ is a global certification that validates the skills needed to deploy and automate secure cloud environments that support the high availability of business systems and data. It is ideal for cloud engineers who need to have expertise across multiple products and systems. CompTIA Cloud+ is the only cloud focused certification approved for DoD 8570.01-M, offering an infrastructure option for individuals who need to certify in IAM Level I, CSSP Analyst and CSSP Infrastructure Support roles.

More Information

CompTIA Security+ is a global certification that validates the foundational cybersecurity skills necessary to perform core security functions and pursue an IT security career. It establishes the core knowledge required of any cybersecurity role and provides a springboard to intermediate-level cybersecurity jobs. CompTIA Security+ is compliant with ISO 17024 standards and approved by the U.S. DoD to meet Directive 8140.03M requirements.

More Information

CompTIA Data+ is an early-career data analytics certification for professionals tasked with developing and promoting data-driven business decision-making that gives learners the confidence to bring data analysis to life.

More Information

This course shows you how to apply various approaches and algorithms to solve business problems through Artificial Intelligence (AI) and Machine Learning (ML), follow a methodical workflow to develop sound solutions, use open source, off-the-shelf tools to develop, test, and deploy those solutions, and ensure that they protect the privacy of users. This course includes hands on activities for each topic area.

More Information

Our Exam Cram sessions are intensive, focused review sessions designed to help your team master key concepts and pass their CompTIA certification exams with confidence. Led by expert instructors, these sessions provide in-depth, targeted hands-on practice to ensure your team is fully prepared for exam day. CompTIA A+ Core 1 covers mobile devices, networking technology, hardware, virtualization and cloud computing and network troubleshooting. This exam cram session is included with the A+ Core 1 course.

More Information

Our Exam Cram sessions are intensive, focused review sessions designed to help your team master key concepts and pass their CompTIA certification exams with confidence. Led by expert instructors, these sessions provide in-depth, targeted hands-on practice to ensure your team is fully prepared for exam day. CompTIA A+ Core 2 covers installing and configuring operating systems, expanded security, software troubleshooting and operational procedures. This exam cram session is included with the A+ Core 2 course.

More Information

CompTIA Network+ certification exam covers the latest trends in networking and validates the core skills necessary to establish, maintain, troubleshoot and secure networks in any environment, preparing learners for a rewarding career in networking and cybersecurity. Students gain a wide range of technical and hands-on skills required of today’s early-career network administrators. Network+ is Approved for DoD 8140.03.

More Information

Our Exam Cram sessions are intensive, focused review sessions designed to help your team master key concepts and pass their CompTIA certification exams with confidence. Led by expert instructors, these sessions provide in-depth, targeted hands-on practice to ensure your team is fully prepared for exam day. Network+ exam covers the core skills necessary to establish, maintain, troubleshoot and secure networks regardless of technology or platform. This exam cram session is included with the Network+ course.

More Information

Our Exam Cram sessions are intensive, focused review sessions designed to help your team master key concepts and pass their CompTIA certification exams with confidence. Led by expert instructors, these sessions provide in-depth, targeted hands-on practice to ensure your team is fully prepared for exam day. Security+ covers the most in-demand skills related to current threats, automation, zero trust, IoT, risk – and more. This exam cram session is included with the Security+ course.

More Information

Our Exam Cram sessions are intensive, focused review sessions designed to help your team master key concepts and pass their CompTIA certification exams with confidence. Led by expert instructors, these sessions provide in-depth, targeted hands-on practice to ensure your team is fully prepared for exam day. Cloud+ covers the expertise needed to deploy and automate secure cloud environments and protect mission-critical applications and data. This exam cram session is included with the Cloud+ course.

More Information

Our Exam Cram sessions are intensive, focused review sessions designed to help your team master key concepts and pass their CompTIA certification exams with confidence. Led by expert instructors, these sessions provide in-depth, targeted hands-on practice to ensure your team is fully prepared for exam day. Cloud+ covers mining and manipulating data, applying basic statistical methods, and analyzing complex datasets. This exam cram session is included with the Data+ course.

More Information

The Certified Information Systems Security Manager (C-ISSM) course covers the skills and knowledge to assess threat analysis & risks, risk & incident management, security programs & CISO roles, IS security strategy & frameworks, audit & risk management creation of policies, compliance & awareness, as well as DR & BCP development, deployment & maintenance. This course not only covers ISACA®'s CISM exam, but will provide a measurable certification that demonstrates proficiency in the IS Management field.

