CompTIA Cybersecurity Analyst CySA+

Security Analysts, Vulnerability Analysts, Security Engineer, Cybersecurity Specialist, Security Operations Centre (SOC) Analysts

On course completion, you will be able to:

• Identify tools and techniques used to perform an environmental reconnaissance of a target network or security system
• Collect, analyse and interpret security data from multiple log and monitoring sources
• Use network host and web application vulnerability assessment tools and interpret the results to provide effective mitigation
• Understand and remediate identity management, authentication and access control issues
• Participate in a senior role within an incident response team and use forensic tools to identify the source of an attack
• Understand the use of frameworks, policies and procedures and report on security architecture with recommendations for effective compensating controls

A+, Network+, Security+ (or equivalent knowledge/skills) are highly recommended. As a minimum attendees must:

• Know basic network terminology and functions (such as OSI Model, Topology, Ethernet, Wi-Fi, switches, routers)
• Understand TCP/IP addressing, core protocols, and troubleshooting tools
• Be able to identify network attack strategies and defenses
• Know the technologies and uses of cryptographic standards and products
• Be able to identify network- and host-based security technologies and practices
• Be able to describe the standards and products used to enforce security on web and communications technologies

The supply of this course by DDLS is governed by the booking terms and conditions. Please read the terms and conditions carefully before enrolling in this course, as enrolment in the course is conditional on acceptance of these terms and conditions.

• Threat Management
• Vulnerability Management
• Cyber Incident Response
• Security Architecture

Module 1 – Threat Management 1

Cybersecurity Analysts

• Cybersecurity Roles and Responsibilities
• Frameworks and Security Controls
• Risk Evaluation
• Penetration Testing Processes

Reconnaissance Techniques

• The Kill Chain
• Open Source Intelligence
• Social Engineering
• Topology Discovery
• Service Discovery
• OS Fingerprinting

Module 2 – Threat Management 2

Security Appliances

• Configuring Firewalls
• Intrusion Detection and Prevention
• Configuring IDS
• Malware Threats
• Configuring Anti-virus Software
• Sysinternals
• Enhanced Mitigation Experience Toolkit

Logging and Analysis

• Packet Capture
• Packet Capture Tools
• Monitoring Tools
• Log Review and SIEM
• SIEM Data Outputs
• SIEM Data Analysis
• Point-in-Time Data Analysis

Module 3 – Vulnerability Management

Managing Vulnerabilities

• Vulnerability Management Requirements
• Asset Inventory
• Data Classification
• Vulnerability Management Processes
• Vulnerability Scanners
• Microsoft Baseline Security Analyser
• Vulnerability Feeds and SCAP
• Configuring Vulnerability Scans
• Vulnerability Scanning Criteria
• Exploit Frameworks

Remediating Vulnerabilities

• Analysing Vulnerability Scans
• Remediation and Change Control
• Remediating Host Vulnerabilities
• Remediating Network Vulnerabilities
• Remediating Virtual Infrastructure Vulnerabilities

Secure Software Development

• Software Development Lifecycle
• Software Vulnerabilities
• Software Security Testing
• Interception Proxies
• Web Application Firewalls
• Source Authenticity
• Reverse Engineering

Module 4 – Cyber Incident Response

Incident Response

• Incident Response Processes
• Threat Classification
• Incident Severity and Prioritisation
• Types of Data

Forensics Tools

• Digital Forensics Investigations
• Documentation and Forms
• Digital Forensics Crime Scene
• Digital Forensics Kits
• Image Acquisition
• Password Cracking
• Analysis Utilities

Incident Analysis and Recovery

• Analysis and Recovery Frameworks
• Analysing Network Symptoms
• Analysing Host Symptoms
• Analysing Data Exfiltration
• Analysing Application Symptoms
• Using Sysinternals
• Containment Techniques
• Eradication Techniques
• Validation Techniques
• Corrective Actions

Module 5 – Security Architecture

Secure Network Design

• Network Segmentation
• Blackholes, Sinkholes, and Honeypots
• System Hardening
• Group Policies and MAC
• Endpoint Security

Managing Identities and Access

• Network Access Control
• Identity Management
• Identity Security Issues
• Identity Repositories
• Context-based Authentication
• Single Sign On and Federations
• Exploiting Identities
• Exploiting Web Browsers and Applications

Security Frameworks and Policies

• Frameworks and Compliance
• Reviewing Security Architecture
• Procedures and Compensating Controls
• Verifications and Quality Control
• Security Policies and Procedures
• Personnel Policies and Training