FedVTE Course Catalog

101 Courses - Basic level courses
NICE Cybersecurity Workforce Framework Category - Analyze
NICE Cybersecurity Workforce Framework Category - Collect and Operate
NICE Cybersecurity Workforce Framework Category - Investigate
NICE Cybersecurity Workforce Framework Category - Operate and Maintain
NICE Cybersecurity Workforce Framework Category - Oversee and Govern
NICE Cybersecurity Workforce Framework Category - Protect and Defend
NICE Cybersecurity Workforce Framework Category - Securely Provision

The NICE Cybersecurity Workforce Framework can be found at: https://niccs.us-cert.gov/workforce-development/cyber-security-workforce-framework

Limit to NICE Cybersecurity Workforce Framework Category or subject:
101 Courses - Basic level courses Analyze Collect and Operate
Investigate Operate and Maintain Oversee and Govern
Protect and Defend Securely Provision
Show All Courses in All Categories

Expand/Collapse All
CDM 141 Introduction to the CDM Agency Dashboard - 2 HoursSkill Level: Beginner  
+ Description
 

This course is a recording of a virtual two-hour course which is the first of six webinars. This course provides participants with the essential knowledge of the ES-2 version of the CDM Agency Dashboard. It explains basic features and navigation within the environment, and includes demonstrations using the new CDM Agency Dashboard to identify and report on vulnerabilities.

Register to join the next live iteration of this course via https://www.cisa.gov/cdm-training.

Learning Objectives:

  • Understand CDM Agency Dashboard basic features and functionality
  • Instructor demonstrates the CDM Agency Dashboard

Date: 2020

Training Proficiency Area: Level 1 - Beginner

Training Purpose: Skill Development

Alignment to the NIST SP 800-181 Cybersecurity Workforce Framework

CategorySpecialty AreaWork Roles
Operate and Maintain Systems Administration, Systems Analysis Operate and Maintain Systems Administration, Systems Analysis System Administrator, Systems Security Analyst
Oversee and Govern Cybersecurity Management Information Systems Security Manager
Oversee and Govern Program/Project Management and Acquisition IT Investment/Portfolio Manager, IT Program Auditor, IT Project Manager, Product Support Manager, Program Manager
Protect and Defend Cyber Defense Analysis Cyber Defense Analyst
+ Course Modules/Units
 
Introduction to the CDM Agency Dashboard
CDM 143 Vulnerability Management with the CDM Agency Dashboard - 2 HoursSkill Level: Beginner  
+ Description
 

This course is a recording of a virtual two-hour course which is the second of six webinars covering the ES-2 version of the CDM Agency Dashboard. This course introduces participants to CDM Agency-Wide Adaptive Risk Enumeration (AWARE) and other vulnerability management topics. With the information provided, dashboard users can identify the most critical vulnerabilities and prioritize mitigation activities at their agency.

Register to join the next live iteration of this course via https://www.cisa.gov/cdm-training.

Learning Objectives:

  • Understand the CDM Agency-Wide Adaptive Risk Enumeration (AWARE) Score
  • Walkthrough how to identify vulnerabilities in the CDM Agency Dashboard

Date: 2021

Training Proficiency Area: Level 1 - Beginner

Training Purpose: Skill Development

Alignment to the NIST SP 800-181 Cybersecurity Workforce Framework

CategorySpecialty AreaWork Roles
Operate and Maintain Systems Administration, Systems Analysis System Administrator, Systems Security Analyst
Oversee and Govern Cybersecurity Management Oversee and Govern Cybersecurity Management Information Systems Security Manager
Oversee and Govern Program/Project Management and Acquisition IT Investment/Portfolio Manager, IT Program Auditor, IT Project Manager, Product Support Manager, Program Manager
Protect and Defend Cyber Defense Analysis Cyber Defense Analyst
+ Course Modules/Units
 
Vulnerability Management with the CDM Agency Dashboard
CDM 201 Identity and Access Management Capabilities within the CDM Agency Dashboard - 2 HoursSkill Level: Intermediate  
+ Description
 

This course is a recording of a virtual two-hour course which is the second of six webinars covering the ES-2 version of the CDM Agency Dashboard. This course introduces participants to the four identity management capabilities - PRIV, CRED, TRUST, and BEHAVE - and to the use of the new CDM Agency Dashboard to reduce risks associated with each.

Register to join the next live iteration of this course via https://www.cisa.gov/cdm-training.

Learning Objectives:

  • Overview of how the CDM Agency Dashboard addresses user-centric data in addition to hardware and software information
  • Strategies for integrating PRIV/CRED/TRUST/BEHAVE capabilities into routine processes workflows to drive increased risk awareness and mitigation.

Date: 2021

Training Proficiency Area: Level 2 - Intermediate

Training Purpose: Skill Development

Alignment to the NIST SP 800-181 Cybersecurity Workforce Framework

CategorySpecialty AreaWork Roles
Operate and Maintain Systems Administration, Systems Analysis System Administrator, Systems Security Analyst
Oversee and Govern Cybersecurity Management Oversee and Govern Cybersecurity Management Information Systems Security Manager
Oversee and Govern Program/Project Management and Acquisition IT Investment/Portfolio Manager, IT Program Auditor, IT Project Manager, Product Support Manager, Program Manager
Protect and Defend Cyber Defense Analysis Cyber Defense Analyst
+ Course Modules/Units
 
Identity and Access Management Capabilities within the CDM Agency Dashboard
New Course OfferingIAM- Identity and Access Management with the CDM Agency Dashboard .5 HoursSkill Level: Intermediate  
+ Description
 

This 39 minute video is an interview recording of a Mr. Ross Foard, subject matter expert for DHS/CISA, and Identity and Access Management (IAM) . This video provides participants with the essential knowledge of IAM and the CDM Agency Dashboard.

Learning Objectives:

  • Understand CDM Agency Dashboard basic features and IAM functionality.

Date: 2021

Training Proficiency Area: Level 2 - Intermediate

Training Purpose: Skill Development

Alignment to the NIST SP 800-181 Cybersecurity Workforce Framework

CategorySpecialty AreaWork Roles
Operate and Maintain Systems Administration, Systems Analysis Operate and Maintain Systems Administration, Systems Analysis System Administrator, Systems Security Analyst
Oversee and Govern Cybersecurity Management Information Systems Security Manager
Oversee and Govern Program/Project Management and Acquisition IT Investment/Portfolio Manager, IT Program Auditor, IT Project Manager, Product Support Manager, Program Manager
Protect and Defend Cyber Defense Analysis Cyber Defense Analyst
+ Course Modules/Units
 
IAM- Identity and Access Management with the CDM Agency Dashboard
Advanced PCAP Analysis and Signature Development (APA) 1 HourSkill Level: Intermediate  
+ Description
 

This course will introduce rules and go over example syntax, protocols, and expressions. It contains several supporting video demonstrations as well as lab exercises writing and testing basic rules.

Learning Objectives:

  • Identify poorly written signatures and revise them.
  • Write regular expressions.
  • Create signatures.
  • Identify information in PCAP data to use for creating alerts.

Date: 2011

Training Purpose: Skill Development

Training Proficiency Area: Level 2 - Intermediate

Alignment to the NIST SP 800-181 Cybersecurity Workforce Framework

CategorySpecialty AreaWork Roles
Analyze All-Source Analysis All-Source Analyst
Collect and Operate Cyber Operations Cyber Operator
Protect and Defend Cyber Defense Analysis Cyber Defense Analyst
Protect and Defend Cyber Defense Infrastructure Support Cyber Defense Infrastructure Support Specialist
+ Course Modules/Units
 
Advanced Pcap Analysis And Signature Development
Packet Protocol Dns
Introduction To Rules
Examples Of Sourcefire Rules
Sourcefire Rule Syntax - Protocols
Sourcefire Rule Syntax - Message And Matching
Lab Exercise Writing And Testing Basic Rules
Lab Exercise Writing And Testing Basic Rules Video
Lab Exercise Writing And Testing Basic Rules Continued
Lab Exercise Continued
Regular Expressions
Editing A Poor Rule
How To Write An Ipv4 Regular Expression
Lab Exercise Writing Regular Expression
Lab Exercise Writing Regular Expression Continued
Malware Analysis Reports (Mar)
Demonstration of Mar 131751 Report
Demonstration Of Mar Report Continued
Lab Exercise Writing Rules From Malware Analysis Reports
Lab Exercise Writing Rules From Malware Analysis Reports Continued
Analysis Pipeline 6 HoursSkill Level: Intermediate  
+ Description
 

This course is designed for network flow data analysts who use or are considering using Analysis Pipeline (http://tools.netsa.cert.org/analysis-pipeline5/index.html). The course aims to create a better understanding of how to incorporate streaming network flow analysis into their toolkit for identifying and alerting on events of interest. The focus will be on applying Analysis Pipeline to operational use cases.

Learning Objectives
At the completion of this course analysts will be able to:

  • Understand Analysis Pipeline and its role in network flow data streaming analytics and alerting.
  • Understand the Analysis Pipeline configuration language.
  • Develop and implement network flow data use cases with Analysis Pipeline.

Date: 2016

Training Purpose: Skill Development

Training Proficiency Area: Level 2 - Intermediate

Alignment to the NIST SP 800-181 Cybersecurity Workforce Framework

CategorySpecialty AreaWork Roles
Collect and Operate Cyber Operations Cyber Operator
Operate and Maintain Network Services Network Operations Specialist
Protect and Defend Cyber Defense Analysis Cyber Defense Analyst
+ Course Modules/Units
 
Introduction
Configuration Files
Running Pipeline
Logical Schematics
Pipeline and Timing and State
Alerts
Configuration File Basics
Filters
Filters (Exercises and Solutions)
Evaluations
Evaluations (Exercises and Solutions)
Statistics
Internal Filters
List Configurations
Configuration File Basics (Exercises and Solutions)
Threshold Examples
Special Evaluations
Building an Analytic
Server Profiling Analytic
Host Discovery Analytic
Advanced Configurations
NTP Anomalies
Unknown SSH Brute Force
Choose Your Own Adventure
ICMP Surveying: Thinking it Through
ICMP Surveying: Building it Out
DDoS Detection: Thinking it Through
DDoS Detection: Building it Out
SSH Compromise: Thinking it Through
SSH Compromise: Building it Out
Analysis Pipeline 5
Certified Ethical Hacker Version 10 (CEHv10) Prep 29 HoursSkill Level: Advanced 
+ Description
 

This self-study course focuses on preparing learners for the EC-Council Certified Ethical Hacker version 10 certification exam. This course contains materials on advanced network assessment techniques including enumeration, scanning, and reconnaissance. It is designed to use the same knowledge and tools as a malicious hacker, but in an ethical and lawful manner to examine an organization's network security posture. The course concludes with a practice exam.

Learning Objectives:

  • Learn how to perform a vulnerability analysis to identify security weakness in an organization's network structure.
  • Perform a security assessment of a cloud environment to understand cloud computing threats and attacks.
  • Understand risks and defensive strategies for IoT platforms and devices.

Date: 2019

Training Purpose: Skill Development

Training Proficiency Area: Level 3 - Advanced

Alignment to the NIST SP 800-181 Cybersecurity Workforce Framework

CategorySpecialty AreaWork Roles
Operate and Maintain Systems Analysis Systems Analyst
Protect and Defend Cyber Defense Analysis Cyber Defense Analyst
Protect and Defend Vulnerability Assessment and Management Vulnerability Assessment Analyst
+ Course Modules/Units
 
CEHv10 Course Introduction
Information Security Reports
Ethical Hacking Defined
Ethical Hacking Terminology
Hacking Phases and Vul Research
Types of Attacks and Attack Vectors
Threat Modeling
Introduction to Physical Security
Incident Management Process
Incident Response Overview
Security Testing and Assessments
Pen Testing Phases and Methodology
Information Security Laws and Standards
Reconnaissance
Footprinting Methodologies - Passive
Footprinting Methodologies - Active
Advanced Google Hacking Techniques
Network Mapping
DEMO: WHOIS with BackTrack
DEMO: Active Footprinting with Traceroute
DEMO: Maltego for Information Gathering Part 1
DEMO: Maltego for Information Gathering Part 2
Footprinting Countermeasures
DEMO: Windows CMD Information Gathering
Scanning Essentials
DEMO: Colasoft Packet Builder
Port Scanning
DEMO: Banner Grabbing with Telnet
Covert Scanning
Covert Scanning with Proxies
DEMO: Scanning with Nmap
Common Enumeration Techniques
Enumeration Tools
Protocol Enumeration
DEMO: Scanning and Enumeration with Nmap
Understanding System Vulnerabilities
Passive and Active Vul Scanning
Vulnerability Assessment Lifecycle and CVSS
Common Vulnerabilities and Exposures (CVE)
Vulnerability Scanning
DEMO: Vulnerability Scanning with Nessus
Authentication Techniques
Microsoft Authentication
Password Cracking
Privilege Escalation
DEMO: Rainbow Table Lookup Sites
Keyloggers
Spyware and Activity Monitoring
Packet Sniffing Attacks
Covert Hacking
Hiding Files - Rootkits
DEMO: Kernel-Level Rootkits
Covering Tracks
Malware Awareness
Trojan Terminology and Techniques
Trojans and Backdoors
Virus Examples and Symptoms
Virus Classifications and Characteristics
Virus Making Tools
Other Malicious Code Types
Malware Countermeasures and Tools
DEMO: Bind and Reverse Shell
DEMO: Strings Analysis
Sniffers Terminology and Overview
Network Overview for Sniffer Placement
Basic Packet Analysis
Address Resolution Protocol (ARP)
DEMO: Viewing ARP Packets with Packet Builder
Spoofing and Flooding Sniffing Attacks
MITM Attacks Ports Vul to Sniffing
Wireshark Overview and Examples
Evasion in Network Sniffing
Sniffing Countermeasures and Tools
DEMO: Hping3
DEMO: Wireshark
Social Engineering Background and Examples
Human-Based Social Engineering
Computer-Based Social Engineering
Computer Based SE - Social Networking
Social Engineering with Mobile Applications
SE and Identity Theft Countermeasures
DEMO: Social Engineering Toolkit
DEMO: Leveraging Armitage in Phishing Attack
DoS Impacts and Classifications
Categories of Denial of Service
Botnets and Disruption Attacks
DoS Symptoms and Tools
Buffer Overflow Terminology and Background
Session Hijacking Overview and Examples
Compromising Session Attacks
Session Hijacking Techniques
Session Hijacking Tools
IPSec and Session Hijacking
Firewalls and Honeypots
Firewall Configurations
IDS Overview and Detection Methods
IDS, Firewall, and Honeypot Evasion
Evasion Techniques
Evasion Testing Techniques
DEMO: Intrusion Signs
Common Web Server Attack
Webserver Architecture
OWASP Top 10 and Beyond
Webserver Hacking Countermeasures
SQL and Command Injection Web App Hacking
Non SQL Injection Errors
Parameter and Form Tampering Web App Hacking
Cross-site Scripting and Obfuscation Web App Hacks
Cross-site Request Forgery and Cookies
Web Application Pen Test Methodology
Web App Tools and Countermeasures
Buffer Overflow Tools and Countermeasures
DEMO: BurpSuite
SQL Terminology and Example Statements
SQL Enumeration
SQL Injection Attacks
SQL Injection Tools and Countermeasures
DEMO: SQL Inject Attacks
Wireless Terminology and Standards
Wireless Terminology and Antennas
Wireless Authentication
Wireless-Based Attacks
Wireless Attack Methodology Part 1 of 2
Wireless Attack Methodology Part 2 of 2
WEP, WPA and Other Wireless Attacks
Bluetooth Communication Basics
Wireless Protocols and Signal Modulation
DEMO: SSID and Channels
DEMO: Wireless Hacking
Wireless Hacking Tools
Wireless Hacking Countermeasures
Mobile Platform Overview
OWASP IoT Vuls and Countermeasures
Mobile Device Operating Systems
Hacking Mobile Platforms
Mobile Device Management and Risks
Mobile Device Security
Internet of Things (IoT) Concepts
Internet of Things (IoT) Attacks and Mitigation
Introduction to Cloud Computing
Cloud Architectures and Deployment Models
Cloud Threats and Attacks
Cloud Security
Cloud Testing Tools
Cryptography Background and Terminology
Crypto Keys and Algorithms
SHA and TLS Algorithms
DEMO: Hashing with MD5 Sum
Cryptography Implementations
Public Key Infrastructure (PKI)
Cryptanalysis Techniques
Crypto Attacks
DEMO: Encryption with TrueCrypt
Digital Signatures
Certified Ethical Hacker Practice Exam
LAB: Using a Simulated Botnet to Conduct a Distributed Denial of Service
Course Lifetime ExpiringCDM 104: Using the Legacy (Archer) CDM Agency Dashboard to Drive Your Vulnerability Management Work Plan 2 HoursSkill Level: Beginner  
+ Description
 

Learn how to use AWARE to prioritize vulnerability management activities to address the worst vulnerabilities first.

