Cybersec First Responder (CFR)

Introduction

• Course Description
• Course-Specific Technical Requirements
• How to Use This Course

Assessing Information Security Risk

• Topic A: Identify the Importance of Risk Management
• Topic B: Assess Risk
• Topic C: Mitigate Risk
• Topic D: Integrate Documentation into Risk Management
• Summary

Analyzing the Threat Landscape

• Topic A: Classify Threats and Threat Profiles
• Topic B: Perform Ongoing Threat Research
• Summary

Analyzing Reconnaissance Threats to Computing and Network Environments

• Topic A: Implement Threat Modeling
• Topic B: Assess the Impact of Reconnaissance
• Topic C: Assess the Impact of Social Engineering
• Summary

Analyzing Attacks on Computing and Network Environments

• Topic A: Assess the Impact of System Hacking Attacks
• Topic B: Assess the Impact of Web-Based Attacks
• Topic C: Assess the Impact of Malware
• Topic D: Assess the Impact of Hijacking and Impersonation Attacks
• Topic E: Assess the Impact of DoS Incidents
• Topic F: Assess the Impact of Threats to Mobile Security
• Topic G: Assess the Impact of Threats to Cloud Security
• Summary

Analyzing Post-Attack Techniques

• Topic A: Assess Command and Control Techniques
• Topic B: Assess Persistence Techniques
• Topic C: Assess Lateral Movement and Pivoting Techniques
• Topic D: Assess Data Exfiltration Techniques
• Topic E: Assess Anti-Forensics Techniques
• Summary

Managing Vulnerabilities in the Organization

• Topic A: Implement a Vulnerability Management Plan
• Topic B: Assess Common Vulnerabilities
• Topic C: Conduct Vulnerability Scans
• Summary

Implementing Penetration Testing to Evaluate Security

• Topic A: Conduct Penetration Tests on Network Assets
• Topic B: Follow Up on Penetration Testing
• Summary

Collecting Cybersecurity Intelligence

• Topic A: Deploy a Security Intelligence Collection and Analysis Platform
• Topic B: Collect Data from Network-Based Intelligence Sources
• Topic C: Collect Data from Host-Based Intelligence Sources
• Summary

Analyzing Log Data

• Topic A: Use Common Tools to Analyze Logs
• Topic B: Use SIEM Tools for Analysis
• Summary

Performing Active Asset and Network Analysis

• Topic A: Analyze Incidents with Windows-Based Tools
• Topic B: Analyze Incidents with Linux-Based Tools
• Topic C: Analyze Malware
• Topic D: Analyze Indicators of Compromise
• Summary

Responding to Cybersecurity Incidents

• Topic A: Deploy an Incident Handling and Response Architecture
• Topic B: Contain and Mitigate Incidents
• Topic C: Prepare for Forensic Investigation as a CSIRT
• Summary

Investigating Cybersecurity Incidents

• Topic A: Apply a Forensic Investigation Plan
• Topic B: Securely Collect and Analyze Electronic Evidence
• Topic C: Follow Up on the Results of an Investigation
• Summary

Appendix A: Mapping CyberSec First Responder (Exam CFR-310) Objectives to Course Content

Appendix B: Regular Expressions

• Topic A: Parse Log Files with Regular Expressions

Appendix C: Security Resources

• Topic A: List of Security Resources

Appendix D: U.S. Department of Defense Operational Security Practices

• Topic A: Summary of U.S. Department of Defense Operational Security Practices