Network Defense Essentials (NDE)

Network Defense Essentials (NDE)

De Network Defense Essentials (N|DE) behandelt de fundamentele concepten van informatiebeveiliging en netwerkdefensie en biedt een holistisch overzicht van identificatie, authenticatie, autorisatie, visualisatie en meer. Test je kennis met CTF-gebaseerde Capstone-projecten en valideer je nieuw verworven vaardigheden in gesurveilleerde examens. Met 12 modules, meer dan 14 uur eersteklas zelfstudievideotraining en 11 interactieve labs kunt u met deze serie formele erkenning aan uw cv toevoegen en uw vaardigheden en expertise aan werkgevers laten zien.

Cursusinhoud

Module 01: Network Security Fundamentals

Understand Fundamentals of Network Security
         o Essentials of Network Security
         o Goal of Network Defense
         o Information Assurance (IA) Principles
                  • Confidentiality
                  • Availability
                  • Integrity
                  • Non-repudiation
                  • Authentication
         o Network Defense Benefits
         o Network Defense Challenges
         o Types of Network Defense Approaches
                  • Preventive Approach
                  • Reactive Approach
                  • Retrospective Approach
                  • Proactive Approach
         o Network Security Controls
                  • Administrative Network Security Controls
                  • Physical Network Security Controls
                  • Technical Network Security Controls

Discuss Essential Network Security Protocols
         o Network Security Protocols
                  • Remote Authentication Dial-in User Service (RADIUS)
                  • Terminal Access Controller Access Control System Plus (TACACS+)
                  • Kerberos
                  • Pretty Good Service (PGP)
                  • Secure/Multipurpose Internet Mail Extensions (S/MIME)
                    ➢ Difference between PGP and S/MIME
                  • Secure Hypertext Transfer Protocol (S-HTTP)
                  • Hypertext Transfer Protocol Secure (HTTPS)
                  • Transport Layer Security (TLS)
                  • Secure Sockets Layer (SSL)
                  • Internet Protocol Security (IPsec)

Module 02: Identification, Authentication and Authorization

Discuss Access Control Principles, Terminologies, and Models
         o Access Control
         o Access Control Terminologies
         o Access Control Principles
         o Access Control Models
                  • Mandatory Access Control (MAC)
                  • Discretionary Access Control (DAC)
                  • Role-based Access Control (RBAC)
                  • Rule-based access control (RB-RBAC)
         o Logical Implementation of DAC, MAC, and RBAC

Lab Exercise

         o Implementing Access Controls in Windows Machine
         o Managing Access Controls in Linux Machine
         o Implementing Role-Based Access Control in Windows Admin Center (WAC)

Discuss Identity and Access Management (IAM) Concepts
         o Identity and Access Management (IAM)
                • User Identity Management (IDM)
                  ➢ Identity Management
                  ➢ Identity Repository
         o User Access Management (AM)
                • Authentication
                  ➢ Types of Authentication
                    ✓ Password Authentication
                    ✓ Smart Card Authentication
                    ✓ Biometric Authentication
                    ✓ Two-factor Authentication
                    ✓ Single Sign-on (SSO) Authentication
                • Authorization
                  ➢ Types of Authorization
                    ✓ Centralized Authorization
                    ✓ Implicit Authorization
                    ✓ Decentralized Authorization
                    ✓ Explicit Authorization
                 • Accounting

Module 03: Network Security Controls - Administrative Controls

Discuss Various Regulatory Frameworks, Laws, and Acts
         o Regulatory Frameworks Compliance
                  • Role of Regulatory Frameworks Compliance in an Organization’s
Administrative Security
         o Why Organizations Need Compliance
         o Identifying Which Regulatory Framework to Comply
         o Deciding on How to Comply to Regulatory Framework
         o Regulatory Frameworks, Laws, and Acts
                   • Payment Card Industry Data Security Standard (PCI-DSS)
                   • Health Insurance Portability and Accountability Act (HIPAA)
                   • Sarbanes Oxley Act (SOX)
                   • Gramm-Leach-Bliley Act (GLBA)
                   • General Data Protection Regulation (GDPR)
                   • Data Protection Act 2018 (DPA)
                   • ISO Information Security Standards
                   • The Digital Millennium Copyright Act (DMCA)
                   • The Federal Information Security Management Act (FISMA)
                   • Other Information Security Acts and Laws
                   • Cyber Law in Different Countries