Learning Objectives:

  • Understand AWARE Risk Scoring using the Legacy (Archer) CDM Agency Dashboard
  • Learn how to identify vulnerabilities, components and mitigations

Date: 2019

Training Proficiency Area: Level 1 - Beginner

Training Purpose: Skill Development

Alignment to the NIST SP 800-181 Cybersecurity Workforce Framework

CategorySpecialty AreaWork Roles
Protect and Defend Vulnerability Assessment and Management Vulnerability Assessment Analyst
Oversee and Govern Cybersecurity Management Information Systems Security Manager
Oversee and Govern Program/Project Management and Acquisition IT Investment/Portfolio Manager, IT Program Auditor, IT Project Manager, Product Support Manager, Program Manager
Securely Provision Risk Management Authorizing Official/Designating Representative, Security Control Assessor
+ Course Modules/Units
 
CDM104: Course Introduction
CDM104: Part 2
CDM104: Part 3
CDM104: Part 4
CDM104: Part 5
CDM104: Conclusion
CDM Agency Dashboard Introduction
CDM 129: Understanding AWARE Risk Scoring Terminology and Constructs
CDM 129: Understanding AWARE Risk Scoring Terminology and Constructs Knowledge Check
CDM 130: Identifying Vulnerabilities and Mitigations using AWARE Scoring Knowledge Check
CDM 131: Identifying Vulns, Components and Mitigations Using AWARE Scoring Knowledge Check
Course Lifetime ExpiringCDM Module 1 : Overview 2 HoursSkill Level: Beginner  
+ Description
 This course is designed for managers, staff and other stakeholders who may be involved in implementation and/or decision making regarding Continuous Diagnostics and Mitigation (CDM). The course aims to help the student better understand how CDM can help a department or agency (D/A) better manage risk and protect mission critical assets and to more effectively evaluate their cybersecurity posture.

The course provides a high level overview of the CDM program. Topics covered include basic CDM concepts, how CDM relates to NIST 800-53 and other NIST SPs, CDM Concept of Operations, the CDM Environment, and CDM’s Phases and Capabilities.

Training Purpose: Securely Provision, Oversee and Govern, Protect and Defend

Specialty Areas: Risk Management, Cybersecurity Management, Vulnerability Assessment and Management, Cyber Defense Analysis

Proficiency: Level 1 - Basic

Capture Date: 2015

+ Course Modules/Units
 
What is the CDM program?
What problem does CDM address?
How does the CDM program support Departments and Agencies
Why does CDM focus on Automation?
What is the CDM "Desired State" Specification?
What is the Actual State?
What is a Defect Check?
What is an Assessment Object?
What is a Defect instance?
What is an Object Container?
What is a CDM Security Capability?
How Do 800-53 Controls Map to CDM Security Capabilities?
How do I use the CDM Security Capabilities to Improve Security?
How does CDM relate to NISTs 800-53 Catalogue of Controls?
How does CDM relate to NISTs 800-53 Suggested Control Assessment Methods?
How does CDM relate to NISTs guidance on ISCM (800-137)?
How does CDM relate to NIST guidance on Risk Management 800-30 and 800-39?
How does CDM relate to NISTs RMF?
How does CDM operate in a department or agency?
What is the CDM Concept of Operations?
Where does the "Desired State" Specification come from?
What does the actual state concept in CDM mean for our department or agency?
Where does the Actual State Data come from?
How does CDM discover defects?
How does Scoring work with CDM and how am I affected?
How does CDM know who is responsible for fixing defects?
Will the CDM "System(s)" be A&Aed?
How will CDM sensors affect my Network(s)? Performance? Security?
What are CDM shared services?
Why is CDM divided into phases?
How do the security capabilities fit into phases?
What are the Phase 1 capabilities?
What are the Phase 2 capabilities?
What are the Phase 3 capabilities?
What does the CDM D/A Dashboard provide?
How Does the CDM D/A Dashboard Work with Other D/A Dashboards?
How Do I Get the Information My D/A Needs from the CDM D/A Dashboard?
Course Lifetime ExpiringCDM Module 2: Hardware Asset Management 1 HourSkill Level: Beginner  
+ Description
 This course is designed for managers, staff and other stakeholders who may be involved in implementation and/or decision making regarding Continuous Diagnostics and Mitigation (CDM). The course aims to help the student better understand how CDM can help a department or agency (D/A) better manage risk and protect mission critical assets and to more effectively evaluate their cybersecurity posture.

The course begins by defining Hardware Asset Management (HWAM) and why it is critical to the implementation of a robust cybersecurity program. The training highlights the criteria for monitoring and managing hardware assets using CDM. It then transitions into HWAM implementation criteria and discusses the generic CDM concept of operations specific to HWAM. Topics covered include Actual State, Desired State, and Defects.

Training Purpose: Securely Provision, Oversee and Govern, Protect and Defend

Specialty Areas: Risk Management, Cybersecurity Management, Vulnerability Assessment and Management, Cyber Defense Analysis

Proficiency: Level 1 - Basic

Capture Date: 2015

+ Course Modules/Units
 
What is Hardware Asset Management (HWAM)?
What Are the Purpose and Results?
What Types of Attacks Does HWAM Thwart for Our Organization?
What Objects Does HWAM Assess?
How Does the HWAM Concept of Operations (CONOPS) work?
How Does HWAM Relate to Other Phase 1 Capabilities?
What HWAM Roles and Responsibilities Will My Organization Implement?
How Does an Organization Use the HWAM Capability?
What Techniques Are Used to Search for HWAM Devices?
What Types of Data Does the HWAM Actual State Collect?
What Types of Data Are Used to Identify Network Addressable Devices?
How Do Agencies Get Desired State Specification Data for the HWAM Capability?
What Types of Data Does the HWAM Desired State Specification Collect?
Can Agencies Specify How to Group Results?
What Are the HWAM Defect Checks?
Which HWAM Defect Checks Are at the Federal Level?
Which HWAM Defect Checks Are at the Local Level?
Course Lifetime ExpiringCDM Module 3: Software Asset Management 1.5 HoursSkill Level: Beginner  
+ Description
 This course is designed for managers, staff and other stakeholders who may be involved in implementation and/or decision making regarding Continuous Diagnostics and Mitigation (CDM). The course aims to help the student better understand how CDM can help a department or agency (D/A) better manage risk and protect mission critical assets and to more effectively evaluate their cybersecurity posture.

The course begins by defining SWAM and why it is critical to the implementation of a robust cyber-security program. It covers new roles and responsibilities which the department or agency (D/A) must implement. It then transitions into SWAM implementation criteria, and discusses the generic CDM concept of operations specific to SWAM Actual State, Desired State, and Defects. It includes high level discussions of software lists (white, gray, black) and how software can be identified and tracked in CDM through the use of Common Platform Enumeration (CPE) and Software Identification (SWID) tags by Software package down to executables.

Training Purpose: Securely Provision, Oversee and Govern, Protect and Defend

Specialty Areas: Risk Management, Cybersecurity Management, Vulnerability Assessment and Management, Cyber Defense Analysis

Proficiency: Level 1 - Basic

Capture Date: 2015

+ Course Modules/Units
 
What is the Software Asset Management (SWAM) Capability?
What Purpose Does SWAM Serve?
What Types of Results Will SWAM Accomplish?
What Types of Attacks Does SWAM Thwart?
What Objects Does SWAM Assess?
How Does the SWAM Concept of Operations (CONOPS) Work?
How Does SWAM Relate to Other Phase 1 Capabilities?
How Does SWAM Block Many Zero Day and APT Attacks?
What Techniques Are Used to Search for SWAM Devices?
How Does CDM Identify Software Products and Executables?
How Does CDM Use Digital Fingerprints?
What Is a Whitelist?
How Do I Use a Software Whitelist?
What Is a Graylist?
How Do I Use a Software Graylist?
What Is a Blacklist?
How Do I Use a Software Blacklist?
What Does Locational Whitelisting Mean to Me?
What Is a Trust Library and How Does SWAM Use It?
How Is Desired State Specification Determined for Mobile Code in CDM?
How Does SWAM Use Hashes?
How Does SWAM Use Common Platform Enumeration (CPE)?
How Does SWAM Use Software IDs (SWIDs)?
What Are the SWAM Defect Checks?
Which SWAM Defect Checks Are at the Federal Level?
Which SWAM Defect Checks Are at the Local Level?
What Mitigation Options Might My Department or Agency Use with SWAM?
Course Lifetime ExpiringCDM Module 4: Configuration Settings Management .5 HoursSkill Level: Beginner  
+ Description
 This course is designed for managers, staff and other stakeholders who may be involved in implementation and/or decision making regarding Continuous Diagnostics and Mitigation (CDM). The course aims to help the student better understand how CDM can help a department or agency (D/A) better manage risk and protect mission critical assets and to more effectively evaluate their cybersecurity posture.

The course begins by outlining the Cyber Security Manager position (CSM) and highlighting the types of attacks CSM can help prevent. It then transitions into CSM methods and criteria, where it reviews Actual State, Desired State, and Defect Checks specific to the capability area. It explains how CSM builds upon the other capabilities and how defect checks differ at the local and federal levels.

Training Purpose: Securely Provision, Oversee and Govern, Protect and Defend

Specialty Areas: Risk Management, Cybersecurity Management, Vulnerability Assessment and Management, Cyber Defense Analysis

Proficiency: Level 1 - Basic

Capture Date: 2015

+ Course Modules/Units
 
What Is the Configuration Settings Management Security Capability?
What Types of Results Will CSM Accomplish?
How Does CSM Thwart Attacks?
What Objects Does the CSM Security Capability Assess?
How Does CSM Work?
How Does HWAM and SWAM Support CSM?
What Methods Will CSM Use to Determine Actual State Information?
What Elements Does the Organization Require to Define the Actual State?
How Does CSM Define the Desired State?
What Methods Will CSM Use to Determine Desired State?
What Is a Common Configuration Enumeration (CCE)?
What Is a CSM Defect Check?
Which CSM Defect Checks Are at the Federal Level?
Which CSM Defect Checks Are at the Local Level?
Course Lifetime ExpiringCDM Module 5: Vulnerability Management .5 HoursSkill Level: Beginner  
+ Description
 The course aims to help the student better understand how vulnerability management (VULN) identifies the existence of vulnerable software products in the boundary to allow an organization to mitigate and thwart common attacks that exploit those vulnerabilities.

The course begins by defining VULN, how it applies to the target environment, and how a fully implemented VULN capability impacts a Department or Agency. It then transitions into VULN criteria and methods, where it reviews Actual State, Desired State, and Defect Checks specific to the capability area. It explains how VULN builds upon the other capabilities areas, the types of defects, and how those defect checks differ at the local and federal levels.

Training Purpose: Securely Provision, Oversee and Govern, Protect and Defend

Specialty Areas: Risk Management, Cybersecurity Management, Vulnerability Assessment and Management, Cyber Defense Analysis

Proficiency: Level 1 - Basic

Capture Date: 2015

+ Course Modules/Units
 
What Is the Vulnerability Management (VULN) Capability?
What Is a CVE (Common Vulnerabilities and Exposures)?
What Is a CWE (Common Weakness Enumeration)?
What Types of Results Will VULN Accomplish?
How Can VULN Thwart Attacks?
What Types of VULN Objects Are Assessed?
How Does the VULN Capability Work?
How Does VULN Relate to SWAM?
How Will My Organization Use the VULN Capability?
What Methods Will VULN Use to Determine Actual State?
What Is the CDM Actual State?
How Does VULN Define the Desired State?
What Methods Will VULN Use to Determine Desired State?
What Is the National Vulnerability Database (NVD)?
What Are the VULN Defect Checks?
Which VULN Defect Checks Are at the Federal Level?
Which VULN Defect Checks Are at the Local Level?
Course Lifetime ExpiringCDM PRIVMGMT: CA PAM for Chief Information Security Officers (LT1) 2 hoursSkill Level: Beginner
+ Description
 Privilege Access Management (PRIVMGMT) course is designed for senior-level executives within an organization responsible for establishing and maintaining the enterprise vision, strategy, and program to ensure information assets and technologies are adequately protected.
Course Description: This course contains 9 learning tracks:
  • X1 An introduction into the PRIVMGMT solution and how it aligns to CDM goals.
  • X2 General use of the web portal for requesting, accessing and managing privileged credentials.
  • X3 Account management features which include account reconciliation and password management.
  • X4 Credential Approval designed to provide agencies with a functional understanding of approving credential requests.
  • P1 Splunk dashboard introduction.
  • S1 SailPoint Introduction covers the UI and highlights how to locate an Identity Attribute
  • S2 SailPoint Administration I covers configuring Applications and Tasks.
  • S3 SailPoint Administration II covers Target Applications and Connectors
  • S4 SailPoint Administration III includes the ability to run, schedule and review reports.
Specialty Areas: Cyber Defense Infrastructure Support Level: Basic
+ Course Modules/Units
 
X1 An introduction into the PRIVMGMT solution and how it aligns to CDM goals.
X2 General use of the web portal for requesting, accessing and managing privileged credentials.
X3 Account management features which include account reconciliation and password management.
X4 Credential Approval designed to provide agencies with a functional understanding of approving credential requests.
P1 Splunk dashboard introduction.
S1 SailPoint Introduction covers the UI and highlights how to locate an Identity Attribute.
S2 SailPoint Administration I covers configuring Applications and Tasks.
S3 SailPoint Administration II covers Target Applications and Connectors.
S4 SailPoint Administration III includes the ability to run, schedule and review reports.
Course Lifetime ExpiringCDM PRIVMGMT: CyberArk for Chief Information Security Officers (LT1) 2 hoursSkill Level: Beginner
+ Description
 Privilege Access Management (PRIVMGMT) course is designed for senior-level executives within an organization responsible for establishing and maintaining the enterprise vision, strategy, and program to ensure information assets and technologies are adequately protected. This course contains 9 learning tracks:
  • C1 An introduction into the PRIVMGMT solution and how it aligns to CDM goals.
  • C2 General use of the web portal for requesting, accessing and managing privileged credentials.
  • C3 Account management features which include account reconciliation and password management.
  • C4 Credential Approval designed to provide agencies with a functional understanding of approving credential requests.
  • P1 Splunk dashboard introduction.
  • S1 SailPoint Introduction covers the UI and highlights how to locate an Identity Attribute.
  • S2 SailPoint Administration I covers configuring Applications and Tasks.
  • S3 SailPoint Administration II covers Target Applications and Connectors.
  • S4 SailPoint Administration III includes the ability to run, schedule and review reports.
Specialty Areas: Cyber Defense Infrastructure Support Level 1 - Basic
+ Course Modules/Units
 
C1 An introduction into the PRIVMGMT solution and how it aligns to CDM goals.
C2 General use of the web portal for requesting, accessing and managing privileged credentials.
C3 Account management features which include account reconciliation and password management.
C4 Credential Approval designed to provide agencies with a functional understanding of approving credential requests.
P1 Splunk dashboard introduction.
S1 SailPoint Introduction covers the UI and highlights how to locate an Identity Attribute.
S2 SailPoint Administration I covers configuring Applications and Tasks.
S3 SailPoint Administration II covers Target Applications and Connectors.
S4 SailPoint Administration III includes the ability to run, schedule and review reports.
Course Lifetime ExpiringCDM PRIVMGMT: CA PAM for Information System Security Officer (LT2) 2 hoursSkill Level: Beginner
+ Description
 Privilege Access Management (PRIVMGMT) course is designed for senior-level executives within an organization responsible for establishing and maintaining the enterprise vision, strategy, and program to ensure information assets and technologies are adequately protected.
Course Description: This course contains 9 learning tracks:
  • X1 An introduction into the PRIVMGMT solution and how it aligns to CDM goals.
  • X2 General use of the web portal for requesting, accessing and managing privileged credentials.
  • X3 Account management features which include account reconciliation and password management.
  • X4 Credential Approval designed to provide agencies with a functional understanding of approving credential requests.
  • P1 Splunk dashboard introduction.
  • S1 SailPoint Introduction covers the UI and highlights how to locate an Identity Attribute
  • S2 SailPoint Administration I covers configuring Applications and Tasks.
  • S3 SailPoint Administration II covers Target Applications and Connectors
  • S4 SailPoint Administration III includes the ability to run, schedule and review reports.
Specialty Areas: Cyber Defense Infrastructure Support Level: Basic
+ Course Modules/Units
 