More Information

This scenario-based course focuses on computer security as an applied process across job roles and industries. The course also helps to prepare students for achieving the widely regarded Certified Information Systems Security Professional (CISSP) certification.

More Information

This course provides IT Security Professionals with the knowledge and skills needed to implement security controls, maintain an organization’s security posture, and identify and remediate security vulnerabilities. This course includes security for identity and access, platform protection, data and applications, and security operations.

More Information

The Microsoft Identity and Access Administrator course explores how to design, implement, and operate an organization’s identity and access management systems by using Microsoft Entra ID (Formerly Azure AD). Learn to manage tasks such as providing secure authentication and authorization access to enterprise applications. You will also learn to provide seamless experiences and self-service management capabilities for all users.

More Information

Learn how to protect information in your Microsoft 365 deployment. This course focuses on data governance and information protection within your organization. The course covers implementation of data loss prevention policies, sensitive information types, sensitivity labels, data retention policies and Office 365 message encryption among other related topics. The course helps learners prepare for the Microsoft Information Protection Administrator exam (SC-400).

More Information

The Cloud is being widely adopted today for a diverse set of reasons. However, many are finding that security in the cloud is a huge challenge. The C)CSO looks to fill the gap in cloud security education and give you the skills you need to develop strong cloud security.

More Information

The Certified Security Principles (C)SP) course is going to prepare you for security across the entire environment including understanding risk management, identity and access control, network and data security. This is just a short list of everything covered within this course, which will include new technologies like IoT and cloud services. This course is intended to prepare you to become a benefit to any company attempting to improve its security posture.

More Information

The Certified Cybersecurity Systems Auditor (C)CSSA) course covers the skills and knowledge to assess vulnerabilities, report on compliance and implement controls for private and public enterprises. Many organizations require a Cybersecurity System Auditor's expert knowledge when it comes to identifying critical issues and providing effective auditing solutions.

More Information

The CISSO addresses the broad range of industry best practices, knowledge and skills expected of a security manager/officer. You will learn in-depth theory pertaining to the practical implementation of core security concepts, practices, monitoring and compliance of IS management. Whether you’re responsible for the management of a Cybersecurity team, a Security Officer, an IT auditor or a Business Analyst, the C)ISSO certification course is an ideal way to increase your knowledge, expertise and skill.

More Information

A Certified Disaster Recovery Engineer (C)DRE) is the superhero of an Information System. Disaster recovery (DR) and business continuity planning (BCP) is the process of having a professional work with a business to prepare processes, policies, and procedures to follow in the event of a disruption. The C)DRE prepares students to plan and present the latest methodologies and best practices for real-world system recovery.

More Information

To protect an information system you need to be able to see that system through the eyes of the attacker. The Certified Professional Ethical Hacker certification course is the foundational training to a line of penetration testing courses because it teaches you to think like a hacker. Therefore, you can set up dynamic defenses to prevent intrusion.

More Information

A Certified Penetration Testing Engineer (C)PTE) imagines all of the ways that a hacker can penetrate a data system. In this course you will learn 5 Key Elements of Pen Testing, discover the latest vulnerabilities and the techniques malicious hackers are using to acquire and destroy data and learn more about the business skills needed to identify protection opportunities, justify testing activities and optimize security controls appropriate to the business needs in order to reduce business risk.

More Information

The Certified Secure Web Application Engineer (C)SWAE) course is delivered by high level OWASP experts and students can expect to obtain real world security knowledge that enables them to recognize vulnerabilities, exploit system weaknesses and help safeguard against application threats. You will learn how to develop web applications that aren't subject to common vulnerabilities, and how to test and validate that their applications are secure, reliable and resistant to attack.

More Information

The course focuses on common data engineering tasks such as orchestrating data transfer and transformation pipelines, working with data files in a data lake, creating and loading relational data warehouses, capturing and aggregating streams of real-time data, and tracking data assets and lineage.

More Information

This course teaches developers how to create applications using the SQL API and SDK for Azure Cosmos DB. Students will learn how to write efficient queries, create indexing policies, manage and provision resources, and perform common operations with the SDK.

More Information

In this course students will learn the various security, compliance, and identity concepts. After attending you will be able to describe the capabilities of Microsoft’s identity and access management solutions and Microsoft security and compliance solutions.

More Information