Learn to Design and Develop Security Policies
         o What is Security Policy?
         o Need for a Security Policy
         o Advantages of Security Policies
         o Characteristics of a Good Security Policy
         o Key Elements of Security Policy
         o Contents of a Security Policy
         o Typical Policy Document Content
         o Types of Information Security Policies
                  • Enterprise Information Security Policy (EISP)
                  • Issue Specific Security Policy (ISSP)
                  • System Specific Security Policy (SSSP)
         o Internet Access Policies
                  • Promiscuous Policy
                  • Permissive Policy
                  • Paranoid Policy
                  • Prudent Policy
         o Password Policy

Lab Exercise

         o Implementing Password Policies Using Windows Group Policy

Learn to Conduct Different Type of Security and Awareness Training
         o Employee Awareness and Training
                  • Security Policy
                  • Physical Security
                  • Social Engineering
                  • Data Classification

Module 04: Network Security Controls - Physical Controls

Understand the Importance of Physical Security
         o Need for Physical Security
         o Physical Security Attack Vectors
                  • Natural/Environmental Threats
                  • Man-made Threats

Discuss Various Physical Security Controls
         o Types of Physical Security Controls
         o Location Considerations
         o Site Architecture Considerations
         o Fire Fighting Systems
         o Physical Barriers
         o Security Personnel
         o Physical Locks
                  • Mechanical locks
                  • Digital locks
                  • Combination locks
                  • Electronic /Electric /Electromagnetic locks
         o Concealed Weapon/Contraband Detection Devices
         o Mantrap
         o Warning Signs
         o Alarm System
         o Video Surveillance
         o Lighting System
         o Power Supply

Describe Workplace Security
         o Reception Area
         o Server/ Backup Device Security
         o Critical Assets and Removable Devices
         o Securing Network Cables
         o Securing Portable Mobile Devices
         o Physical Security Policy

Describe Various Environmental Controls
         o Heating, Ventilation and Air Conditioning
         o Electromagnetic Interference (EMI) Shielding
         o Hot and Cold Aisles
         o Physical Security Checklists

Module 05: Network Security Controls - Technical Controls

Understand Different Types of Network Segmentation
         o What is Network Segmentation?
         o Types of Network Segmentation
                  • Physical Segmentation
                  • Logical Segmentation
                  • Network Virtualization
         o Introduction to Bastion Host
         o Need for Bastion Host
         o Positioning the Bastion Host
         o Types of Bastion Hosts
                  • Single-homed
                  • Multi-homed
                  • Internal Bastion Host
                  • Non-routing Dual-homed Hosts
                  • External Services Hosts
                  • Victim Machines
                  • One-box Firewalls
         o What is Demilitarized Zone (DMZ)?
                  • Different Ways to Create a DMZ
                    ➢ Single Firewall DMZ
                    ➢ Dual Firewall DMZ

Understand Different Types of Firewalls and their Role
         o What is a Firewall?
         o Types of Firewalls
                  • Hardware Firewalls
                  • Software Firewalls
                  • Host-based Firewalls
                  • Network-based Firewalls
         o Firewall Technologies
                  • Packet Filtering Firewall
                  • Circuit-Level Gateways
                  • Application-Level Gateways
                  • Stateful Multilayer Inspection Firewall
                  • Application Proxy
                  • Network Address Translation (NAT)
                  • Virtual Private Network
                  • Next Generation Firewall (NGFW)
         o Firewall Capabilities
         o Firewall Limitations
         o Firewall Implementation and Deployment Process
         o Host-based Firewall Protection with Iptables
         o Secure Firewall Implementation
                  • Best Practices
                  • Recommendations
                  • Do’s and Don’ts

