Cyber Defence

Day 1: Networking and Threat Modelling

This session kicks off with a comprehensive introduction to Cyber Defence, The Information Environment and Network Centric Operations. Students are introduced to ways of affecting the information environment and approaches to threat modelling, and will be stepped through examples of network attacks.

Topics

Situational awareness, Network Collection Value-Chain, Self-Synchronisation, Hardening, Obfuscation, Threat-Detected Protection, Anomaly Detection, Network Attacks.

Day 2: Protection

This session presents the concept of using protection techniques to proactively prevent or minimise the effect of a compromise or breach. Techniques covered include methods listed in the ASD Essential 8, architectural security design and vulnerability scanning.

Topics

User Application Hardening, Host-Based Hardening, Minimising Attack Surfaces, Linux Firewalls, Network Segmentation, Demilitarised Zones, LUN Masking, Encryption.

Day 3: Collection and Detection

Students are introduced to collection methods such as the deployment and configuration of sensors, sensor data processing and aggregation for analysis. The session also covers detection strategies, network- and host-based intrusion detection and honeypots.

Topics

Network Sensors, Fusion, IOCs and Signatures, Anomaly Detection, Security Onion Architecture, Open Threat Exchange, Honeypots.

Days 4 & 5: Incident Response

These sessions give an overview of orientation and investigation techniques. Students will understand how to make sense of observed information to assess the situation, identify indicators of compromise and the extent of threat activity. We'll also cover how such indicators initiate incident response plans and look at writing, editing and proper formatting of intelligence reports.

Topics

Orientation, Investigation, Instigation, Association, Incident Response Planning, Intelligence Reporting.

Please download the Cyber Defence course PDF.