CyberSec First Responder (CFR): Threat Detection & Response (CFR)

Detailed Course Outline

Lesson 1: Assessing Information Security Risk

  • Identify the Importance of Risk Management
  • Assess Risk
  • Mitigate Risk
  • Integrate Documentation into Risk Management

Lesson 2: Analyzing the Threat Landscape

  • Classify Threats and Threat Profiles
  • Perform Ongoing Threat Research

Lesson 3: Analyzing Reconnaissance Threats to Computing and Network Environments

  • Implement Threat Modeling
  • Assess the Impact of Reconnaissance Incidents
  • Assess the Impact of Social Engineering

Lesson 4: Analyzing Attacks on Computing and Network Environments

  • Assess the Impact of System Hacking Attacks
  • Assess the Impact of Web-Based Attacks
  • Assess the Impact of Malware
  • Assess the Impact of Hijacking and Impersonation Attacks
  • Assess the Impact of DoS Incidents
  • Assess the Impact of Threats to Mobile Security
  • Assess the Impact of Threats to Cloud Security

Lesson 5: Analyzing Post-Attack Techniques

  • Assess Command and Control Techniques
  • Assess Persistence Techniques
  • Assess Lateral Movement and Pivoting Techniques
  • Assess Data Exfiltration Techniques
  • Assess Anti-Forensics Techniques

Lesson 6: Evaluating the Organization’s Security Posture

  • Conduct Vulnerability Assessments
  • Conduct Penetration Tests on Network Assets
  • Follow Up on Penetration Testing

Lesson 7: Collecting Cybersecurity Intelligence

  • Deploy a Security Intelligence Collection and Analysis Platform
  • Collect Data from Network-Based Intelligence Sources
  • Collect Data from Host-Based Intelligence Sources

Lesson 8: Analyzing Log Data

  • Use Common Tools to Analyze Logs
  • Use SIEM Tools for Analysis
  • Parse Log Files with Regular Expressions

Lesson 9: Performing Active Asset and Network Analysis

  • Analyze Incidents with Windows-Based Tools
  • Analyze Incidents with Linux-Based Tools
  • Analyze Malware
  • Analyze Indicators of Compromise

Lesson 10: Responding to Cybersecurity Incidents

  • Deploy an Incident Handling and Response Architecture
  • Mitigate Incidents
  • Prepare for Forensic Investigation as a CSIRT

Lesson 11: Investigating Cybersecurity Incidents

  • Apply a Forensic Investigation Plan
  • Securely Collect and Analyze Electronic Evidence
  • Follow Up on the Results of an Investigation
  • Appendix A: Mapping Course Content to CyberSec First Responder (Exam CFR-210)
  • Appendix B: List of Security Resources