Lab Exercise

         o Implementing Host-based Firewall Protection with iptables
         o Implementing Host-based Firewall Functionality Using Windows Firewall
         o Implementing Network-Based Firewall Functionality: Blocking Unwanted Website
access using pfSense Firewall
         o Implementing Network-Based Firewall Functionality: Blocking Insecure Ports using
pfSense Firewall

Understand Different Types of IDS/IPS and their Role
        o Intrusion Detection and Prevention Systems (IDS/IPS)
        o How does an IDS Work?
        o Role of an IDS in Network Defense
        o How an IDS Detects an Intrusion?
        o IDS Capabilities
        o IDS/IPS Limitations: What an IDS/IPS is NOT?
        o IDS/IPS Security Concerns
                  • Common Mistakes in IDS/IPS Configurations
        o General Indications of Intrusions
                  • File System Intrusions
                  • Network Intrusions
                  • System Intrusions
         o IDS Classification
                  • Approach-based IDS
                    ➢ Signature-Based Detection
                    ➢ Anomaly-based Detection
                  • Anomaly and Misuse Detection Systems
                  • Behavior-based IDS
                  • Protection-based IDS
                  • Structure-based IDS
                  • Analysis Timing-based IDS
                  • Source Data Analysis-based IDS
         o IDS Components
                  • Network Sensors
                  • Command Console
                  • Alert Systems
                  • Response System
                  • Attack Signature Database
         o Collaboration of IDS Components in Intrusion Detection
         o Deployment of Network and Host-based IDS
                  • Staged IDS Deployment
                  • Deploying Network-based IDS
                  • Deploying a Host-based IDS
         o What is an IDS Alert?
         o Types of IDS Alerts
                  • True Positive Alerts
                  • False Positive Alerts
                  • False Negative Alerts
                  • True Negative Alerts
         o Characteristics of Good IDS Solutions
         o Selection of an Appropriate IDS/IPS Solutions
         o Intrusion Detection with Snort
         o Intrusion Detection Tools

Lab Exercise

         o Implementing Host-based IDS functionality using Wazuh HIDS
         o Implementing Network-based IDS Functionality Using Suricata IDS

Understand Different Types of Honeypot
         o Honeypot
         o Types of Honeypots
                  • Classification of Honeypots based on their design criteria
                  • Classification of honeypots based on their deployment strategy
                  • Classification of honeypots based on their deception technology
         o Honeypot Tools

Lab Exercise

         o Detect Malicious Network Traffic using HoneyBOT

Understand Different Types of Proxy Servers and their Benefits
         o What are Proxy Servers?
         o Benefits of Proxy Server
         o Functioning of a Proxy Server
         o Proxy Servers vs Packet Filters
         o Types of Proxy Servers
                  • Transparent Proxy
• Non-transparent Proxy
• SOCKS Proxy
• Anonymous Proxy
• Reverse Proxy
         o How to Configure Proxy Server
                  • Configuring Automatic Proxy Setup in Windows 10
                  • Configuring Manual Proxy Setup in Windows 10
                  • Configuring Proxy Setup in Google Chrome
                  • Configuring Proxy Setup in Microsoft Edge
         o Limitations of Proxy Server
                  • Example of a Proxy Server: Squid Proxy
         o List of Proxy Tools

