Blue teamer II dio

Cloud security module discusses the cloud basics. IT is important to understand that the cloud is evolving at the pace that cannot be followed by a normal computer user. Therefore, some “basic” cloud protection tools and services will be covered during this module, followed by the overview of the cloud basics and client/cloud service provider responsibilities. The big three (Amazon AWS, Microsoft Azure, and Google cloud) will be covered from the perspective of available tools and datacenter design, datacenter security, datacenter, and services compliance, on-prem to cloud migration security considerations and migration process itself for VMs, data, databases, and applications. Participants will also learn which tools exist to connect to the cloud securely, tools available to secure access to publicly facing resources, monitoring the cloud security, and additional security services. Theoretical part of this module concludes with the CSA (Cloud Security Alliance) and the options one has on hand to audit CSPs.
Labs are not provided directly in the class lab environment. Participants will use free and publicly available vendor labs during the training.

Network traffic and log analysis module introduces the tools one can use to capture and analyze the network traffic, such as Wireshark, tcpdump, network miner and zeek. It also introduces the various log types and defines the logs and their applicability in various processes including troubleshooting, system monitoring, incident handling, compliance and forensic analysis. Once, differentiation between local and centralized logging types is discussed, Windows, Linux, network devices and web server logs and tools will be covered.

SIEM and threat intelligence module will define the SIEM solutions and market leaders including paid versions like Splunk Enterprise, IBM QRadar, and Rapid7 InsightDR, and open source SIEM tools like OSSIM, ELK, SIEMonster, etc. Threat intelligence lifecycle and use cases and types will be defined in this module, including the IoC (Indicators of Compromise) and IoA (Indicators of Attack).

DFIR module will define both the Digital forensics and incident response, as the name suggests. Participants will have the opportunity to familiarize themselves with the NIST incident handling, ENISA incident management and MITRE ATT&CK frameworks. Participants will learn about the incident handling process, and about adversary TTPs (Tactics, Techniques and Procedures). Computer forensics lesson will cover computer forensics concepts such as the value of the digital evidence, how to create a bit-stream copy, how to approach the digital evidence during the incident and/or investigation, etc., data storage systems and concept, file systems, memory forensics, steganography, and malware forensics.

Self-study modules cover risk management and backup and BCDR. These modules will help participants to complete the 360-view into the world of cyber security and help them understand why it is so important to secure the systems and which systems to secure, how much money it makes sense to invest in the protections, etc. from the risk management point of view, while the backup and BCDR module will define the importance of creating disaster resilient system in order to support the business.

• Polaznicima pripada sertifikat o pohađanju kursa Blue teamer za ostvarenih minimalno 70% prisustva od ukupnog fonda časova.