X1 An introduction into the PRIVMGMT solution and how it aligns to CDM goals.
X2 General use of the web portal for requesting, accessing and managing privileged credentials.
X3 Account management features which include account reconciliation and password management.
X4 Credential Approval designed to provide agencies with a functional understanding of approving credential requests.
P1 Splunk dashboard introduction.
S1 SailPoint Introduction covers the UI and highlights how to locate an Identity Attribute.
S2 SailPoint Administration I covers configuring Applications and Tasks.
S3 SailPoint Administration II covers Target Applications and Connectors.
S4 SailPoint Administration III includes the ability to run, schedule and review reports.
Course Lifetime ExpiringCDM PRIVMGMT: CyberArk for Information System Security Officer (LT2) 2 HoursSkill Level: Beginner
+ Description
  Privilege Access Management (PRIVMGMT) course is designed for personnel responsible for research, develop, implement, test and review an organization's information security in order to protect information and prevent unauthorized access. This course contains 9 learning tracks:
  • C1 An introduction into the PRIVMGMT solution and how it aligns to CDM goals.
  • C2 General use of the web portal for requesting, accessing and managing privileged credentials.
  • C3 Account management features which include account reconciliation and password management.
  • C4 Credential Approval designed to provide agencies with a functional understanding of approving credential requests.
  • P1 Splunk dashboard introduction.
  • S1 SailPoint Introduction covers the UI and highlights how to locate an Identity Attribute
  • S2 SailPoint Administration I covers configuring Applications and Tasks.
  • S3 SailPoint Administration II covers Target Applications and Connectors
  • S4 SailPoint Administration III includes the ability to run, schedule and review reports.
Specialty Areas: Cyber Defense Infrastructure Support Level: Basic
+ Course Modules/Units
 
C1 An introduction into the PRIVMGMT solution and how it aligns to CDM goals.
C2 General use of the web portal for requesting, accessing and managing privileged credentials.
C3 Account management features which include account reconciliation and password management.
C4 Credential Approval designed to provide agencies with a functional understanding of approving credential requests.
P1 Splunk dashboard introduction.
S1 SailPoint Introduction covers the UI and highlights how to locate an Identity Attribute.
S2 SailPoint Administration I covers configuring Applications and Tasks.
S3 SailPoint Administration II covers Target Applications and Connectors.
S4 SailPoint Administration III includes the ability to run, schedule and review reports.
Course Lifetime ExpiringCDM PRIVMGMT: CA PAM for Security Operations Center (LT3) 2 hoursSkill Level: Beginner
+ Description
 Privilege Access Management (PRIVMGMT) course is designed for personnel responsible for operating the SOC site which is dedicated to monitoring, assessing, and defending enterprise information systems (web sites, applications, databases, data centers and servers, networks, desktops and other endpoints). This course contains 5 learning tracks:
  • X1 An introduction into the PRIVMGMT solution and how it aligns to CDM goals.
  • X2 General use of the web portal for requesting, accessing and managing privileged credentials.
  • X4 Credential Approval designed to provide agencies with a functional understanding of approving credential requests.
  • P1 Splunk dashboard introduction.
  • P2 Splunk Integration
Specialty Areas: Cyber Defense Infrastructure Support Level: Basic
+ Course Modules/Units
 
X1 An introduction into the PRIVMGMT solution and how it aligns to CDM goals.
X2 General use of the web portal for requesting, accessing and managing privileged credentials.
X4 Credential Approval designed to provide agencies with a functional understanding of approving credential requests.
P1 Splunk dashboard introduction.
P2 Splunk Integration.
Course Lifetime ExpiringCDM PRIVMGMT: CyberArk for Security Operations Center (LT3) 2 HoursSkill Level: Beginner
+ Description
 Privilege Access Management (PRIVMGMT) course is designed for personnel responsible for operating the SOC site which is dedicated to monitoring, assessing, and defending enterprise information systems (web sites, applications, databases, data centers and servers, networks, desktops and other endpoints). This course contains 5 learning tracks:
  • C1 An introduction into the PRIVMGMT solution and how it aligns to CDM goals.
  • C2 General use of the web portal for requesting, accessing and managing privileged credentials.
  • C4 Credential Approval designed to provide agencies with a functional understanding of approving credential requests.
  • P1 Splunk dashboard introduction.
  • P2 Splunk Integration
Specialty Areas: Cyber Defense Infrastructure Support Level: Basic
+ Course Modules/Units
 
C1 An introduction into the PRIVMGMT solution and how it aligns to CDM goals.
C2 General use of the web portal for requesting, accessing and managing privileged credentials.
C4 Credential Approval designed to provide agencies with a functional understanding of approving credential requests.
P1 Splunk dashboard introduction.
P2 Splunk Integration.
Course Lifetime ExpiringCDM PRIVMGMT: CA PAM for Agency Privileged Users (LT4) 2 HoursSkill Level: Beginner 
+ Description
 Privilege Access Management (PRIVMGMT) course is designed for personnel that access or use credentials which have been granted administrative privileges on one or more systems. This course contains 4 learning tracks that provide Privileged users with
    C1 An introduction into the PRIVMGMT solution and how it aligns to CDM goals.
    C2 General use of the web portal for requesting, accessing and managing privileged credentials.
    C3 Account management features which include account reconciliation and password management.
Training Purpose: Skill Development
Specialty Areas: Knowledge Management
Training Proficiency Area: Level 1 - Basic
+ Course Modules/Units
 
Overview
General Use
Approving Credential Requests
Course Lifetime ExpiringCDM PRIVMGMT: CyberArk for Agency Privileged Users (LT4) 2 HoursSkill Level: Beginner 
+ Description
 Privilege Access Management (PRIVMGMT) course is designed for personnel that access or use credentials which have been granted administrative privileges on one or more systems. This course contains 4 learning tracks that provide Privileged users with
    C1 An introduction into the PRIVMGMT solution and how it aligns to CDM goals.
    C2 General use of the web portal for requesting, accessing and managing privileged credentials.
    C3 Account management features which include account reconciliation and password management.
Training Purpose: Skill Development
Specialty Areas: Knowledge Management
Training Proficiency Area: Level 1 - Basic
+ Course Modules/Units
 
Overview
General Use
Approving Credential Requests
Course Lifetime ExpiringCDM PRIVMGMT: CA PAM for Privileged User Managers (LT5)  2 hoursSkill Level: Beginner
+ Description
 Privilege Access Management (PRIVMGMT) course is designed for managers of privileged users. This course contains 8 learning tracks:
  • X1 An introduction into the PRIVMGMT solution and how it aligns to CDM goals.
  • X2 General use of the web portal for requesting, accessing and managing privileged credentials.
  • X3 Account management features which include account reconciliation and password management.
  • X4 Credential Approval designed to provide agencies with a functional understanding of approving credential requests.
  • S1 SailPoint Introduction covers the UI and highlights how to locate an Identity Attribute
  • S2 SailPoint Administration I covers configuring Applications and Tasks.
  • S3 SailPoint Administration II covers Target Applications and Connectors
  • S4 SailPoint Administration III includes the ability to run, schedule and review reports.
Specialty Areas: Cyber Defense Infrastructure Support Level: Basic
+ Course Modules/Units
 
X1 An introduction into the PRIVMGMT solution and how it aligns to CDM goals.
X2 General use of the web portal for requesting, accessing and managing privileged credentials.
X3 Account management features which include account reconciliation and password management.
X4 Credential Approval designed to provide agencies with a functional understanding of approving credential requests.
S1 SailPoint Introduction covers the UI and highlights how to locate an Identity Attribute.
S2 SailPoint Administration I covers configuring Applications and Tasks.
S3 SailPoint Administration II covers Target Applications and Connectors.
S4 SailPoint Administration III includes the ability to run, schedule and review reports.
Course Lifetime ExpiringCDM PRIVMGMT: CyberArk for Privileged User Managers (LT5)  2 hoursSkill Level: Beginner
+ Description
 Privilege Access Management (PRIVMGMT) course is designed for managers of privileged users. This course contains 8 learning tracks:
  • C1 An introduction into the PRIVMGMT solution and how it aligns to CDM goals.
  • C2 General use of the web portal for requesting, accessing and managing privileged credentials.
  • C3 Account management features which include account reconciliation and password management.
  • C4 Credential Approval designed to provide agencies with a functional understanding of approving credential requests.
  • S1 SailPoint Introduction covers the UI and highlights how to locate an Identity Attribute
  • S2 SailPoint Administration I covers configuring Applications and Tasks.
  • S3 SailPoint Administration II covers Target Applications and Connectors
  • S4 SailPoint Administration III includes the ability to run, schedule and review reports.
Specialty Areas: Cyber Defense Infrastructure Support Level: Basic
+ Course Modules/Units
 
C1 An introduction into the PRIVMGMT solution and how it aligns to CDM goals.
C2 General use of the web portal for requesting, accessing and managing privileged credentials.
C3 Account management features which include account reconciliation and password management.
C4 Credential Approval designed to provide agencies with a functional understanding of approving credential requests.
S1 SailPoint Introduction covers the UI and highlights how to locate an Identity Attribute.
S2 SailPoint Administration I covers configuring Applications and Tasks.
S3 SailPoint Administration II covers Target Applications and Connectors.
S4 SailPoint Administration III includes the ability to run, schedule and review reports.
Course Lifetime ExpiringCDM PRIVMGMT: CA PAM for Network Operations Center (LT6) 2 hoursSkill Level: Beginner
+ Description
 Privilege Access Management (PRIVMGMT) course is designed for managers of privileged users. This course contains 5 learning tracks:
  • X1 An introduction into the PRIVMGMT solution and how it aligns to CDM goals.
  • X2 General use of the web portal for requesting, accessing and managing privileged credentials.
  • X4 Credential Approval designed to provide agencies with a functional understanding of approving credential requests.
  • P1 Splunk dashboard introduction.
  • P2 Splunk Integration
Specialty Areas: Cyber Defense Infrastructure Support Level: Basic
+ Course Modules/Units
 
X1 An introduction into the PRIVMGMT solution and how it aligns to CDM goals.
X2 General use of the web portal for requesting, accessing and managing privileged credentials.
X4 Credential Approval designed to provide agencies with a functional understanding of approving credential requests.
P1 Splunk dashboard introduction.
P2 Splunk Integration.
Course Lifetime ExpiringCDM PRIVMGMT: CyberArk for Network Operations Center (LT6)  2 hoursSkill Level: Beginner
+ Description
 Privilege Access Management (PRIVMGMT) course is designed for managers of privileged users. This course contains 5 learning tracks:
  • C1 An introduction into the PRIVMGMT solution and how it aligns to CDM goals.
  • C2 General use of the web portal for requesting, accessing and managing privileged credentials.
  • C4 Credential Approval designed to provide agencies with a functional understanding of approving credential requests.
  • P1 Splunk dashboard introduction.
  • P2 Splunk Integration
Specialty Areas: Cyber Defense Infrastructure Support Level: Basic
+ Course Modules/Units
 
C1 An introduction into the PRIVMGMT solution and how it aligns to CDM goals.
C2 General use of the web portal for requesting, accessing and managing privileged credentials.
C4 Credential Approval designed to provide agencies with a functional understanding of approving credential requests.
P1 Splunk dashboard introduction.
P2 Splunk Integration.
Course Lifetime ExpiringCDM_PRIVMGMT: SailPoint for SailPoint Administrators (LT7) 2 hoursSkill Level: Beginner
+ Description
 Privilege Access Management (PRIVMGMT) course is designed for managers of privileged users. This course contains 4 learning tracks:
  • S1 SailPoint Introduction covers the UI and highlights how to locate an Identity Attribute
  • S2 SailPoint Administration I covers configuring Applications and Tasks.
  • S3 SailPoint Administration II covers Target Applications and Connectors
  • S4 SailPoint Administration III includes the ability to run, schedule and review reports.
Specialty Areas: Cyber Defense Infrastructure Support Level: Basic
+ Course Modules/Units
 
S1 SailPoint Introduction covers the UI and highlights how to locate an Identity Attribute.
S2 SailPoint Administration I covers configuring Applications and Tasks.
S3 SailPoint Administration II covers Target Applications and Connectors.
S4 SailPoint Administration III includes the ability to run, schedule and review reports.
Course Lifetime ExpiringCDM PRIVMGMT: CA PAM Administrator (LT8) 4 hoursSkill Level: Advanced
+ Description
 Privilege Access Management (PRIVMGMT) course is designed for personnel responsible for the overall operation and management of Xceedium. Personnel in this role would perform tasks such as managing users, devices, applications, credentials and disaster recovery scenarios. This course contains 8 learning tracks:
    X1 An introduction into the PRIVMGMT solution and how it aligns to CDM goals. X2 General use of the web portal for requesting, accessing and managing privileged credentials. X3 Account management features which include account reconciliation and password management. X4 Credential Approval designed to provide agencies with a functional understanding of approving credential requests. X5 Administration I covers how to add new users, devices, organize groups and connect to external resources such as LDAP. X6 Administration II provides users with the ability to create and configure application or services and setup policies. X7 Administration III covers how to run reports and schedule reports, locate/manage log files, perform session management and locate troubleshooting tools. X8 Administration IV provides users with an understanding of how to manage disaster recovery features.
Specialty Areas: Cyber Defense Infrastructure Support Level: Advanced
+ Course Modules/Units
 
X1 An introduction into the PRIVMGMT solution and how it aligns to CDM goals.
X2 General use of the web portal for requesting, accessing and managing privileged credentials.
X3 Account management features which include account reconciliation and password management.
X4 Credential Approval designed to provide agencies with a functional understanding of approving credential requests.
X5 Administration I covers how to add new users, devices, organize groups and connect to external resources such as LDAP.
X6 Administration II provides users with the ability to create and configure application or services and setup policies.
X7 Administration III covers how to run reports and schedule reports, locate/manage log files, perform session management and locate troubleshooting tools.
X8 Administration IV provides users with an understanding of how to manage disaster recovery features.
Course Lifetime ExpiringCDM PRIVMGMT: CyberArk Administrators (LT8) 4 hoursSkill Level: Advanced
+ Description
 Privilege Access Management (PRIVMGMT) course is designed for personnel responsible for the overall operation and management of CyberArk. Personnel in this role would perform tasks such as managing users, devices, applications, credentials and disaster recovery scenarios. This course contains 8 learning tracks:
  • C1 An introduction into the PRIVMGMT solution and how it aligns to CDM goals.
  • C2 General use of the web portal for requesting, accessing and managing privileged credentials.
  • C3 Account management features which include account reconciliation and password management.
  • C4 Credential Approval designed to provide agencies with a functional understanding of approving credential requests.
  • C5 Administration I covers how to add new users, devices, organize groups and connect to external resources such as LDAP.
  • C6 Administration II (Part 1 and 2) provides users with the ability to create and manage platforms and safes, configure master policies as well as an in-depth look into safe design.
  • C7 Administration III covers how to run reports in the PVWA, operate the PrivateArk Client and how to locate and manage log files.
  • C8 Administration IV provides users with an understanding of how to manage disaster recovery features.
Specialty Areas: Cyber Defense Infrastructure Support Level: Advanced
+ Course Modules/Units
 
C1 An introduction into the PRIVMGMT solution and how it aligns to CDM goals.
C2 General use of the web portal for requesting, accessing and managing privileged credentials.
C3 Account management features which include account reconciliation and password management.
C4 Credential Approval designed to provide agencies with a functional understanding of approving credential requests.
C5 Administration I covers how to add new users, devices, organize groups and connect to external resources such as LDAP.
C6 Administration II Part 1 provides users with the ability to create and manage platforms and safes, configure master policies as well as an in-depth look into safe design.
C6 Administration II Part 2 provides users with the ability to create and manage platforms and safes, configure master policies as well as an in-depth look into safe design.
C7 Administration III covers how to run reports in the PVWA, operate the PrivateArk Client and how to locate and manage log files.
C8 Administration IV provides users with an understanding of how to manage disaster recovery features.
CMaaS Overview 0.5 HoursSkill Level: Beginner
+ Description
 

This course is designed for managers, staff, and other stakeholders who may be involved in implementation and/or decision making regarding Continuous Diagnostics and Mitigation (CDM). This course explains how Continuous Monitoring as a Service (CMaaS) relates to the Continuous Diagnostics and Mitigation (CDM) program.

