The course "Advanced Network Analysis and Incident Response" equips learners with critical skills for effectively managing and responding to cyber threats. Through a blend of theoretical concepts and hands-on practice, participants will delve into advanced network situational awareness, network packet analysis, and incident response strategies aligned with organizational security policies.
What sets this course apart is its comprehensive approach to both the technical and strategic aspects of cybersecurity. Learners will engage with both government-off-the-shelf (GOTS) and commercial-off-the-shelf (COTS) tools, gaining practical experience in analyzing network traffic and implementing effective incident response protocols. The curriculum also incorporates real-world scenarios through tabletop exercises and emphasizes the application of the NIST Cybersecurity Framework and the SANS Incident Response Cycle.
By completing this course, learners will enhance their ability to detect, analyze, and respond to incidents effectively, preparing them for challenges in the dynamic field of cybersecurity. Whether you're aiming to advance your career or reinforce your skills, this course provides the knowledge and confidence needed to excel in network analysis and incident response.
Overview
Syllabus
- Course Introduction
- This course provides a comprehensive exploration of network analysis and incident response strategies, focusing on the differentiation between Network Situational Awareness and Intrusion Detection Systems. Students will learn to apply anomaly detection techniques and utilize various network packet analysis tools. The curriculum includes developing alarm systems through Graph Analysis and interpreting key performance metrics like ROC analysis. Emphasis is placed on evaluating incident response mechanisms and understanding the implications of Artificial Intelligence in cybersecurity. Participants will also gain practical skills in applying the NIST Cybersecurity Framework and the SANS Incident Response Cycle to real-world scenarios.
- Network Analysis
- This course dives into advanced network situational awareness, exploring how it differs from conventional NIDS.
- Network Packet Analysis
- This module introduces foundational concepts in Network Packet Analysis, providing insights into both government-off-the-shelf (GOTS) and commercial-off-the-shelf (COTS) tools used for analyzing network traffic.
- ROC Analysis
- This module will guide students through the process of conducting ROC analysis on IDS data and interpreting various graphical representations, including event graphs, precision-recall (P-R) graphs, and thresholds.
- Response
- This module focuses on the importance of aligning response strategies with organizational security policies, while also evaluating the risks associated with automated responses.
- Tabletop Exercise
- This course explores the complexities of intrusion detection and response in constrained environments.
- Cyber Security Incident Response Management
- This course delves into the application of the NIST Cybersecurity Framework (CSF) 2.0 and the SANS Incident Response Cycle in managing cyber incidents.
Taught by
Jason Crossland