Discuss Fundamentals of VPN and its importance in Network Security
         o What is a VPN?
         o How VPN Works?
         o Why Establish VPN?
         o VPN Components
         o VPN Concentrators
                  • Functions of a VPN Concentrator
         o VPN Types and Categories
                  • Client-to-site (Remote-access) VPNs
                  • Site-to-Site VPNs
                  • Hardware VPNs
                    ➢ Hardware VPN Products
                  • Software VPNs
                    ➢ Software VPN Products
         o Selecting an Appropriate VPN
         o VPN Core Functionality
                  • Encapsulation
                  • Encryption
                  • Authentication
         o VPN Technologies
                  • Trusted VPNs
                  • Secure VPNs
                  • Hybrid VPNs
        o VPN Topologies
                  • Hub-and-Spoke VPN Topology
                  • Point-to-Point VPN Topology
                  • Full Mesh VPN Topology
                  • Star Topology
         o Example of a VPN: OpenVPN
         o VPN Security Risks
         o VPN Security
                  • Firewalls
                  • IPsec Server
                  • AAA Server
                  • Remote Access Dial-In User Service
                  • Connection to VPN
                    ➢ SSH and PPP
                    ➢ SSL and PPP
                    ➢ Concentrator

Lab Exercise

         o Establishing Virtual Private Network Connection using SoftEther VPN

Discuss Security Incident and Event Management (SIEM)
         o Security Incident and Event Management (SIEM)
         o SIEM Architecture
         o SIEM Functions
         o SIEM Solutions

Discuss User Behavior Analytics (UBA)
         o User Behavior Analytics (UBA)
         o Why User Behavior Analytics is Effective?
         o UBA/UEBA Tools

Understand Various Antivirus/Anti-malware Software
         o Anti-Trojan Software
         o Antivirus Software

Module 06: Virtualization and Cloud Computing

Understand Virtualization Essential Concepts and OS Virtualization Security
         o Virtualization
                  • Virtualization Approaches
                  • Levels of Virtualization
                  • Types of Virtualization
         o Virtualization Components
         o Virtualization Enablers
                  • Network Virtualization (NV)
                  • Software Defined Network (SDN)
                  • Network Function Virtualization (NFV)
         o Common Virtualization Vendors
         o OS Virtualization Security and Concerns
                  • Container
                  • Container Technology Architecture
                  • Types of Containers
                  • Containers Vs Virtual Machine
                  • Docker
                  • Docker Networking
                  • Kubernetes
                  • Container Security Challenges
                  • Container Security Threats
                  • Docker Security Threats
                  • Kubernetes Security Challenges and Threats
         o OS Virtualization Security Best Practices
                  • Best Practices for Container Security
                  • Best Practices for Docker Security
                  • Best Practices for Kubernetes Security
                  • Docker Security Tools

Lab Exercise

         o Auditing Docker Host Security Using Docker-Bench-Security Tool

Understand Cloud Computing Fundamentals
         o Introduction to Cloud Computing
         o Cloud Computing Benefits
         o Types of Cloud Computing Services
                  • Infrastructure-as-a-Service (IaaS)
                  • Platform-as-a-Service (PaaS)
                  • Software-as-a-Service (SaaS)
                  • Identity-as-a-Service (IDaaS)
                  • Security-as-a-Service (SECaaS)
                  • Container-as-a-Service (CaaS)
                  • Function-as-a-Service (FaaS)
                  • Anything-as-a-Service (XaaS)
         o Customer vs CSP Shared Responsibilities in IaaS, PaaS, and SaaS
         o Cloud Deployment Models
                  • Public Cloud
                  • Private Cloud
                  • Community Cloud
                  • Hybrid Cloud
                  • Multi Cloud
         o On-premise vs. Hosted vs. Cloud
         o NIST Cloud Deployment Reference Architecture
         o Cloud Storage Architecture
         o Cloud Service Providers

Discuss the Insights of Cloud Security and Best Practices
         o Cloud Security: Shared Responsibility
         o Elements of Cloud Security
                  • Consumers Vs Providers
                  • Identity and Access Management (IAM)
                  • Compliance
                  • Data Storage Security
                  • Monitoring
                  • Network Security
                  • Logging
         o AWS Identity and Access Management
                  • Lock Your AWS Account Root User Access Keys
                  • Create Individual IAM Users
                  • Use Groups to Assign Permissions to IAM Users
                 • Grant Least Privilege
                 • Use AWS-managed Policies
         o Best Practices for Securing the Cloud
         o NIST Recommendations for Cloud Security
         o Organization/Provider Cloud Security Compliance Checklist
         o Cloud Security Tools