Date: 2016

Training Purpose: Skill Development

Training Proficiency Area: Level 0 - Introduction

Alignment to the NIST SP 800-181 Cybersecurity Workforce Framework

CategorySpecialty AreaWork Roles
Protect and Defend Cyber Defense Analysis Cyber Defense Analyst
Protect and Defend Cyber Defense Infrastructure Support Cyber Defense Infrastructure Support Specialist
Protect and Defend Incident Response Cyber Defense Incident Responder
Protect and Defend Vulnerability Assessment and Management Vulnerability Assessment Analyst
+ Course Modules/Units
 
Lesson 1 - Continuous Diagnostics and Mitigation (Video)
Lesson 2 - The Problem (Infographic)
Lesson 3 - How CDM Phase 1 Capabilities Support CDM Goals (Infographic)
Lesson 4 - How CDM Phase 1 Capabilities Work Together (Infographic)
Lesson 5 - CDM Phase 1 Capabilities Scope (Infographic)
Lesson 6 - Overview of Continuous Monitoring as a Service (Video)
Lesson 7 - How the CDM Capabilities Were Defined
Lesson 8 - ISCM Policy and Guidance Timeline
CMaaS Technical Overview Course 0.5 HoursSkill Level: Beginner
+ Description
 

This course is designed for managers, staff, and other stakeholders who may be involved in implementation and/or decision making regarding Continuous Diagnostics and Mitigation (CDM). The course aims to help the learner better understand how Continuous Monitoring as a Service (CMaaS) will be implemented in DHS Component networks.

Date: 2017

Training Purpose: Skill Development

Training Proficiency Area: Level 1 - Basic

Alignment to the NIST SP 800-181 Cybersecurity Workforce Framework

CategorySpecialty AreaWork Roles
Protect and Defend Cyber Defense Analysis Cyber Defense Analyst
Protect and Defend Cyber Defense Infrastructure Support Cyber Defense Infrastructure Support Specialist
Protect and Defend Incident Response Cyber Defense Incident Responder
Protect and Defend Vulnerability Assessment and Management Vulnerability Assessment Analyst
+ Course Modules/Units
 
Lesson 1: CMaaS Technology Stack Overview (Video)
Lesson 2: Central Management Enclave Firewall Requirements (Infographic)
Lesson 3: Component Management Enclave Firewall Requirements (Infographic)
Lesson 4: Hardware Sensors Firewall Requirements 1 of 2 (Infographic)
Lesson 5: Hardware Sensors Firewall Requirements 2 of 2 (Infographic)
Lesson 6: Software Sensors Firewall Requirements (Infographic)
Lesson 7: Considerations for Initial CMaaS Deployment (Infographic)
Lesson 8: CMaaS Deployment Overview (Infographic)
CMaaS Transition Classroom Sessions 5 HoursSkill Level: Beginner
+ Description
 

This course is part of the CMaaS transitional webinar series conducted via WebEx. Each video focuses on a single tool within the CMaaS solution stack and includes two major Use Cases for each tool.

Date: 2018

Training Purpose: Skill Development

Training Proficiency Area: Level 1 - Basic

Alignment to the NIST SP 800-181 Cybersecurity Workforce Framework

CategorySpecialty AreaWork Roles
Protect and Defend Cyber Defense Analysis Cyber Defense Analyst
Protect and Defend Cyber Defense Infrastructure Support Cyber Defense Infrastructure Support Specialist
Protect and Defend Incident Response Cyber Defense Incident Responder
Protect and Defend Vulnerability Assessment and Management Vulnerability Assessment Analyst
+ Course Modules/Units
 
Session 1
Session 2
Session 3
Session 4
Critical Infrastructure Protection 2 HoursSkill Level: Beginner   
+ Description
 

This course discusses the influence, impact, and need for cybersecurity when defending the critical infrastructure and key resources of the United States. This course provides the definition of critical infrastructure, examples of cybersecurity threats to critical infrastructure, and information on what is being done to protect critical infrastructure from these cybersecurity threats.

Learning Objectives:

  • Define and give examples of critical infrastructure.
  • Identify possible cyber threats to critical infrastructure.
  • Describe U.S. cybersecurity policies and programs.
  • Explain the cybersecurity roles of the Department of Homeland Security (DHS) and other Federal agencies.

Date: 2017

Training Purpose: Skill Development

Training Proficiency Area: Level 1 - Beginner

Alignment to the NIST SP 800-181 Cybersecurity Workforce Framework

CategorySpecialty AreaWork Roles
Operate and Maintain Network Services Network Operations Specialist
Operate and Maintain Systems Administration Systems Administrator
Operate and Maintain Systems Analysis Systems Analyst
Operate and Maintain Systems Development Information Systems Security Developer
Oversee and Govern Strategic Planning and Polic Cyber Policy and Strategy Planner
Protect and Defend Cyber Defense Infrastructure Support Cyber Defense Infrastructure Support Specialist
Protect and Defend Cyber Defense Analysis Cyber Defense Analyst
Securely Provision Systems Architecture Systems Architect
Securely Provision Technology R&D Research & Development Specialist
Securely Provision Systems Requirements Planning Systems Requirements Planner
Securely Provision Systems Development Systems Developer
+ Course Modules/Units
 
Critical Infrastructure Protection
Cyber Dark Arts 3 HoursSkill Level: Intermediate  
+ Description
 

This course highlights 'dark' or deceptive activities that are employed by malicious users via the Internet. Several legitimate purpose technologies and techniques and how they are leveraged, or manipulated for fraudulent purposes, is discussed. Threats from topics such as zero-day attacks, dark web, alternate OSs, VPN/TOR, weaponized psychology, and anonymous services will be detailed, as well as methods for concealing one’s identity. These methods are taught in order for cybersecurity experts to defend against such attacks. The course includes reinforcing video demonstrations.

Learning Objectives:

  • Explain several techniques for obfuscating online activities.
  • List examples of technologies leveraged for deceptive purposes.
  • Detail best practices for prevention and protection from malicious cyber activities.

Date: 2018

Training Purpose: Skill Development

Training Proficiency Area: Level 2 - Intermediate

Alignment to the NIST SP 800-181 Cybersecurity Workforce Framework

CategorySpecialty AreaWork Roles
Collect and Operate Cyber Operations Cyber Operator
Operate and Maintain Systems Analysis Systems Security Analyst
Protect and Defend Cyber Defense Analysis Cyber Defense Analyst
+ Course Modules/Units
 
Cyber Dark Arts
Weaponized Psychology
DEMO: Password Cracking Using Hydra
Scanning for Vulnerable Devices and Networks
Anonymous Web Hosting, Searching, and Browsing
Alternative Operating Systems
Tails, Whonix, and Qubes
Secure Messaging Services
Blockchain and Cryptocurrency
DEMO: Blockchain and Cryptocurrency
DEMO: Iodine IP over DNS
DEMO: TOR versus Traditional Tunneling
Advanced Persistent Threats
Cyber Dark Arts Exam
Cybersecurity Analyst 12.5 HoursSkill Level: Intermediate 
+ Description
 

The Cybersecurity Analyst course is designed to help reinforce concepts for cyber work roles that require monitoring and information analysis to respond to suspicious events. This intermediate-level course focuses on defense techniques leveraging data and tools to identify risks to an organization, and apply effective mitigation strategies to detect and respond to threats.

Learning Objectives:

  • List common cyber threats and examples of scanning and assessment tools and techniques to identify potential vulnerabilities.
  • Analyze data from various sources to identify vulnerabilities and recommend strategies for mitigation.
  • Configure and implement threat detection tools to detect incidents, and effectively respond and recover.

Date: 2018

Training Purpose: Skill Development

Training Proficiency Area: Level 2 - Intermediate

Alignment to the NIST SP 800-181 Cybersecurity Workforce Framework

CategorySpecialty AreaWork Roles
Analyze Threat Analysis Threat Analyst
Protect and Defend Cybersecurity Defense Analysis Cyber Defense Analyst
Protect and Defend Incident Response Cyber Defense Incident Responder
Protect and Defend Vulnerability Assessment and Management Vulnerability Assessment Analysts
+ Course Modules/Units
 
Reconnaissance
Port Scanning for Active Reconnaissance
Environmental Reconnaissance Tools
Social Engineering for Reconnaissance
Network Mapping for Active Reconnaissance
Syslog
Reviewing Alerts/Detecting Attack Phases
Common Tasks in Environmental Reconnaissance
Environmental Reconnaisannce Variables
Basic Packet Analysis
Methods of Network Traffic Analysis
Network Traffic Analysis
Netflows
Working with Netflows
Netflow Tools
Examining Log Files
Data Correlation and Analytics
Analyzing Device Data
SIEM
DEMO: Wireshark Packet Analyzer
Hardening Network Devices
Network Segmentation and Design
Honeypot
Endpoint Security
Windows Group Policy
Access Control Models
Remote Authentication - Radius and Tacacs+
Hardening Host and Networked Systems
Compensating Controls
Corporate Penetration Testing
Reverse Engineering Purpose and Practice
Team Training and Exercises
Risk Evaluation and Security Controls
Vulnerability Assessment Introduction
Vulnerability Management Requirements
Vulnerability Scanner Configuration
Vulnerability Assessment Tools
Scanning and Enumeration with Nmap
Intro to Vulnerability Scanning with Nessus
Vulnerability Remediation
Scanning and Report Viewing with OpenVAS
Endpoint and Protocol Analysis
Logging Strategies and Sources
Reviewing, Analyzing and Correlating Logs
Network Vulnerabilities
System Vulnerabilities
Web Application Vulnerabilities
Wireless Network Vulnerabilities
Virtual Infrastructure Vulnerabilities
Threats to Mobile Devices
ICS and SCADA Systems Security
Malware and Social Engineering Threats
Preparing for Impact Analysis
Forensics Kit and Incident Response
Forensic Investigation Suite
Setting Up an Analysis Environment
Communication During Incident Response
Common Symptoms of Host Infection
Incident Response and Recovery Part 1 of 2
Incident Response and Recovery Part 2 of 2
Regulatory Compliance and Frameworks
Control Selection Tailoring and Implementation
Verification and Quality Control
Procedures Supporting Policy
Enterprise Network Authentication Part 1 of 2
Enterprise Network Authentication Part 2 of 2
Cross-site Scripting and Other Exploits
Privilege Escalation Exploit
Technical Processes and Controls
Software Development Models and SDLC
Code Review and Testing
Secure Coding Best Practice Resources
Preventative Cyber Tools
Collective Cyber Tools
Analytical Cyber Tools
Exploit Cyber Tools
Forensics Cyber Tools
Course Test
Cyber Security Investigations 9 HoursSkill Level: Beginner  
+ Description
 

This course discusses the basic concepts of cybersecurity and digital forensics investigation practices. Topics include performing collection and triage of digital evidence in response to an incident, evidence collection methodologies, and forensic best practices. This is an introductory course reviewing the processes, methods, techniques, and tools in support of cyber security investigations.

Learning Objectives:

  • Understand the process of integrating forensics collection and analysis program into an organization.
  • Recognize concepts involved in the Forensic Process.
  • Apply necessary preparation to perform collections and incident response according to best practices.
  • Understand methods, goals and objectives for digital forensic collection activities.
  • Apply techniques and tools for conducting evidence collection, triage, and log analysis.

Date: 2015

Training Purpose: Functional Development

Training Proficiency Area: Level 1 - Beginner

Alignment to the NIST SP 800-181 Cybersecurity Workforce Framework

CategorySpecialty AreaWork Roles
Collect and Operate Cyber Operations Cyber Operator
Investigate Cyber Investigation Cyber Crime Investigator
Investigate Digital Forensics Cyber Defense Forensics Analyst
Protect and Defend Incident Response Cyber Defense Incident Responder
+ Course Modules/Units
 
Purpose of Computer and Network Forensics
Digital Forensics Tools
Forensics Team Staffing Considerations
Digital Forensics Guidelines, Policies, and Procedures
Digital Forensics Life Cycle
Digital Forensics Best Practices
Digital Forensics Concepts
Locard's Exchange Principle
Incident Response Phases Part 1 of 3
Incident Response Phases Part 2 of 3
Incident Response Phases Part 3 of 3
Computer Forensics Process Part 1 of 2
Computer Forensics Process Part 2 of 2
Digital Forensic Planning and Preparation
IR and Digital Forensics Tools
Forensically Prepared Media, Tools and Equipment
Incident Response Information Gathering
Incident Response Acquisition Considerations
Incident Response Notes and Documentation
Auditing Windows Event Logs
Volatile Data Collection
Storage Media Collection
Network Data Collection
Log Collection
Data Carving using FTK
Digital Forensic Triage Overview
Incident Triage Process
Incident Triage Methodology
Attacker Methodology Overview Part 1 of 3
Attacker Methodology Overview Part 2 of 3
Attacker Methodology Overview Part 3 of 3
Triage: Light and General Collections
Triage Analysis
Triage Analysis of Volatile Data
Program Execution
Analyzing Services
Malware Vectors and Detection
Mobile Device Triage Analysis
IR: Following a Trail
Hash and File Signature Analysis
Time Analysis
Registry Analysis
File Analysis Demonstration
Hashing with md5deep
Hash Analysis with Autopsy
Lessons Learned from an Incident
Lessons Learned from Objective and Subjective Data
Evidence Retention and Information Sharing Post Incident
Cyber Security Investigations Exam
Cybersecurity for Technical Staff 17.5 HoursSkill Level: Beginner 
+ Description
 

This course highlights best practices applicable to a wide variety cybersecurity job roles. Topics include risk management, architecture and design, and tools and technologies. This course also covers key concepts for detecting, protecting, and defending from security threats.

Learning Objectives:

  • List common cyber threats and how scanning and assessment tools and techniques identify potential vulnerabilities.
  • Explain how various tools and technologies are configured or deployed to support an organization's security posture.
  • Detail risk management best practices and mitigation strategies.

Date: 2018

Training Purpose: Skill Development

Training Proficiency Area: Level 1 - Beginner

Alignment to the NIST SP 800-181 Cybersecurity Workforce Framework

CategorySpecialty AreaWork Roles
Operate and Maintain Network Services Network Operations Specialist
Operate and Maintain Systems Administration Systems Administrator
Operate and Maintain Systems Analysis Systems Security Analyst
Protect and Defend Incident Response Cyber Defense Incident Responder
Protect and Defend Vulnerability Assessment and Management Vulnerability Assessment Analyst
+ Course Modules/Units
 
Malware: Viruses
Malware: Rootkits, Trojans, Botnets
MITM, DoS, Packet Flooding and Other Attacks
Backdoor, Spoofing, Replay and Other Attacks
Password, Birthday, Crypto and Application Attacks
Social Engineering Techniques
Wireless Attacks
Application Attacks
Threat Actors
Assessment Tools and Techniques
Active and Passive Reconnaissance
Security Testing and Assessment
Firewall Implementations
Proxy Server Implementations
Hubs and Switches
Routers and Routing Protocols
Remote Access and VPNs Part 1 of 2
Remote Access and VPNs Part 2 of 2
Network Intrusion Detection Systems
Host-Based Intrusion Detection Systems
Password Cracking Categories and Tools
Password Cracking Techniques
DEMO: Local Information Gathering Tools
DEMO: Network Connectivity Testing Tools
DEMO: Remote Information Gathering Tools
Mobile Device Security
Mobile Device Deployment
Network Security Protocols
Network Services and Protocols
Frameworks and Reference Architectures
Network Zones
Demilitarized Zones (DMZ) Implementations
Security Device and Technology Placement
Host Security: OS Hardening and Firewalls
Host Security: Anti Virus, Malware and Spam
Host Security: Pop Ups and Patch Management
Secure Static Environment
Secure Staging Deployment Concepts
Cloud and Virtualization Concepts
Cloud Architectures
Host Security: Virtualization
Resiliency and Automation to Reduce Risk
Physical Security and Environmental Controls
Access Control Categories
Authentication Services
Access Control Models
Authentication and Authorization Concepts
Biometric Authentication
Account Management
Identity Management
Security Awareness and Training
Risk and Related Concepts
Risk and Asset Identification
Threat and Risk Calculation
Risk Control Types
Security Control Types and Categories
Basic Forensics Procedures
Incident Handling and Forensics
Incident Response Preparation
Risk Management: Business Continuity
Risk Management: Redundancy and Fault Tolerance
Risk Management: Disaster Recovery
Risk Mitigation Strategies
Data Security
Data Destruction and Disposal Methods
Data Sensitivity and Handling
Mitigation and Deterrence: Logging
Mitigation and Deterrence: Hardening
Mitigation and Deterrence: Network Security
Mitigation and Deterrence: Attack Countermeasures
Cryptography Part 1 of 2
Cryptography Part 2 of 2
Wireless Security Evolution
Wireless Security Best Practices
Cryptographic Keys and PKI
Course Test
Cyber Supply Chain Risk Management 2 HoursSkill Level: Beginner  
+ Description
 

This course focuses on cyber supply chain risk management, also known as C-SCRM, and the role it plays within our society today. This course will explain how to securely provision, analyze, oversee and govern, protect and defend a supply chain.

