دوره FOR578: Cyber Threat Intelligence

دوره FOR578: Cyber Threat Intelligence

پیش نیاز دوره FOR578: Cyber Threat Intelligence

دانش در حد یکی از دوره های زیر

• SANS 401
• SANS 511
• FOR 508
• FOR 572
• FOR526
• FOR 610
• ICS515

مخاطبین دوره

• کارشناسان جرائم رایانه ای
• شکارچیان تهدیدات
• کارشناسان امنیت
• مدیران امنیت اطلاعات
• کارشناسان واحد پاسخگویی به حوادث
• کارشناسان واحد مرکز عملیات امنیت

مزایای دوره

• ارائه مدرک معتبر
• برگزاری دوره ها بصورت کاملا عملی
• استفاده از لابراتور مجهز
• استفاده از برترین اساتید داخلی و با مدرک بین المللی
• با توجه به حضور گروه دوران در بیش از 1000 پروژه سازمانی، امکان معرفی دانشجویان دوره به بازار کار مرتبط به دوره ها
• تخفیف جهت حضور در دوره های بعدی
• دريافت مدرک بين المللی مرتبط

سرفصل دوره

  FOR578.1: Cyber Threat Intelligence and Requirements

• Case-Study: Carbanak, “The Great Bank Robbery”
• Understanding Intelligence
  • Intelligence Lexicon and Definitions
  • Traditional Intelligence Cycle
  • Sherman Kent and Intelligence Tradecraft
  • Structured Analytical Techniques
• Understanding Cyber Threat Intelligence
  • Defining Threats
  • Understanding Risk
  • Cyber Threat Intelligence and Its Role
  • Expectation of Organizations and Analysts
  • Four Methods of Threat Detection
• Threat Intelligence Consumption
  • Sliding Scale of Cybersecurity
  • Consuming Intelligence for Different Goals
  • Enabling Other Teams with Intelligence
• Positioning the Team to Generate Intelligence
  • Building an Intelligence Team
  • Positioning the Team in the Organization
  • Prerequisites for Intelligence Generation
• Planning and Direction (Developing Requirements)
  • Intelligence Requirements
  • Priority Intelligence Requirements
  • Beginning the Intelligence Lifecycle
  • Threat Modeling

  FOR578.2: The Fundamental Skillset: Intrusion Analysis

Topics

• Primary Collection Source: Intrusion Analysis
  • Intrusion Analysis as a Core Skillset
  • Methods to Performing Intrusion Analysis
  • Intrusion Kill Chain
• Kill Chain Courses of Action
  • Passively Discovering Activity in Historical Data and Logs
  • Detecting Future Threat Actions and Capabilities
  • Denying Access to Threats
  • Delaying and Degrading Adversary Tactics and Malware
• Kill Chain Deep Dive
  • Scenario Introduction
  • Notification of Malicious Activity
  • Pivoting Off of a Single Indicator to Discover Adversary Activity
  • Identifying and Categorizing Malicious Actions
  • Using Network and Host-Based Data
  • Interacting with Incident Response Teams
  • Interacting with Malware Reverse Engineers
  • Effectively Leveraging Requests for Information
• Handling Multiple Kill Chains
  • Identifying Different Simultaneous Intrusions
  • Managing and Constructing Multiple Kill Chains
  • Linking Related Intrusions
• Collection Source: Malware
  • Data from Malware Analysis
  • Key Data Types to Analyze and Pivot On
  • VirusTotal and Malware Parsers
  • Identifying Intrusion Patterns and Key Indicators

  FOR578.3: Collection Sources

• Case Study: Axiom
• Collection Source: Domains

• • Domain Deep Dive
  • Different Types of Adversary Domains
  • Pivoting off of Information in Domains
• Case Study: GlassRAT
• Collection Source: External Datasets
  • Building Repositories from External Datasets
  • Open-Source Intelligence Collection Tools and Frameworks
• Collection Source: TLS Certificates
  • TLS/SSL Certificates
  • Tracking New Malware Samples and C2 with TLS
  • Pivoting off of Information in TLS Certificates
• Case Study: Trickbots
• Exploitation: Storing and Structuring Data
  • Storing Threat Data
  • Threat Information Sharing
  • MISP as a Storage Platform

  FOR578.4: Analysis and Dissemination of Intelligence

• Analysis: Exploring Hypotheses
  • Analysis of Competing Hypotheses
  • Hypotheses Generation
  • Understanding and Identifying Knowledge Gaps
• Analysis: Building Campaigns
  • Different Methods of Campaign Correlation
  • Understanding Perceived Adversary Intentions
  • Leveraging the Diamond Model for Campaign Analysis
• Dissemination: Tactical
  • Understanding the Audience and Consumer
  • Threat Data Feeds and Their Limitations
  • YARA
  • Advanced YARA Concepts and Examples
• Case Study: Sony Attack
• Dissemination: Operational
  • Partners and Collaboration
  • Government Intelligence Sharing
  • Traffic Light Protocol Standard
  • Information Sharing and Analysis Centers
  • CybOX, STIX, and TAXII
  • STIX Elements and Projects
  • TAXII Implementations
  • Threat Intelligence Metrics
  • Communicating About Campaigns
  • Campaign Heat Maps and Tracking Adversaries

  FOR578.5: Higher-Order Analysis and Attribution

• Logical Fallacies and Cognitive Biases
  • Identifying and Defeating Bias
  • Logical Fallacies and Examples
  • Common Cyber Threat Intelligence Informal Fallacies
  • Cognitive Biases and Examples
• Dissemination: Strategic
  • Report Writing Pitfalls
  • Report Writing Best Practices
  • Different Types of Strategic Output
• Case Study: Stuxnet
• Fine-Tuning Analysis
  • Identifying and Remedying New Intelligence Requirements
  • Tuning the Collection Management Framework
• Case Study: Sofacy
• Attribution
  • Different Types of Attribution
  • Group Attribution
  • Campaign Attribution
  • Intrusion Set Attribution
  • True Attribution
  • Geopolitical Motivations for Cyber Attacks

دوران آکادمی زیر مجموعه گروه دوران، مجری برگزاری دوره FOR578: Cyber Threat Intelligence در قالب آموزش امنیت به صورت آموزش آنلاین و حضوری با بهره گیری از لابراتور آنلاین اختصاصی بهمراه گواهی معتبرارائه می‌شود.