Lab Exercise

         o Implementing AWS Identity and Access Management
         o Securing Amazon Web Services Storage

Module 07: Wireless Network Security

Understand Wireless Network Fundamentals
         o Wireless Terminologies
         o Wireless Networks
         o Wireless Technologies
         o Wired vs. Wireless Networks
         o Wireless Standards
         o Wireless Network Topologies
                  • Ad-hoc Standalone Network Architecture (Independent Basic Service Set
(IBSS))
                   • Infrastructure Network Topology (Centrally Coordinated Architecture/ Basic
Service Set (BSS))
         o Classification of Wireless Networks
                  • Wireless Networks Based on the Connection
                    ➢ Extension to a Wired Network
                    ➢ Multiple Access Points
                    ➢ LAN-to-LAN Wireless Network
                    ➢ 4G Hotspot
                  • Wireless Network Based on the Geographic Area Coverage
                    ➢ WLAN
                    ➢ WWAN
                    ➢ WPAN
                    ➢ WMAN
         o Components of Wireless Network
                  • Access Point
                  • Wireless Cards (NIC)
                  • Wireless Modem
                  • Wireless Bridge
                  • Wireless Repeater
                  • Wireless Router
                  • Wireless Gateways
                  • Wireless USB Adapter
                  • Antenna
                   ➢ Directional Antenna
                   ➢ Parabolic Grid Antenna
                   ➢ Dipole Antenna
                   ➢ Omnidirectional Antenna
                   ➢ Yagi Antenna
                   ➢ Reflector Antennas

Understand Wireless Network Encryption Mechanisms
         o Types of Wireless Encryption
                  • Wired Equivalent Privacy (WEP) Encryption
                  • Wi-Fi Protected Access (WPA) Encryption
                  • WPA2 Encryption
                  • WPA3 Encryption
         o Comparison of WEP, WPA, WPA2, and WPA3
         o Issues in WEP, WPA, and WPA2

Discuss Different Types of Wireless Network Authentication Methods
         o Wi-Fi Authentication Method
                  • Open System Authentication
                  • Shared Key Authentication
         o Wi-Fi Authentication Process Using a Centralized Authentication Server
Discuss and Implement Wireless Network Security Measures
         o Wireless Network Security Measures
                  • Creating an Inventory of Wireless Devices
                  • Placement of a Wireless AP
                  • Placement of a Wireless Antenna
                  • Disable SSID Broadcasting
                  • Selecting a Strong Wireless Encryption Mode
                  • Defending Against WPA Cracking
                  • Detecting Rogue Access Points
                    ➢ Wireless Scanning
                    ➢ Wired Network Scanning
                    ➢ Simple Network Management Protocol (SNMP) Polling
         o Wireless Security Tools
         o Configuring the Administrative Security on Wireless Routers

Lab Exercise

         o Configuring Security on a Wireless Router

Module 08: Mobile Device Security

Understand Various Mobile Device Connection Methods
         o Near-field Communication (NFC)
         o Satellite Communication (Satcom)
         o Cellular Communication
         o ANT
         o Universal Serial Bus (USB)
         o Global Positioning System (GPS)
         o Infrared (IR)
         o Wi-Fi
         o Bluetooth
         o 5G Cellular (Mobile) Communication
         o Point-to-point (P2P) Connection
         o Point-to-multipoint Connection
         o Radio-frequency Identification (RFID)