Learning Objectives:

  • Describe product supply chains and life cycles.
  • Identify the role of adversaries in supply chain risk management.
  • Define the risks associated with supply chains.
  • State the principles of supply chain management.
  • Identify security measures taken to protect a supply chain.
  • Apply suggested tools to address supply chain vulnerabilities.
  • Explain how knowledge of the "internet of things" (IoT) is used to evaluate products as IoT devices.
  • Recognize potential dangers posed by various devices brought to work.
  • Identify the threats outlined for acquisitions personnel through the Federal Acquisition Regulation (FAR).
  • Define how to personally safeguard your organization’s cybersecurity.

Date: 2019

Training Purpose: Skill Development

Training Proficiency Area: Level 1 - Beginner

Alignment to the NIST SP 800-181 Cybersecurity Workforce Framework

CategorySpecialty AreaWork Roles
Analyze All-Source Analysis All-Source Analyst
Analyze Exploitation Analysis Exploitation Analyst
Analyze Threat Analysis Threat/Warning Analysis
Analyze Targets Target Developer, Target Network Analyst
Oversee and Govern Program/Project Management and Acquisition Program Manager
Oversee and Govern Strategic Planning and Policy Cyber Policy and Strategy Planner
Oversee and Govern Cybersecurity Management Information Systems Security Manager
Protect and Defend Cyber Defense Analysis Cyber Defense Analyst
Protect and Defend Cyber Defense Infrastructure Support Cyber Defense Infrastructure Support Specialist
Securely Provision Software Development Software Developer
Securely Provision Systems Development Systems Developer
+ Course Modules/Units
 
Supply Chain Risk Management
Demilitarized Zone (DMZ) with IDS/IPS 9 HoursSkill Level: Intermediate 
+ Description
 

This course introduces the concept of a network Demilitarized Zone (DMZ) and the security benefits it can provide. This course focuses on best practices for designing and implementing a DMZ and includes a section on Intrusion Detection Systems (IDS) and Intrusion Protection Systems (IPS) that provides an in-depth look at SNORT for network monitoring. The course concludes with log analysis and management best practices.

Learning Objectives:

  • Present an overview of the DMZ security model and key components.
  • Discuss DMZ structure, purpose, and operation.
  • Present different models for implementation to meet network requirements.
  • Discuss the network threats that a DMZ can detect and mitigate.

Date: 2013

Training Purpose: Skill Development

Training Proficiency Area: Level 2 - Intermediate

Alignment to the NIST SP 800-181 Cybersecurity Workforce Framework

CategorySpecialty AreaWork Roles
Operate and Maintain Network Services Network Operations Specialist
Operate and Maintain Systems Analysis Systems Security Analyst
Operate and Maintain Systems Administration Systems Administrator
Protect and Defend Cyber Defense Infrastructure Support Cyber Defense Infrastructure Support Specialist
+ Course Modules/Units
 
Demilitarized Zone (DMZ) Introduction
DMZ Architecture
DMZ Components: Firewalls Part 1 of 2
DMZ Components: Firewalls Part 2 of 2
Setting up a DMZ using IPTables Demo
DMZ Components: IDS
DMZ Components: IDS/IPS Placement
DMZ Components: Proxy Servers
DMZ Components: Network Servers
DMZ Architectures
Attacking the DMZ Part 1 of 2
Attacking the DMZ Part 2 of 2
DMZ Attack Types Part 1 of 2
DMZ Attack Types Part 2 of 2
DMZ: Open Source vs Commercial Implementations
DMZ: Software Subscription Services
Open Source DMZ Tools Part 1 of 2
Open Source DMZ Tools Part 2 of 2
Proxy Concepts
DNS Concepts
Web Server Concepts
E-mail Relay and VPN Concepts
DMZ and Commercial Software - Part 1
DMZ and Commercial Software - Part 2
Security Capabilities in a DMZ
Security Capabilities in Procmail Demo
Network Security Appliances IDS
Snort Intro and Overview
Using BASE w Snort DB
Snort Demo
Log Mgmt and Analysis Concepts
SYSLOG Basics
Using Swatch Overview
Log Management Best Practices
Proxy and DNS Log File Concepts
Analyzing Proxy and DNS Log Files
DMZ with IDS/IPS Course Quiz
Don't Wake Up to a Ransomware Attack 1 HoursSkill Level: Beginner 
+ Description
 

Ransomware attacks hit a new target every 14 seconds: shutting down digital operations, stealing information and exploiting businesses, essential services and individuals alike. "Don't Wake Up to a Ransomware Attack" provides essential knowledge and reviews real-life examples of these attacks to help you and your organization to prevent, mitigate, and respond to the ever-evolving threat of ransomware.

This webinar includes the following information and more:

  • Definition of ransomware, summary of its large-scale impacts, and how these attacks have developed over time
  • Common signs of a ransomware attack and how to respond if an attack is suspected
  • Guidance for how to mitigate the impact of ransomware attacks and recover in the event of an attack
  • Case studies demonstrating the impacts of ransomware attacks
  • A concluding Knowledge Check to reinforce understanding and key takeaways

Learning Objectives:
Enable learners to prevent, flag, and protect themselves and their organizations from ransomware cyberattacks through awareness of common attack schemes, best practices, CISA guidance, and resources.

  • Define ransomware
  • Be able to identify signs of a ransomware attack
  • Learn mitigation steps of ransomware attacks
  • Understand how to recover from a ransomware attack
  • Understand impacts of ransomware attacks though case studies

Date: 2020

Training Proficiency Area: Level 1 - Beginner

Training Purpose: Skill Development

Alignment to the NIST SP 800-181 Cybersecurity Workforce Framework

CategorySpecialty AreaWork Roles
Analyze All-Source Analysis Mission Assessment Specialist
Analyze Exploitation Analysis Exploitation Analyst
Analyze Threat Analysis Threat/ warning analyst
Collect and Operate Collection Operations All-Source Collection Manager, All-Source Collection Requirements Manager
Investigate Digital Forensics Cyber Defense Forensics Analyst; Law Enforcement/ Counterintelligence Forensics Analyst
Operate and Maintain Customer Service and Technical Support Technical Support Specialist
Operate and Maintain Data Administration Data analyst, database administrator
Operate and Maintain Systems Administration System Administrator
Operate and Maintain Knowledge Management Knowledge Manager
Operate and Maintain Network Services Network Operations Specialist
Operate and Maintain Systems Administration System Administrator
Operate and Maintain Systems Analysis Systems Security Analyst
Oversee and Govern Cybersecurity Management Communications security manager; information systems security manager
Oversee and Govern Executive Cyber Leadership Executive Cyber Leadership
Oversee and Govern Program Management and Acquisition IT investment manager, IT program auditor, IT project manager, product support manager, program manager
Oversee and Govern Training, Education, and Awareness Cyber Instructional Curriculum Developer
Protect and Defend Cyber Defense Analysis Cyber Defense Analyst
Protect and Defend Cyber Defense Infrastructure Support Cyber Defense Infrastructure Support specialist
Protect and Defend Incident Response Cyber defense incident responder
Protect and Defend Vulnerability Assessment and Management Vulnerability assessment analyst
Securely Provision Risk Management Authorizing official; security control assessor
Securely Provision Systems Architecture Enterprise Architect, Security Architect
Securely Provision Systems Requirements Planning Systems Requirements Planner
Securely Provision Test and Evaluation System Testing and Evaluation Specialist
+ Course Modules/Units
 
Don’t Wake Up to a Ransomware Attack
Elections and IT Embrace your role as a Manager - 3.5 HoursSkill Level: Beginner  
+ Description
 

This course is a collaboration between the U.S. Election Assistance Commission (EAC) and the U.S. Department of Homeland Security (DHS) and provides an opportunity to learn why election officials must view themselves as IT managers. The course serves as an overview of information technology and how to ensure security is included in the planning, procuring, designing, implementing, and maintaining of interconnected electronic election systems, including public-facing websites. The content introduces the key concepts of identifying vulnerabilities and how to protect election systems from internal and external threats and provides information on cybersecurity resources available from the EAC and DHS.

Date: 2018

Training Purpose: Management Development

Training Proficiency Area: Level 1 - Beginner

Alignment to the NIST SP 800-181 Cybersecurity Workforce Framework

CategorySpecialty AreaWork Roles
Oversee and Govern Cybersecurity Management Information Systems Security Manager
Protect and Defend Incident Response Cyber Defense Incident Responder
Securely Provision Risk Management Authorizing Official/Designating Representative
+ Course Modules/Units
 
Professionalizing Election Admin Intro
Being an IT Manager
Election Systems
Procuring IT
Testing and Audits
Election Security
Principles of Information Security
Cybersecurity and Elections
Risk Management and Elections
Phishing and Elections
Election Infrastructure Security
DHS Cyber Security Tools and Services
EAC Resources
The Election Official as IT Manager 4 HoursSkill Level: Beginner  
+ Description
 

This course focuses on why Election Officials must view themselves as IT systems managers and introduces the knowledge and skills necessary to effectively function as an IT manager. Th ecourse includes a review of Election Systems, Election Night Reporting, and Interconnected Election Systems vulnerabilities and liabilities. The content also covers Social Media and Website best practices, vulnerabilities, and liabilities, and addresses Procuring IT, Vendor Selection, Testing and Audits, Security Measures, and Risk Assessments. In addition, this course includes a review of resources available to the election community from the Department of Homeland Security.

Date: 2018

Training Purpose: Management Development

Training Proficiency Area: Level 1 - Beginner

Alignment to the NIST SP 800-181 Cybersecurity Workforce Framework

CategorySpecialty AreaWork Roles
Oversee and Govern Cybersecurity Management Information Systems Security Manager
Protect and Defend Incident Response Cyber Defense Incident Responder
Securely Provision Risk Management Authorizing Official/Designating Representative
+ Course Modules/Units
 
Professionalizing Election Admin Intro
Being an IT Manager
Election Systems
Technology and the Election Office
Procuring IT
Testing and Audits
Election Security
Principles of Information Security
Physical Security
Cybersecurity and Elections
Human Security
Risk Management and Elections
Incident Response Scenarios and Exercises
Phishing and Elections
DDOS Attacks and Elections
Website Defacing
Election Infrastructure Security
DHS Cyber Security Tools and Services
EAC Resources
Emerging Cyber Security Threats 12 HoursSkill Level: Intermediate   
+ Description
 

This course covers a broad range of cybersecurity elements that pose threats to information security posture. The various threats are covered in detail, followed by mitigation strategies and best practices. It will cover what the policies are, the roles it plays in cybersecurity, how they are implemented. The course will also look at cybersecurity laws, standards, and initiatives. Topics include policy, knowing your enemy, mobile device security, cloud computing security, Radio Frequency Identification (RFID) security, LAN security using switch features, securing the network perimeter, securing infrastructure devices, security and DNS and IPv6 security. Video demonstrations are included to reinforce concepts.

Date: 2010

Training Purpose: Skill Development

Training Proficiency Area: Level 2 - Intermediate

Alignment to the NIST SP 800-181 Cybersecurity Workforce Framework

CategorySpecialty AreaWork Roles
Analyze Threat Analysis Threat/Warning Analysis
Operate and Maintain Systems Administration Systems Administrator
Oversee and Govern Strategic Planning and Policy Cyber Policy and Strategy Planner
Protect and Defend Vulnerability Assessment and Management Vulnerability Assessment Analyst
+ Course Modules/Units
 
Introduction to Cybersecurity Policy
Types of Security Policy
Policy Education and Implementation
Cybersecurity Laws
Proposed Legislation
NIST Cybersecurity Standards
Other Cybersecurity Standards
Comprehensive National Cybersecurity Initiatives (CNCI)
Other Federal Cybersecurity Initiatives
Implementing Cybersecurity Initiatives
SPAM
Malware Trends
Botnets
Monetization
Cyber Attack Profiles
Cyber Crime
Cyberwarfare
Cyber Attack Attribution
Cyber Threat Mitigation
Mobile Device Trends
Mobile Device Threats
Mobile Device Countermeasures
Exploited Threats
What is Cloud Computing?
Technical Risks
Operational Risks
Risk Mitigation Strategies
DISA Cloud Solutions
RFID Introduction
RFID Threats
RFID Countermeasures
Exploited Threats
Introduction and MAC Address Monitoring
MAC Address Spoofing
Managing Traffic Flows
VLANs and Security
802.1x Port Authentication
Network Admission Control
Securing STP
Securing VLANs and VTP
Introduction and Edge Security Traffic Design
Blocking DoS and DDoS Traffic
Specialized Access Control Lists
Routers with Firewalls
Beyond Firewalls: Inspecting Layer 4 and Above
Securing Routing Protocols and Traffic Prioritization
Securing Against Single Point of Failures
Physical and Operating System Security
Management Traffic Security
Device Service Hardening
Securing Management Services
Device Access Hardening
Device Access Privileges
Name Resolution Introduction
Name Resolution and Security
DNS Cache
DNS Security Standards and TSIG
DNSSEC
Migrating to DNSSEC
Issues with Implementing DNSSEC 1
Issues with Implementing DNSSEC 2
IPv6 Concepts
IPv6 Threats
IPv6 Network Reconnaissance
DEMO: IPv6 Network Reconnaissance
IPv6 Network Recon Mitigation Strategies
IPv6 Network Mapping
DEMO: IPv6 Network Mapping
IPv6 Network Mapping Mitigation Strategies
IPv6 Neighbor Discovery
DEMO: IPv6 Address Assignment
IPv6 Attacks
DEMO: IPv6 Alive Hosts
DEMO: IPv6 Duplicate Address Detection (DAD)
DEMO: IPv6 DAD Denial of Services (DOS)
DEMO: IPv6 Fake Router Advertisement
DEMO: IPv6 Man-in-the-middle
IPv6 Attack Mitigation Strategies
IPv6 Tunneling
IPv6 Windows Teredo Tunneling
IPv6 Tunneling Mitigation Strategies
IPv6 Best Practices
Foundations of Incident Management 10.5 HoursSkill Level: Beginner 
+ Description
 

This course introduces basic concepts and functions of incident management. This includes where incident management activities fit in the information assurance or information security ecosystem and covers the key steps in the incident handling lifecycle with practices to enable a resilient incident management capability.

Learning Objectives:

  • Explain the role of incident management.
  • Distinguish between incident management and incident handling.
  • Outline the incident handling lifecycle.
  • Identify key preparations to be established to facilitate incident handling.
  • Distinguish between triage and analysis.
  • Identify the basic steps in response.

