دوره SANS FOR 578

دوره FOR578: Cyber Threat Intelligence

پیش نیاز دوره SANS FOR 578

داشتن دانش در حد یکی از دوره‌های زیر:

• SANS 401
• SANS 511
• FOR 508
• FOR 572
• FOR526
• FOR 610
• ICS515

مخاطبین دوره SANS FOR 578

• کارشناسان جرائم رایانه‌ای
• شکارچیان تهدیدات
• کارشناسان امنیت
• مدیران امنیت اطلاعات
• کارشناسان واحد پاسخگویی به حوادث
• کارشناسان واحد مرکز عملیات امنیت

مزایای دوره

• ارائه مدرک معتبر
• برگزاری دوره‌ها بصورت کاملا عملی
• استفاده از لابراتور مجهز
• استفاده از برترین اساتید داخلی و با مدرک بین‌المللی
• با توجه به حضور گروه دوران در بیش از 1000 پروژه سازمانی، امکان معرفی دانشجویان دوره به بازار کار مرتبط به دوره‌ها
• تخفیف جهت حضور در دوره‌های بعدی
• دريافت مدرک بين المللی مرتبط

سرفصل دوره

  FOR578.1: Cyber Threat Intelligence and Requirements

• Case-Study: Carbanak, “The Great Bank Robbery”

• Understanding Intelligence

  • Intelligence Lexicon and Definitions
  • Traditional Intelligence Cycle
  • Sherman Kent and Intelligence Tradecraft
  • Structured Analytical Techniques

• Understanding Cyber Threat Intelligence

  • Defining Threats
  • Understanding Risk
  • Cyber Threat Intelligence and Its Role
  • Expectation of Organizations and Analysts
  • Four Methods of Threat Detection

• Threat Intelligence Consumption

  • Sliding Scale of Cybersecurity
  • Consuming Intelligence for Different Goals
  • Enabling Other Teams with Intelligence

• Positioning the Team to Generate Intelligence

  • Building an Intelligence Team
  • Positioning the Team in the Organization
  • Prerequisites for Intelligence Generation

• Planning and Direction (Developing Requirements)

  • Intelligence Requirements
  • Priority Intelligence Requirements
  • Beginning the Intelligence Lifecycle
  • Threat Modeling

  FOR578.2: The Fundamental Skillset: Intrusion Analysis

Topics

• Primary Collection Source: Intrusion Analysis

  • Intrusion Analysis as a Core Skillset
  • Methods to Performing Intrusion Analysis
  • Intrusion Kill Chain

• Kill Chain Courses of Action

  • Passively Discovering Activity in Historical Data and Logs
  • Detecting Future Threat Actions and Capabilities
  • Denying Access to Threats
  • Delaying and Degrading Adversary Tactics and Malware

• Kill Chain Deep Dive

  • Scenario Introduction
  • Notification of Malicious Activity
  • Pivoting Off of a Single Indicator to Discover Adversary Activity
  • Identifying and Categorizing Malicious Actions
  • Using Network and Host-Based Data
  • Interacting with Incident Response Teams
  • Interacting with Malware Reverse Engineers
  • Effectively Leveraging Requests for Information

• Handling Multiple Kill Chains

  • Identifying Different Simultaneous Intrusions
  • Managing and Constructing Multiple Kill Chains
  • Linking Related Intrusions

• Collection Source: Malware

  • Data from Malware Analysis
  • Key Data Types to Analyze and Pivot On
  • VirusTotal and Malware Parsers
  • Identifying Intrusion Patterns and Key Indicators

   FOR578.3: Collection Sources

• Case Study: Axiom

• Collection Source: Domains

• • Domain Deep Dive
  • Different Types of Adversary Domains
  • Pivoting off of Information in Domains

• Case Study: GlassRAT

• Collection Source: External Datasets

  • Building Repositories from External Datasets
  • Open-Source Intelligence Collection Tools and Frameworks

• Collection Source: TLS Certificates

  • TLS/SSL Certificates
  • Tracking New Malware Samples and C2 with TLS
  • Pivoting off of Information in TLS Certificates

• Case Study: Trickbots

• Exploitation: Storing and Structuring Data

  • Storing Threat Data
  • Threat Information Sharing
  • MISP as a Storage Platform

   FOR578.4: Analysis and Dissemination of Intelligence

• Analysis: Exploring Hypotheses

  • Analysis of Competing Hypotheses
  • Hypotheses Generation
  • Understanding and Identifying Knowledge Gaps

• Analysis: Building Campaigns

  • Different Methods of Campaign Correlation
  • Understanding Perceived Adversary Intentions
  • Leveraging the Diamond Model for Campaign Analysis

• Dissemination: Tactical

  • Understanding the Audience and Consumer
  • Threat Data Feeds and Their Limitations
  • YARA
  • Advanced YARA Concepts and Examples

• Case Study: Sony Attack

• Dissemination: Operational

  • Partners and Collaboration
  • Government Intelligence Sharing
  • Traffic Light Protocol Standard
  • Information Sharing and Analysis Centers
  • CybOX, STIX, and TAXII
  • STIX Elements and Projects
  • TAXII Implementations
  • Threat Intelligence Metrics
  • Communicating About Campaigns
  • Campaign Heat Maps and Tracking Adversaries

   FOR578.5: Higher-Order Analysis and Attribution

• Logical Fallacies and Cognitive Biases

  • Identifying and Defeating Bias
  • Logical Fallacies and Examples
  • Common Cyber Threat Intelligence Informal Fallacies
  • Cognitive Biases and Examples

• Dissemination: Strategic

  • Report Writing Pitfalls
  • Report Writing Best Practices
  • Different Types of Strategic Output

• Case Study: Stuxnet

• Fine-Tuning Analysis

  • Identifying and Remedying New Intelligence Requirements
  • Tuning the Collection Management Framework

• Case Study: Sofacy

• Attribution

  • Different Types of Attribution
  • Group Attribution
  • Campaign Attribution
  • Intrusion Set Attribution
  • True Attribution
  • Geopolitical Motivations for Cyber Attacks

دوران آکادمی زیر مجموعه گروه دوران، مجری برگزاری دوره SANS FOR 578 در قالب آموزش امنیت به صورت آموزش آنلاین و حضوری با بهره گیری از لابراتور آنلاین اختصاصی بهمراه گواهی معتبرارائه می‌شود.