Discuss Mobile Device Management Concepts
         o Mobile Application Management
         o Mobile Content Management
         o Context-aware Authentication
         o Mobile Email Management
         o Enterprise Mobility Management
         o Mobile Security Management
         o Remote Wipe
         o Screen Lock
         o Passwords and PINs
         o Biometrics
         o Push Notification Services
         o Geolocation
         o Geofencing
         o Full Device Encryption
         o Containerization

Discuss Common Mobile Usage Policies in Enterprises
         o Mobile Use Approaches in Enterprise
         o Bring Your Own Device (BYOD)
                  • BYOD Policy Implementation
         o Choose Your Own Device (CYOD)
                  • CYOD Policy Implementation
         o Corporate Owned, Personally Enabled (COPE)
                  • COPE Policy Implementation
         o Company Owned, Business Only (COBO)
                  • COBO Policy Implementation

Discuss Security Risk and Guidelines Associated with Enterprises Mobile Usage
Policies
         o Enterprise Mobile Device Security Risks and Challenges
         o Risk Associated with BYOD, CYOD, COPE, and COBO
         o Security Guidelines for BYOD, CYOD, COPE, and COBO

Discuss and Implement Enterprise-level Mobile Security Management Solutions
         o Mobile Device Management Solutions
         o Mobile Application Management Solutions
         o Mobile Content Management Solutions
         o Mobile Threat Defense Solutions
         o Mobile Email Management Solutions
         o Enterprise Mobility Management Solutions
         o Unified Endpoint Management Solutions

Discuss and Implement General Security Guidelines and Best Practices on Mobile
Platforms
         o Mobile Application Security Best Practices
         o Mobile Data Security Best Practices
         o Mobile Network Security Guidelines
         o General Guidelines for Mobile Platform Security
         o Android Security Tools
         o iOS Device Security Tools

Lab Exercise

         o Implementing Enterprise Mobile Security Using Miradore MDM Solution

Module 09: IoT Device Security

Understand IoT Devices, Application Areas, and Communication Models
         o What is the IoT?
         o Why Organization are Opting for IoT-enabled Environments
         o IoT Application Areas and Devices
         o IoT Architecture
         o Layers of IoT Architecture
                  • Device Layer
                  • Communication Layer
                  • Cloud Platform Layer
                  • Process Layer
        o IoT Communication Models
        o IoT-Enabled IT Environment

Discuss the Security in IoT-enabled Environments
        o Security in IoT- enabled Environments
        o IoT System Management
        o Stack-wise IoT Security Principles
                 • Secure Device Layer
                 • Secure Communication Layer
                 • Secure Cloud Platform Layer
                • Secure Process Layer
        o IoT Framework Security Considerations
        o IoT Device Management
        o IoT Security Best Practices
        o IoT Security Tools

Lab Exercise

        o Securing IoT Device Communication Using TLS/SSL

Module 10: Cryptography and PKI

Discuss Cryptographic Techniques
         o Cryptography
         o Encryption
                  • Symmetric Encryption
                  • Asymmetric Encryption
         o Government Access to Keys (GAK)

Discuss Various Cryptographic Algorithms
         o Ciphers
                  • Data Encryption Standard (DES)
                  • Advanced Encryption Standard (AES)
                  • RC4, RC5, and RC6 Algorithms
                  • Digital Signature Algorithm (DSA) and Rivest Shamir Adleman (RSA)
                  • MD5 and MD6
                  • Secure Hashing Algorithm (SHA)
                  • HMAC

Discuss Various Cryptography Tools
         o MD5 and MD6 Hash Calculators
         o Hash Calculators for Mobile
         o Cryptography Tools

Lab Exercise

         o Calculate One-way Hashes using HashCalc
         o Calculate MD5 Hashes using HashMyFiles

Discuss Public Key Infrastructure (PKI)
         o Digital Signature
         o Digital Certificates
         o Public Key Infrastructure (PKI)
                  • Certification Authorities