Date: 2015

Training Purpose: Functional Development

Training Proficiency Area: Level 1 - Beginner

Alignment to the NIST SP 800-181 Cybersecurity Workforce Framework

CategorySpecialty AreaWork Roles
Analyze Threat Analysis Threat/Warning Analyst
Protect and Defend Cyber Defense Analysis Cyber Defense Analyst
Protect and Defend Incident Response Cyber Defense Incident Responder
+ Course Modules/Units
 
Foundations of Incident Management Course Intro
Framing The Need For Incident Management
Incident Management Terms and Processes
Institutionalizing Incident Management Capabilities
Stakeholders in Incident Management
CERT and Other’s Perspective on Threats and Trends
Incident Management Terminology
Incident Management Attack Classes and Actors
Incident Management Malware and DoS Examples
Incident Management Prevention, Detection, and Response
Incident Handling Lifecycle - Prepare
Incident Handling Information
Analyzing Attack Information
Incident Management Monitoring Tools
Incident Management Detection Process
Process to Support Incident Detection and Reporting
What is Situational Awareness?
Non Technical Elements of Situational Awareness
Technical Elements of Situational Awareness
Using Sensors for Requirements Gathering
Incident Handling Lifecycle: Analysis
Incident Handling Lifecycle: Triage
Questions Addressed in Triage
Objectives of Incident Analysis
Tasks of Incident Analysis Part 1 of 2
Tasks of Incident Analysis Part 2 of 2
Data Sources for Analysis
Examples of Data Sources for Analysis
Incident Analysis Exercise Scenario
Preparing For Impact Analysis
Conducting Impact Analysis
Response and Recovery Part 1 of 2
Response and Recovery Part 2 of 2
Mission of the Response Process
Coordinating Response Part 1 of 2
Coordinating Response Part 2 of 2
Sample Attack Mitigations
Benefits and Motivations of Information Sharing
Methods of Information Sharing
Data Models for Information Sharing
STIX/TAXII Protocol
Foundations of Incident Handling Course Summary
Foundations of Incident Management Course Exam
Fundamentals of Cyber Risk Management 6 HoursSkill Level: Beginner  
+ Description
 

This course focuses on key concepts, issues, and considerations for managing risk. Discussions include identifying critical assets and operations, risk assessment and analysis methodologies, risk management frameworks, and how to determine threats to your business function, mitigation strategies, and response and recovery.

Learning Objectives:

  • Describe key concepts related to cyber risk management.
  • Detail risk assessment and analysis methodologies and frameworks.
  • Identify security controls and countermeasures to mitigate risks and support response and recovery.

Date: 2020

Training Purpose: Skill Development

Training Proficiency Area: Level 1 - Beginner

Alignment to the NIST SP 800-181 Cybersecurity Workforce Framework

CategorySpecialty AreaWork Roles
Oversee and Govern Cybersecurity Management Information Systems Security Manager
Protect and Defend Incident Response Cyber Defense Incident Responder
Securely Provision Risk Management Security Control Assessor
+ Course Modules/Units
 
Fundamentals of Cyber Risk Management Course Introduction
Risk Management Overview
Standards for Risk Management
OCTAVE
CERT Resilience Management Model Overview
Critical Assets and Operations
Threat Overview
Vulnerabilities
Threat Scenarios
Risk and Impact Analysis
Considerations for Responding to Risks
Risk Mitigation Strategies
Control Methods and Types of Security Controls
Administrative Controls
Selecting Security Controls
Security Control Assessment
Mitigation Strategy and Maintenance
Security Testing and Assessments
Incident Response Terms and Life Cycle
Incident Response Phase 1 of 6 - Preparation
Incident Response Phase 2 of 6 – Detection and Analysis
Incident Response Phase 3 of 6 – Containment
Incident Response Phases 4-5 of 6 – Eradication and Recovery
Incident Response Phase 6 of 6 – Lessons Learned
Business Continuity Plans and Procedures
Disaster Recovery Plans and Procedures
Fundamentals of Cyber Risk Management Exam
Incident Response 101 1 HourSkill Level: Beginner  
+ Description
 

This course focuses on cyberattacks, specifically compromises via ransomware. Implementing strategies to defend against attacks as well as preparations for response and recovery in the event of an incident is critical to an organization’s resilience. This course reviews malware types and vectors for compromise, common issues hindering an effective response, best practices for preparing and responding to an infection incident, and defensive measures to strengthen the cybersecurity posture.

Learning Objectives:

  • Identify the various types of disruptionware, vectors for compromise, and the impact of an infection on business operations.
  • Recognize the common problems that can hinder effective incident response and prevention activities.
  • Know the ordered steps in following documented incident reporting procedures including immediate actions and communication.
  • Explain the importance of defense-in-depth layered strategy for protecting the enterprise with examples of implementation.

Date: 2020

Training Purpose: Skill Development

Training Proficiency Area: Level 1 - Beginner

Alignment to the NIST SP 800-181 Cybersecurity Workforce Framework

CategorySpecialty AreaWork Roles
Oversee and Govern Cybersecurity Management Information Systems Security Manager
Protect and Defend Incident Response Cyber Defense Incident Responder
+ Course Modules/Units
 
Malware Attacks and Vectors of Compromise
Incident Response - Common Problems/Issues
Ransomware Immediate Infection Response
Incident Response Backups
Cyberattack Defensive Strategies
IR Course Exam
Insider Threat Analysis 6 HoursSkill Level: Advanced 
+ Description
 

This course focuses on helping insider threat analysts understand the nature and structure of data that can be used to prevent, detect, and respond to insider threats. This course focuses on how to work with data from multiple sources to develop indicators of potential insider activity, as well as strategies for developing and implementing an insider threat analysis and response. This course explains the workflow that incorporates expertise and capabilities from across an organization.

Learning Objectives:

  • Work with raw data to identify concerning behaviors and activity of potential insiders.
  • Identify the technical requirements for accessing data for insider threat analysis.
  • Develop insider threat indicators that fuse data from multiple sources.
  • Apply advanced analytics for identifying insider anomalies.
  • Measure the effectiveness of insider threat indicators and anomaly detection methods.
  • Navigate the insider threat tool landscape.
  • Describe the policies, practices, and procedures needed for an insider threat analysis process.
  • Outline the roles and responsibilities of insider threat analysts in an insider threat incident response process.

Date: 2020

Training Purpose: Skill Development

Training Proficiency Area: Level 3 - Advanced

Alignment to the NIST SP 800-181 Cybersecurity Workforce Framework

CategorySpecialty AreaWork Roles
Analyze Threat Analysis Threat/Warning Analyst
Protect and Defend Vulnerability and Assessment Management Vulnerability Assessment Analyst
+ Course Modules/Units
 
Insider Threat Analysis Introduction
Insider Threat Hub Overview
Hub Roles and Responsibilities Part 1 of 2
Hub Roles and Responsibilities Part 2 of 2
Hub Management and Operations
Non-Technical Data Sources Part 1 of 2
Non-Technical Data Sources Part 2 of 2
Technical Data Sources
A Closer Look at Logs
Data Source Prioritization
Indicator Development
Example Analytics
Sequence and Model Development
Insider Threat Anomaly Detection Part 1 of 2
Insider Threat Anomaly Detection Part 2 of 2
Data Correlation and Entity Resolution Part 1 of 2
Data Correlation and Entity Resolution Part 2 of 2
Insider Threat Tools
Insider Threat Mitigation Tools
Meas. Insider Threat Control Efficacy Part 1 of 2
Meas. Insider Threat Control Efficacy Part 2 of 2
Incident Threat Analysis Process
Analyst Workflow
Conducting Analysis
Cognitive Bias
Incident Response
Where Incident Response Fits
Incident Response Options
InTP Incident Response Plans
Insider Threat Ansys Wrap-Up
Introduction to Threat Hunting Teams 1.5 hoursSkill Level: Beginner
+ Description
 

This course provides basic definitions, activities, and examples of teams hunting threats in the cyber domain. The course addresses the differences between hunting team activities and those of incident management teams or penetration testing teams. The content covers how hunting teams establish goals, methods used by threat hunting teams, and sources available to help read and interpret the threat landscape.

Learning Objectives:

  • Define threat hunting, what it means to hunt and how to hunt as a team.
  • Differentiate between hunting teams and other types of cyber security teams.
  • Describe how goals influence the method and success of hunting teams.
  • Recognize the types of threat analysis information available and how to interpret the facts presented.
  • Understand the three types of threat models and explain one in detail.

Date: 2016

Training Purpose: Skill Development

Training Proficiency Area: Level 1 - Beginner

Alignment to the NIST SP 800-181 Cybersecurity Workforce Framework

CategorySpecialty AreaWork Roles
Analyze Threat Analysis Threat/Warning Analyst
Protect and Defend Cyber Defense Analysis Cyber Defense Analyst
Protect and Defend Vulnerability Assessment and Management Vulnerability Assessment Analyst
+ Course Modules/Units
 
Defining Threat Hunting
Examples and Goals of Threat Hunting
Differences Between Hunt Teams and Other Cyber Teams
Threat Landscape
Types of Threat Modeling
Hunting Methods on Networks
Teaming and Automation Example
Threat Hunting Teams Course Exam
IPv6 Security Essentials Course 5 HoursSkill Level: Advanced  
+ Description
 

This course begins with a primer of IPv6 addressing and its current deployment state, discusses Internet Control Manager Protocol version 6 (ICMPv6), Dynamic Host Configuration Protocol version 6 (DHCPv6), and Domain Name System version 6 (DNSv6), and concludes with IPv6 Transition Mechanisms, security concerns, and management strategies. This course includes several reinforcing video demonstrations, as well as a final knowledge assessment.

Learning Objectives:

  • Primer of IPv6 addressing
  • Describe current deployment state
  • Explain ICMPv6, DHCPv6, and DNSv6
  • Explore IPv6 Transition mechanisms
  • Identify security concerns
  • Incorporate management strategies

Date: 2015

Training Purpose: Skill Development

Training Proficiency Area: Level 3 - Advanced

Alignment to the NIST SP 800-181 Cybersecurity Workforce Framework

CategorySpecialty AreaWork Roles
Operate and Maintain Network Services Network Operations Specialist
Operate and Maintain Systems Administration Systems Administration
Operate and Maintain Systems Analysis Systems Security Analyst
Protect and Defend Cyber Defense Infrastructure Support Cyber Defense Infrastructure Support Specialist
Securely Provision Systems Architecture Systems Architect
+ Course Modules/Units
 
IPv6 Introduction
IPv6 Adoption
DEMO: IPv6 Network Reconnaissance
IPv6 Addressing Part 1 of 2
IPv6 Addressing Part 2 of 2
IPv6 Packet Header
DEMO: IPv6 Header Analysis
ICMPv6
IPv6 Address Assignment
DEMO: IPv6 Address Assignment
IPv6 Web Browsing
IPv6 Transition Mechanisms Part 1 of 2
IPv6 Transition Mechanisms Part 2 of 2
DEMO: IPv6 Tunneling
IPv6 Security Concerns
DEMO: IPv6 Network Mapping
IPv6 Security Mitigation Strategies
DEMO: IPv6 Network Monitoring Tools
IPv6 Ready
IPv6 Security Essentials Key Takeaways
DEMO: IPv4 and IPv6 Subnetting
DEMO: IPv6 Addressing on Router Interfaces
DEMO: Setting up RIP for IPv6
DEMO: Configuring OSPFv3
DEMO: IPv6 Alive Hosts
DEMO: IPv6 Duplicate Address Detection (DAD)
DEMO: IPv6 DAD Denial of Services (DOS)
DEMO: IPv6 Fake Router Advertisement
DEMO: IPv6 Man-in-the-middle
IPv6 Security Essentials Quiz
ISACA Certified Information Security Manager (CISM) Prep 11 HoursSkill Level: Intermediate  
+ Description
 

The self-study resource prepares learners for the CISM exam. This course focuses on information security management expertise through in-depth lecture topics, reinforcing demonstrations, and a practice exam. This course includes concepts from the four job practice areas: Information Security Governance, Information Risk Management and Compliance, Information Security Program Development and Management, and Information Security Incident Management.

Learning Objectives:

  • Explain how information security governance and supporting processes are used to align security strategy with organizational goals and objectives.
  • Detail strategies to manage risk to an acceptable level in support of organization goals and objectives.
  • Describe the information security program's role in the organization's security posture by managing and protecting assets while supporting goals.
  • Detail means to minimize the impact to operations in the event of a security incident through establishing detection, response, and recovery capabilities.

Date: 2015

Training Purpose: Skill Development

Training Proficiency Area: Level 2 - Intermediate

Alignment to the NIST SP 800-181 Cybersecurity Workforce Framework

CategorySpecialty AreaWork Roles
Oversee and Govern Cybersecurity Management Information Systems Security Manager
Oversee and Govern Program/Project Management and Acquisition Program Manager
Operate and Maintain Systems Analysis Systems Security Analyst
Protect and Defend Vulnerability Assessment and Management Vulnerability Assessment Analyst
+ Course Modules/Units
 
CISM Course Introduction
IS Governance Domain Overview
Information Security (IS) Management
Importance of IS Governance Part 1 of 2
Importance of IS Governance Part 2 of 2
IS Management Metrics
ISM Strategy Part 1 of 2
ISM Strategy Part 2 of 2
Elements of IS Strategy
IS Action Plan for Strategy
DEMO: Key Goal, Risk, Performance Indicator
Risk Management Overview and Concepts
Risk Management Implementation
Risk Assessment: Models and Analysis
DEMO: Calculating Total Cost of Ownership
DEMO: Recovery Time Objective (RTO)
Compliance Enforcement
Risk Analysis: Threat Analysis
IS Controls and Countermeasures
Other Risk Management Considerations Part 1 of 2
Other Risk Management Considerations Part 2 of 2
DEMO: Cost Benefit Analysis
Information Security Program Development
Information Security Program Management
Outcomes of Effective Management
IS Security Program Development Concepts
Scope and Charter of IS Program Development
IS Management Framework
IS Framework Components
IS Program Roadmap
Organizational Roles and Responsibilities
Information Security Manager Responsibilities
Other Roles and Responsibilities in IS
Information Security Program Resources
IS Personnel Roles and Responsibilities
IS Program Implementation Part 1 of 2
IS Program Implementation Part 2 of 2
Implementing IS Security Management Part 1 of 2
Implementing IS Security Management Part 2 of 2
Measuring IS Management Performance
Common Challenges to IS Management
Determining the State of IS Management
Incident Management and Response
Incident Management Part 1 of 2
Incident Management Part 2 of 2
IMT IRT Members
Incident Response Planning Part 1 of 2
Incident Response Planning Part 2 of 2
DEMO: Phishing Emails
DEMO: Incident Management Workflow
Recovery Planning Part 1 of 2
Recovery Planning Part 2 of 2
DEMO: RTIR Incident Response Tool Part 1 of 2
DEMO: RTIR Incident Response Tool Part 2 of 2
CISM Practice Exam
(ISC)2 (TM) CAP Certification Prep Self Study 2014 11 HoursSkill Level: Intermediate 
+ Description
 

This course prepares learners for the Information Security Certification (ISC)2 Certified Authorization Professional (CAP) certification exam. This course focuses on the process of authorizing and maintaining information systems. Topics include understanding the Risk Management Framework (RMF), selection, implementation, and monitoring of security controls as well as the categorization of information systems. A practice exam is included.

Learning Objectives:

  • Provide a review of the 7 (ISC)2 CAP domains.
  • Supplemental preparation for the (ISC)2 CAP certification exam.

Date: 2014

Training Purpose: Skill Development

Training Proficiency Area: Level 2 - Intermediate

Alignment to the NIST SP 800-181 Cybersecurity Workforce Framework

CategorySpecialty AreaWork Roles
Oversee and Govern Cybersecurity Management Information Systems Security Manager
Protect and Defend Incident Response Cyber Defense Incident Responder
Protect and Defend Vulnerability Assessment and Management Vulnerability Assessment Analyst
+ Course Modules/Units
 
CAP Course Introduction
Risk Management Approach to Security Authorization
Risk Management Framework Steps
Risk Management Framework Phases
RMF Roles and Responsibilities
Organization Wide Risk Management
Managing Risk
Assessor Independence and External Environments
System Development Life Cycle
Alignment of RMF with SDLC Review
RMF Legal and Regulatory Requirements
NIST Publications
Continuous Monitoring Strategies
RMF Guidance Review
Defining Categorization
Categorization Examples
Categorization Process
Security Plans and Registration
Categorize
Selection Step Tasks
Selection Step Definitions
Security Controls Guidance
Privacy and Security Controls
Control Selection and Supplemental Guidance
Tailoring Security Controls
Control Assurance and Monitoring
Control Assurance and Monitoring - Continued
Select
Implementing Security Controls Overview
Integrating Implementation
Implement
Preparing for Control Assessments
Conducting Control Assessments
Security Assessment Report
Remediation Actions and Process Review
Assess
Authorization Documentation
Risk Determination and Acceptance Part 1 of 3
Risk Determination and Acceptance Part 2 of 3
Risk Determination and Acceptance Part 3 of 3
Authorization Decisions
Prioritized Risk Mitigation and Authorization Review
Authorize
Assessments and Configuration Management
Ongoing Security Control Assessments
Monitor
CAP Certification Prep Practice Exam
LAN Security Using Switch Features 2 HoursSkill Level: Intermediate 
+ Description
 

This course focuses on different methods of how to secure Local Area Networks (LANs) at the connectivity level. Topics include monitoring media access control (MAC) addresses and port security, limiting MAC & IP spoofing, controlling traffic flows, implementing and enhancing security in virtual local area networks (VLANs), enabling authentication on connection points, and determining host security health. Examples are used throughout to reinforce concepts.