Lab Exercise

         o Create a Self-signed Certificate

Module 11: Data Security

Understand Data Security and its Importance
         o What is Business Critical Data?
                  • Examples of Critical Data
         o The Need of Data Security
         o Data Security
         o Example: Data At Rest vs Data in Use vs Data in Transit
         o Data Security Technologies

Discuss Various Security Controls for Data Encryption
         o Disk Encryption Techniques
                  • Disk Encryption: Implementing Built-in Disk Encryption for Windows
                    ➢ Disk Encryption Tools
                  • File Level Encryption: Implementing Built-in File System-level Encryption on
Windows
                    ➢ File Encryption Tools
                  • Removable Media Encryption: Implementing Removable Media Encryption in
Windows
                    ➢ Removable Media Encryption Tools

Lab Exercise

         o Perform Disk Encryption using VeraCrypt

Discuss Data Backup and Retention
         o Introduction to Data Backup
         o Data Backup Strategy/Plan
         o Selecting the Backup Media
         o Examples of Data Backup Media Devices
         o RAID (Redundant Array Of Independent Disks) Technology
                  • Advantages and Disadvantages of RAID Systems
                  • RAID Storage Architecture
                  • RAID Level 0: Disk Striping
                  • RAID Level 1: Disk Mirroring
                  • RAID Level 3: Disk Striping with Parity
                  • RAID Level 5: Block Interleaved Distributed Parity
                  • RAID Level 10: Blocks Striped and Mirrored
                  • RAID Level 50: Mirroring and Striping across Multiple RAID Levels
         o Storage Area Network (SAN)
                  • Advantages of SAN
         o Network Attached Storage (NAS)
         o Selecting Appropriate Backup Method
                  • Hot Backup (Online)
                  • Cold Backup (Offline)
                  • Warm Backup (Nearline)
         o Choosing the Backup Location
                  • Onsite Data Backup
                  • Offsite Data Backup
                  • Cloud Data Backup
         o Types of Backup
                  • Full/Normal Data Backup
                  • Differential Data Backup
                  • Incremental Data Backup
                  • Advantages and Disadvantages
         o Data Backup Tools
         o Data Backup Retention
         o Data Retention Policy Best practices
         o Data Recovery Tools

Lab Exercise

         o File Recovery Using EaseUS Data Recovery Wizard
         o Backing Up and Restoring Data in Windows

Discuss Data Loss Prevention Concepts
         o What is Data Loss Prevention?
         o Types of Data Loss Prevention (DLP) Solutions
         o DLP Solution: Windows Information Protection (WIP)
                  • DLP Solutions
         o Best Practices for a Successful DLP Implementation

Module 12: Network Traffic Monitoring

Understand the Need and Advantages of Network Traffic Monitoring
         o Network Traffic Monitoring
         o Need for Network Monitoring
         o Advantages of Network Monitoring

Determine Baseline Traffic Signatures for Normal and Suspicious Network Traffic
         o Network Traffic Signatures
                  • Normal Traffic Signature
                  • Attack Signatures
         o Baselining Normal Traffic Signatures
         o Categories of Suspicious Traffic Signatures
                  • Informational
                  • Reconnaissance
                  • Unauthorized Access
                  • Denial of Service
         o Attack Signature Analysis Techniques
                  • Content-based Signatures Analysis
                  • Context-based Signatures Analysis
                  • Atomic Signatures-based Analysis
                  • Composite Signatures-based Analysis

Perform Network Monitoring for Suspicious Traffic
         o Wireshark
                  • Follow TCP Stream in Wireshark
                  • Display Filters in Wireshark
                  • Additional Wireshark Filters
         o Monitoring and Analyzing FTP Traffic
         o Monitoring and Analyzing Telnet Traffic
         o Monitoring and Analyzing HTTP Traffic
         o Network Sniffers for Network Monitoring
         o Network Monitoring Tools

Lab Exercise

         o Capturing Network Traffic using Wireshark
         o Applying Various Filters in Wireshark
         o Analyzing and Examining Various Network Packet Headers in Linux using tcpdump