Learning Objectives:

  • Identify the vulnerabilities and best practices in securing LAN connections.
  • Understand the management and decision-making processes within the NAC Framework.
  • Discuss methods of defending against attacks to STP, VLAN, and VTP switch configurations.

Date: 2010

Training Purpose: Skill Development

Training Proficiency Area: Level 2 - Intermediate

Alignment to the NIST SP 800-181 Cybersecurity Workforce Framework

CategorySpecialty AreaWork Roles
Operate and Maintain Systems Administration Systems Administrator
Operate and Maintain Systems Analysis Systems Security Analyst
Protect and Defend Vulnerability Assessment and Management Vulnerability Assessment Analyst
Protect and Defend Cyber Defense Analysis Cyber Defense Analyst
+ Course Modules/Units
 
Introduction and MAC Address Monitoring
MAC Address Spoofing
Managing Traffic Flows
VLANs and Security
802.1x Port Authentication
Network Admission Control
Securing STP
Securing VLANs and VTP
Linux Operating System Security 9 HoursSkill Level: Advanced 
+ Description
 

This course focuses on the security features and tools available in Linux as well as the considerations, advantages, and disadvantages of using those features. This course is based on Red Hat Linux and is designed for IT and security managers, and system administrators who want to increase their knowledge on configuring and hardening Linux from a security perspective.

Learning Objectives:

  • Describe the basic architecture of a Linux system (e.g. kernel, file system formats, permissions, etc.).
  • Characterize a Linux system (identify distribution, installed packages, active accounts, etc.).
  • List and explain how to use common command line utilities on a Linux system for analysis purposes.
  • Operate a Linux system, including patching, modifying services, and other administration tasks.
  • Use a Linux system to perform analysis work such as malware and incident response analysis.

Date: 2013

Training Purpose: Skill Development

Training Proficiency Area: Level 3 - Advanced

Alignment to the NIST SP 800-181 Cybersecurity Workforce Framework

CategorySpecialty AreaWork Roles
Operate and Maintain Systems Analysis Systems Security Analyst
Operate and Maintain Systems Administration Systems Administrator
Protect and Defend Vulnerability Assessment and Management Vulnerability Assessment Analyst
+ Course Modules/Units
 
Linux OS Security Introduction
Booting Linux
Linux Recovery
Linux Startup Scripts
Linux Startup Processes
Linux Runlevels Demo
Chkconfig_and_Upstart Demo
Linux Processes and Signals
Linux Process Monitoring
PS_and_Netstat Demo
Linux PS and TOP Demo
Working with Linux PIDs
Linux File System Overview
Linux File Security
Linux File Access Controls
File Integrity Demo
Linux Kernel Tuning
Linux Host Access Controls
Linux User and Group Definition
User Management
Linux Privilege Escalation
Sudoers Demo
Linux Authentication Methods
Linux Viruses and Worms
Linux Trojan Horses
Linux Rootkits
Linux Misconfigurations
Linux Software Vulnerabilities
Linux Social Engineering
Linux Automated Installation
Managing Linux Packages
Package Management Tools Demo
Repositories and System Management
Custom Repository Demo
Linux IPv4 and IPv6
Linux Network Configuration
Linux Tunneling
Kernel Tuning Demo
Linux X11 Forwarding
Linux File Sharing
Linux Grand Unified Bootloader (GRUB)
Configuring GRUB Demo
Security Enhanced Linux
Introduction to IPTables
IPTables Rules
IPFilter
Linux Packet Sniffers
Linux NIDS
Linux HIDS
Linux Antivirus
Linux Secure Shell
Linux Log Management
Linux Scripting Basics
BASH Scripting Demo
IF Statements
Pipes and Redirection
Variables and Regular Expressions
Custom Scripting
Linux Hardening
NSA Hardening Guides
National Vulnerability Database (NVD)
Common Vulnerabilities and Exposures (CVE)
Vulnerability Scanning
Linux Operating System Security Quiz
Offensive and Defensive Network Operations 13 HoursSkill Level: Beginner 
+ Description
 

This course focuses on fundamental concepts for offensive and defensive network operations. It covers how offensive and defensive cyber operations are conducted and details U.S. government doctrine for network operations. Topics include network attack planning, methodologies, and tactics and techniques used to plan for, detect, and defend against network attacks.

Learning Objectives:

  • Apply U.S. government network operations background and doctrine.
  • Describe offensive and defensive network operations.
  • Determine offensive network operation missions, planning, and exploitation phases and methodologies.
  • Derive defensive network operation missions, planning, and methods to detect and defend against network attacks and attackers' methods.

Date: 2015

Training Purpose: Skill Development

Training Proficiency Area: Level 1 - Beginner

Alignment to the NIST SP 800-181 Cybersecurity Workforce Framework

CategorySpecialty AreaWork Roles
Collect and Operate Cyber Operations Cyber Operator
Protect and Defend Cyber Defense Analysis Cyber Defense Analyst
+ Course Modules/Units
 
Cyberspace As A Domain
Joint Publication 3-12(R), Cyberspace Operations Overview Part 1 of 3
Joint Publication 3-12(R), Cyberspace Operations Overview Part 2 of 3
Joint Publication 3-12(R), Cyberspace Operations Overview Part 3 of 3
Joint Communications Overview and Information Environment
Joint Force Communication, System Operations, and Management Planning
Legal Considerations for Cyber Operations Part 1 of 2
Legal Considerations for Cyber Operations Part 2 of 2
Adversaries in Cyberspace Part 1 of 3
Adversaries in Cyberspace Part 2 of 3
Adversaries in Cyberspace Part 3 of 3
Offensive Cyber Operations Background
Offensive Cyberspace Operations Definitions
Offensive Cyberspace Operations Planning and Legal Considerations
Offensive Methodology Planning Examples 1 of 2
Offensive Methodology Planning Examples 2 of 2
Reconnaissance Methodology Overview
Social Engineering for Reconnaissance
Reconn with Automated Correlation Tools and Search Engines Part 1 of 2
Reconn with Automated Correlation Tools and Search Engines Part 2 of 2
Network Mapping for Active Reconnaissance
Port Scanning for Active Reconnaissance
Windows Enumeration Basics
Linux Enumeration Basics
Scanning and Enumerating with Nmap
Exploitation using Direct Exploits and System Misconfiguration
Exploitation with SET Example
Exploitation
Entrenchment
Exploitation Basics
Post-Exploitation
Abuse and Attacks
Defensive Cyberspace Operations (DCO)
DCO Types of Operations
DCO Operational Goals
DCO Best Practices
Defensive Methodology: Understanding the Threat
Defensive Methodology: Tactics
Defensive Methodology: Defense-in-Depth
Incident Management Overview
Incident Management Policies, Plans and Procedures
Incident Management Team Configuration
Incident Response Lifecycle
Defending the Domain
Perimeter and Host Defenses
IDS/IPS Defined Including Advantages and Disadvantages
IDS/IPS Types and Functions
IDS/IPS Location Placements
Intrusion Detection using Snort
Reviewing Alerts and Detecting Attack Phases
Network Traffic Analysis
Methods of Network Traffic Analysis
Wireshark
Log Analysis Methods and Techniques Part 1 of 2
Log Analysis Methods and Techniques Part 2 of 2
Detecting Offensive Operations using Log Analysis
Digital Forensics Overview and Tools
Digital Forensics Methods and Techniques Part 1 of 2
Digital Forensics Methods and Techniques Part 2 of 2
Identifying Phases of Attack Using Digital Forensics
Incident Data: Profile and Analysis
Incident Reporting
Offensive and Defensive Network Operations Exam
Overview of Creating and Managing Computer Security Incident Response Teams (CSIRTs) 4 HoursSkill Level: Beginner  
+ Description
 

This course focuses on what is needed to create and operate a Computer Security Incident Response Team (CSIRT). The intended audience is individuals tasked with creating a CSIRT and those who may be new to CSIRT issues and processes. Objectives within the course include the benefits and limitations of a CSIRT, CSIRT requirements, services, common policies and procedures, and operational best practices. Previous incident handling experience is not required to partake in this course.

Learning Objectives:

  • Identify managerial, organizational, procedural, and operational issues regarding the CSIRT role and function.
  • Describe the issues involved with creating and operating a CSIRT.
  • Discuss specific topics regarding CSIRT benefits and limitations, requirements and framework, services, policies and procedures, and operational best practices.

Date: 2020

Training Purpose: Skill Development

Training Proficiency Area: Level 1 - Beginner

Alignment to the NIST SP 800-181 Cybersecurity Workforce Framework

CategorySpecialty AreaWork Roles
Analyze Threat Analysis Threat/Warning Analyst
Oversee and Govern Cybersecurity Management Communications Security Manager
Protect and Defend Incident Response Cyber Defense Incident Responder
Protect and Defend Cyber Defense Analysis Cyber Defense Analyst
+ Course Modules/Units
 
Creating and Managing CSIRTS Introduction
Defining the Problem
Defining Incident Management
Effective Incident Management Processes
Defining Terms Used Throughout the Course
Institutionalizing IM Capabilities
Incident Handling Terms Used Throughout the Course
Defining CSIRTs
Creating an Effective CSIRT
Building a CSIRT: Action Plan Part 1 of 2
Building a CSIRT: Action Plan Part 2 of 2
Building a CSIRT: Where to Begin
Lessons Learned and Team Maturity
CSIRT Components
CSIRT Organizational Models Part 1 of 2
CSIRT Organizational Models Part 2 of 2
CSIRT Policies and Procedures
CSIRT Staffing and Hiring
CSIRT Facilities and Infrastructure
Incident Management Processes Overview
IM Process: Prepare, Sustain, and Improve
IM Process: Protect Infrastructure
IM Process: Detect Events
IM Process: Triage Events
IM Process: Triage Best Practices
IM Process: Respond
IM Process: Respond Issues
IM Process: Best Practices
Creating and Managing CSIRTs Summary
Creating and Managing CSIRTs Resources
Radio Frequency Identification (RFID) Security 1 HourSkill Level: Beginner 
+ Description
 

This course focuses on securing radio frequency identification (RFID), different components of RFID, how it works, applications in which it is being used, benefits and weaknesses, and the communication range over which it works will be reviewed. Topics include specific concerns with RFID, recommendations for RFID, and security issues that have come to light.

Learning Objectives:

  • Explain the components, operation, and application of RFID technology.
  • Understand the privacy implications with using RFID-embedded items.
  • Differentiate across threat categories.
  • Describe different security recommendations to secure RFID.
  • Familiarity with real-world examples of how RFID has been exploited.

Date: 2016

Training Purpose: Skill Development

Training Proficiency Area: Level 1 - Beginner

Alignment to the NIST SP 800-181 Cybersecurity Workforce Framework

CategorySpecialty AreaWork Roles
Operate and Maintain Systems Analysis Systems Security Analyst
Protect and Defend Vulnerability Assessment and Management Vulnerability Assessment Analyst
+ Course Modules/Units
 
RFID Introduction
RFID Threats
RFID Countermeasures
Exploited Threats
Root Cause Analysis 1 hourSkill Level: Beginner 
+ Description
 

This course explains the root cause analysis for cybersecurity incidents and provides an overview of two different root cause analysis models (and approaches used in these models). This course also describes how root cause analysis can benefit other incident management processes (response, prevention, and detection), and details general root cause analysis techniques that can be adopted as methods for analysis of cyber incidents.

Learning Objectives:

  • Explain the benefits and challenges of reverse engineering.
  • Perform basic tasks with reverse engineering tools.
  • Understand basics of Intel x86 assembly code.
  • Describe the Microsoft Windows executable file format and understand the basics of the Windows API.
  • Extract actionable information from ta malicious binary file that can be used in analysis reports.

Date: 2016

Training Purpose: Skill Development

Training Proficiency Area: Level 1 - Beginner

Alignment to the NIST SP 800-181 Cybersecurity Workforce Framework

CategorySpecialty AreaWork Roles
Analyze Threat Analysis Threat/Warning Analyst
Protect and Defend Cyber Defense Analysis Cyber Defense Analyst
Protect and Defend Incident Response Cyber Defense Incident Responder
+ Course Modules/Units
 
Root Cause Analysis Fundamentals
Root Cause Analysis Methods
Cyber Kill Chain Model for Root Cause Analysis
Sample Incident Cause Analysis Workflow
Root Cause Analysis Course Exam
Securing Infrastructure Devices 1 HourSkill Level: Intermediate  
+ Description
 

This course focuses on physical security, operating system security, management traffic security, device service hardening, securing management services, and device access privileges.

Learning Objectives:

  • Understand considerations for securing physical assets, patch management and change management.
  • Apply methods for securing network management traffic.
  • Understanding of securing management services such as NTP, SNMP, Syslog.
  • Understand hardware device hardening.

Date: 2010

Training Purpose: Skill Development

Training Proficiency Area: Level 2 - Intermediate

Alignment to the NIST SP 800-181 Cybersecurity Workforce Framework

CategorySpecialty AreaWork Roles
Operate and Maintain Network Services Network Operations Specialist
Operate and Maintain Systems Administration Systems Administrator
Operate and Maintain Systems Analysis Systems Security Analyst
Protect and Defend Cyber Defense Infrastructure Support Cyber Defense Infrastructure Support Specialist
Securely Provision Systems Architecture Security Architect
+ Course Modules/Units
 
Physical and Operating System Security
Management Traffic Security
Device Service Hardening
Securing Management Services
Device Access Hardening
Device Access Privileges
Securing Internet- Accessible Systems 1 HoursSkill Level: Beginner   
+ Description
 

This course focuses on Internet-accessible systems or "Internet of Things" (IoT). Each of these systems and devices can be targeted by threat actors and used to conduct malicious activity if they are unsecured, or worse, these systems can leave vulnerabilities and sensitive information open to exploitation if not properly configured and maintained. This course explains the vulnerabilities of internet-accessible systems and how to prepare for, mitigate, and respond to a potential attack. This course provides key knowledge to inform organizational awareness of internet-accessible system attacks as well as best practices that minimize the likelihood of a successful attack and enable effective response and recovery if an attack occurs.

This webinar is accessible to non-technical learners including managers and business leaders and offers an organizational perspective useful to technical specialists.

Learning Objectives
Enable learners to better defend their internet-accessible systems through awareness of common vulnerabilities, best practices, CISA guidance, and resources:

  • Define Internet-Accessible Systems and common vulnerabilities
  • Explain cyber hygiene best practices that prevent attacks.
  • Understand the impacts of real-life cyberattacks and what an effective organizational response looks like.
  • Learn steps to identify, mitigate, and recover from Internet-Accessible System attacks.

Date: 2020

Training Purpose: Skill Development

Training Proficiency Area: Level 1 - Beginner

Alignment to the NIST SP 800-181 Cybersecurity Workforce Framework

CategorySpecialty AreaWork Roles
Operate and Maintain Data Administration Data Analyst, Database Administrator
Operate and Maintain Systems Administration Systems Administrator
Operate and Maintain Systems Analysis Systems Security Analyst
Oversee and Govern Cybersecurity Management Communications Security Manager; Information Systems Security Manager
Oversee and Govern Program Management and Acquisition IT Investment Manager, IT Program Auditor, IT Project Manager, Product Support Manager, Program Manager
Oversee and Govern Strategic Planning and Policy Cyber Policy and Strategy Planner; Cyber Workforce Developer and Manager
Protect and Defend Cyber Defense Infrastructure Support Cyber Defense Infrastructure Support Specialist
Protect and Defend Incident Response Cyber Defense Incident Responder
Protect and Defend Vulnerability Assessment Analyst
Securely Provision Risk Management Authorizing Official/Designating Representative; Security Control Assessor
Securely Provision System Requirements Planning System Requirements Planner
+ Course Modules/Units
 
Securing Internet- Accessible Systems
Securing the Network Perimeter 1 HourSkill Level: Intermediate  
+ Description
 

This course focuses on edge security traffic design, blocking Denial of Service / Distributed Denial of Service (DoS/DDoS) traffic, specialized access control lists, routers and firewalls, securing routing protocols, securing traffic prioritization, and securing against Single Point of Failure (SPOF).

Learning Objectives:

  • Identify perimeter and the approach to protecting that perimeter.
  • Understand methods to consider for blocking DoS and DDos traffic.
  • Apply specialized Access Control List considerations.
  • Implement firewalls and differentiate types to protect the perimeter.
  • Understand routing protocols and traffic prioritization for networks.

Date: 2010

Training Purpose: Skill Development

Training Proficiency Area: Level 2 - Intermediate

Alignment to the NIST SP 800-181 Cybersecurity Workforce Framework

CategorySpecialty AreaWork Roles
Investigate Digital Forensics Cyber Defense Forensics Analyst
Operate and Maintain Network Services Network Operations Specialist
Operate and Maintain Systems Analysis Systems Security Analyst
Protect and Defend Cyber Defense Analysis Cyber Defense Analyst
Protect and Defend Incident Response Cyber Defense Incident Responder
+ Course Modules/Units
 
Introduction and Edge Security Traffic Design
Blocking DoS and DDoS Traffic
Specialized Access Control Lists
Routers with Firewalls
Beyond Firewalls: Inspecting Layer 4 and Above
Securing Routing Protocols and Traffic Prioritization
Securing Against Single Point of Failures
SiLK Traffic Analysis 7 HoursSkill Level: Intermediate 
+ Description
 

This course is designed for analysts involved in daily response to potential cybersecurity incidents, and who have access to the Einstein environment. The course begins with an overview of network flow and how the SiLK tools collect and store data. The next session focuses specifically on the Einstein environment. The basic SiLK tools are covered next, giving the analyst the ability to create simple analyses of network flow. Advanced SiLK tools follow and cover how to create efficient and complex queries. The course culminates with a lab where learners use their new skills to profile a network.

Learning Objectives:

  • Use of the SiLK network flow analysis tool suite to perform tasks such as querying for records related to a specific incident or indicator, creating sets of indicators for batch analysis, and leveraging network flow to provide basic network situational awareness.

Date: 2013

Training Purpose: Skill Development

Training Proficiency Area: Level 2 - Intermediate

Alignment to the NIST SP 800-181 Cybersecurity Workforce Framework

CategorySpecialty AreaWork Roles
Oversee and Govern Cybersecurity Management Information Systems Security Manager
Protect and Defend Cyber Defense Infrastructure Support Cyber Defense Infrastructure Support Specialist
Protect and Defend Vulnerability Assessment and Management Vulnerability Assessment Analyst
+ Course Modules/Units
 
Introduction to SiLK
iSiLK
What is Network Flow?
Interpreting SiLK Network Flow
SiLK Flows
SiLK Traffic Analysis Quiz 1
The SiLK Repository
Basic SiLK Tools
SiLK Traffic Analysis Quiz 2
rwfilter
rwfilter Examples
rwfilter Demo
rwfilter Continued
SiLK Traffic Analysis Quiz 3
rwcount
rwcount Demo
rwstats
rwstats Demo 1
rwstats Continued 1
rwstats Demo 2
rwstats Continued 2
rwuniq
SiLK Traffic Analysis Quiz 4
PySiLK
Python Expressions and SilkPython
SiLK Traffic Analysis Quiz 5
IP Sets
Bags
SiLK Traffic Analysis Quiz 6
Prefix Maps
Tupples
SiLK Traffic Analysis Quiz 7
rwgroup
rwmatch
SiLK File Utilities
IPv6 in SiLK
SiLK Traffic Analysis Quiz 8
Network Profiling Introduction
Understanding DNS Attacks 1 HoursSkill Level: Beginner     
+ Description
 

The Domain Name System, commonly known as DNS, is often referred to as the "phone book" of the Internet. Every time we access the Internet to visit our favorite websites, shop and pay bills online, or access online portals for healthcare or banking, we depend on DNS infrastructure to securely route us to our intended destinations. While this shared infrastructure is incredibly powerful and useful, it also presents a rich attack surface for threat actors: allowing them to shut down websites and online services, replace legitimate website content with threats and extortion attempts, or even route traffic to a carbon copy of a legitimate website to steal any information entered by users intending to conduct business as usual. "Understanding DNS Attacks" provides key information you need to know to protect yourself and your organization from DNS infrastructure tampering including common vulnerabilities, how to identify a potential attack, and guidance and best practices to mitigate the likelihood and impact of a successful DNS attack.

This webinar is accessible to non-technical learners including managers and business leaders, and offers an organizational perspective useful to technical specialists.

Learning Objectives:
Enable learners to prevent, flag, and protect themselves and their organizations from DNS infrastructure attacks through awareness of common attack schemes, best practices, CISA guidance, and resources.

  • Define DNS Tampering and explain common attack methods
  • Identify signs of a DNS attack
  • Learn mitigation steps for DNS attacks
  • Understand the process to recover from a DNS attack
  • Explore impacts of DNS attacks through case studies

Date: 2021

Training Proficiency Area: Level 1 - Beginner

Training Purpose: Skill Development

Alignment to the NIST SP 800-181 Cybersecurity Workforce Framework

CategorySpecialty AreaWork Roles
Analyze All-Source Analysis Mission Assessment Specialist
Collect and Operate Collection Operations All-Source Collection Manager, All-Source Collection Requirements Manager
Operate and Maintain Customer Service and Technical Support Technical Support Specialist
Operate and Maintain Data Administration Data analyst, database administrator
Operate and Maintain Knowledge Management Knowledge Manager
Operate and Maintain Network Services Network Operation Specialist
Operate and Maintain Systems Administration System Administrator
Oversee and Govern Cybersecurity Management Communications security manager; information systems security manager
Oversee and Govern Program Management and Acquisition IT investment manager, IT program auditor, IT project manager, product support manager, program manager
Oversee and Govern Strategic Planning and Policy Cyber policy and strategy planner; cyber workforce developer and manager
Oversee and Govern Training, Education, and Awareness Cyber Instructional Curriculum Developer
Protect and Defend Cyber Defense Infrastructure Support Cyber Defense Infrastructure Support Specialist
Protect and Defend Incident Response Cyber Defense Incident Responder
Protect and Defend Vulnerability Assessment and Management Vulnerability Assessment Analyst
Securely Provision Risk Management Authorizing official; security control assessor
Securely Provision Systems Architecture Enterprise Architect, Security Architect
Securely Provision Systems Requirements Planning Systems Requirements Planner
Securely Provision Test and Evaluation System Testing and Evaluation Specialist
+ Course Modules/Units
 
Understanding DNS Attacks
Understanding Web and Email Server Security 1 HoursSkill Level: Beginner    
+ Description
 

Web and email servers are the workhorses of the Internet: we couldn't run government, businesses, or our personal lives without them! However, the information exchanged through web and email servers can offer a tempting target for cyber attackers. Participants can request 1 CPE credit for completing this course.

This webinar includes the following information and more:

  • Attack methods: Hackers can target and decode victims' web and email traffic, compromise email security to make phishing attempts more likely to succeed, or can even use botnets to shut down access to websites and conduct large-scale campaigns of malicious activity.
  • Key Guidance for Organizations: CISA provides resources and best practices to help individuals and organizations secure their web and email infrastructure.
  • Case studies: Explore the methods and impacts of real-life cyberattacks, and how the victims responded and recovered.
  • Incident Response overview: Key steps to identify a potential attack, mitigate damage through proper preparation and response, and recover after an attack occurs.

Learning Objectives:
Enable learners to prevent, flag, and protect themselves and their organizations from web and email server cyberattacks through awareness of common attack schemes, best practices, CISA guidance, and resources.

  • Define web and email server infrastructure, and explain common attack methods
  • Identify signs of a potential attack
  • Learn mitigation steps for web and email server attacks
  • Understand the process to recover from a web or email server attack
  • Explore impacts of web and email server attacks through case studies

Date: 2020

Training Proficiency Area: Level 1 - Beginner

Training Purpose: Skill Development

Alignment to the NIST SP 800-181 Cybersecurity Workforce Framework

CategorySpecialty AreaWork Roles
Analyze All-Source Analysis All-source analysis
Analyze Threat Analysis Threat/ warning analyst
Collect and Operate Collection Operations All Source Collection Manager; All Source Collection Requirements Manager
Collect and Operate Cyber Operational Planning Cyber Intel Planner; Cyber Ops Planner; Partner Integration Planner
Operate and Maintain Data Administration Data analyst, database administrator
Operate and Maintain Knowledge Management Knowledge Manager
Operate and Maintain Network Services Network Operations Specialist
Operate and Maintain Systems Administration System Administrator
Operate and Maintain Systems Analysis Systems Security Analyst
Oversee and Govern Cybersecurity Management Communications security manager; information systems security manager
Oversee and Govern Program Management and Acquisition IT investment manager, IT program auditor, IT project manager, product support manager, program manager
Oversee and Govern Strategic Planning and Policy Cyber policy and strategy planner; cyber workforce developer and manager
Protect and Defend Cyber Defense Analysis Cyber Defense Analyst
Protect and Defend Cyber Defense Infrastructure Support Cyber Defense Infrastructure Support specialist
Protect and Defend Incident Response Cyber defense incident responder
Protect and Defend Vulnerability Assessment and Management Vulnerability assessment analyst
Securely Provision Risk Management Authorizing official; security control assessor
Securely Provision Systems Architecture Enterprise Architect; Security Architect
Securely Provision System Requirements Planning System requirements planner
+ Course Modules/Units
 
Understanding Web and Email Server Security
Windows Operating System Security 16 HoursSkill Level: Intermediate 
+ Description
 

This course focuses on the security aspects of Microsoft Windows. The class begins with an overview of the Microsoft Windows security model and some of the key components such processes, drivers, the Windows registry, and Windows kernel. An overview of the users and group permission structure used in Windows is presented along with a survey of the attacks commonly seen in Windows environments. Patching, networking, and the built-in security features of Windows such as the firewall, anti-malware, and BitLocker are all covered in light detail.

Learning Objectives:

  • Understanding of the Windows security model and its key components.
  • Introduction and best practice recommendations for using and configuring users and groups.
  • Overview of the Data Access Control technology in Windows Server 2012.
  • Survey common attacks seen in a Windows environment.
  • Understanding of the Microsoft update and patching process

Date: 2012

Training Purpose: Skill Development

Training Proficiency Area: Level 2 - Intermediate

Alignment to the NIST SP 800-181 Cybersecurity Workforce Framework

CategorySpecialty AreaWork Roles
Operate and Maintain Systems Analysis Systems Security Analyst
Operate and Maintain Systems Administration System Administrator
Protect and Defend Vulnerability Assessment and Management Vulnerability Assessment Analyst
+ Course Modules/Units
 
Windows OS Security Course Introduction
Windows Security Module Introduction
Windows Architecture Overview
Windows Subsystems Part 1 of 2
Windows Subsystems Part 2 of 2
Windows Security Development Lifecycle
Windows API
Windows Registry
Viewing Windows Registry Demo
Windows Services Part 1 of 2
Windows Services Demo
Windows Services Part 2 of 2
Multi-tasking
Sessions, Windows Stations and Desktops
Programs and Drivers Part 1 of 2
Reviewing Drivers in Windows
Programs and Drivers Part 2 of 2
Updating Widows Drives Demo
Applications, Processes, and Threads
Buffer Overflow Protection
Authenticode Part 1 of 2
Digital Certificate Details Demo
Authenticode Part 2 of 2
Windows Action Center
Windows Users and Groups Introduction
User Account Control
Windows Users and Groups Part 1 of 2
Windows Users and Groups Part 2 of 2
Windows Interactive Logon Process
NTLM Authentication Overview
Kerberos Authentication Overview
Types of Authentication
File Permissions
Dynamic Access Controls
Threats and Vulnerabilities Introduction
OS Vulnerabilities
CVE Details Demo
CVE Samples
Misconfigurations
Password Configuration Options
Password DDOS Demo
Common Misconfigurations
CCE and the NVD Demo
Social Engineering
Viruses and Worms
Impersonation
Microsoft Updates and Patching Process Part 1 of 2
Double Decode
Microsoft Updates and Patching Process Part 2 of 2
Securing the Update Process
Update Process Circumvention
Windows Server Update Service
Internet Explorer Patching
Windows Network Connectivity
Windows Network Profiles
Windows Network Adapter Settings
Windows Wireless Settings
Windows Networking Protocols
Other Windows Protocols
Microsoft VPN Part 1 of 2
Microsoft VPN Part 2 of 2
Microsoft Network Access Protection Part 1 of 2
Microsoft Network Access Protection Part 2 of 2
How to Configure Windows Update Settings Demo
Windows Security Features Introduction
Windows Firewall
Windows Firewall Wizard Demo
Windows Firewall with Advanced Security
Windows Firewall with Advanced Security Demo
Configuring Windows Firewall Demo
Windows Defender
Windows AD and PKI Demo
Windows Active Directory Certificate Services
Windows Group Policy
Windows AppLocker
Configuring And Using App Locker Demo
Windows BitLocker
Configuring And Using Bitlocker Demo
Windows Secure Boot
Windows Security Auditing
Windows Audit Settings and Examples
SCW Introduction
Hardening Windows Introduction
Windows Templates
Microsoft Baseline Security Analyzer
Microsoft Security Configuration Wizard
Microsoft Security Compliance Manager
Hardening with Group Policy
NVD Search Demo
Other Guidelines and Recommendations
Using Windows Mgmt Intstrumentation Demo
Using The Security Config Wizard Demo
PowerShell Introduction
PowerShell Key Commands
PowerShell Demo
Administrative Functions with PowerShell
Computer and Network Management with PowerShell
Basic Scripts in PowerShell
PowerShell Security Settings and Configurations
Using Powershell Demo
Windows OS Security Quiz
Wireless Network Security (WNS) 9 HoursSkill Level: Intermediate  
+ Description
 

This course focuses on the technologies of the 802.11 family of wireless networking, including the principles of network connectivity and network security.

Learning Objectives:

  • Understand the difference between Wi-Fi and other wireless technologies.
  • Identify the major protocols within the family of 802.11 protocols.
  • Understand how radio frequency properties affect Wi-Fi network design and operation.
  • Understand the operation of enterprise Wi-Fi networks and the evolution of CAPWAP.
  • Understand the major Wi-Fi security and methods and be able to create a Wi-Fi security monitoring plan.

Date: 2013

Training Purpose: Skill Development

Training Proficiency Area: Level 2 - Intermediate

Alignment to the NIST SP 800-181 Cybersecurity Workforce Framework

CategorySpecialty AreaWork Roles
Operate and Maintain Network Services Network Operations Specialist
Operate and Maintain Systems Administration Systems Administrator
Operate and Maintain Customer Service and Technical Support Technical Support Specialist
Protect and Defend Cyber Defense Infrastructure Support Cyber Defense Infrastructure Support Specialist
Securely Provision Systems Architecture Systems Architect
+ Course Modules/Units
 
Wi-Fi Communication and Security Intro
How Wi-Fi Became Ubiquitous
Wi-Fi Standards - 802.11b
Wi-Fi Standards - 802.11a
Wi-Fi Standards - 802.11g n and ac
Bluetooth Standards
WiMAX Standards
LTE HSPA EvDO Network Types
Spread Spectrum Technology
802.11 Transmissions and Wireless Channels
802.11 Data Rates
Wireless Network Topologies
Wireless Network Hardware
RF Propagation Principles
Impacts on Signal Radiation
Signal Propagation and Objects
Additional Signal Effects
Measuring Signal Strength
Signal Strength and Antennas
Wireless Coverage and Frequency Reuse
Wireless Network Design Issues
Wireless Modes and Service Sets
Wireless Authentication and Association
Wireless and Roaming 1 of 2
Wireless and Roaming 2 of 2
Enterprise 802.11 Solutions
Key Points of CAPWAP
Advantages of CAPWAP
CAPWAP Demo
802.11 Security Flaws
Fixing 802.11 Security
802.1x Authentication Protocols
Additional Issues with 802.11 Encryption
Additional 802.11 Security Measures
Other Wireless Threats
Wireless Best Practices
Wireless Network Assessment Part 1 of 2
Wireless Network Assessment Part 2 of 2
Wireless Network Security Quiz