CCNA Cybersecurity Bootcamp

• What attackers want and why security matters
• Confidentiality, integrity and availability [1.1]
• What a Security Operations Center does: tiers and roles
• Logs and alerts: the raw material of a SOC

LAB Guided tour: your first look at security logs

• IP addresses, ports and common protocols
• TCP vs. UDP and the protocol headers analysts read [4.8]
• Windows and Linux components analysts work with [3.2]
• Linux command line for log analysis

LAB Read and search logs on a Linux workstation

• Risk, threat, vulnerability and exploit [1.4]
• Threat intelligence, threat hunting, threat actors and more [1.3]
• Defense-in-depth strategy [1.5]
• How a SOC analyst works a case

LAB SOC triage: investigate an SSH brute-force alert

• DAC, MAC, RBAC, ABAC and more [1.6]
• Authentication, authorization and accounting [1.6.d]
• CVSS base metrics [1.7.a-e]
• Temporal and environmental metrics [1.7.f-g]

LAB Score vulnerabilities with CVSS

• Attack surface vs. vulnerability [2.1]
• Protocol-based attacks, DoS and DDoS [2.5]
• Man-in-the-middle attacks [2.5]
• Social engineering techniques [2.7]

LAB Identify attacks in firewall and DNS logs

• SQL injection, command injection and XSS [2.6]
• Buffer overflows and command and control [2.8]
• Malware and ransomware [2.8]
• Evasion and obfuscation [2.9]

LAB Spot injection attempts in web server logs

• Symmetric vs. asymmetric encryption [2.10]
• PKI and certificate chains [2.10]
• X.509, cipher suites and key exchange [2.11.a-c]
• Protocol versions and PKCS [2.11.d-e]

LAB Inspect certificates from the command line

• Network, endpoint, application and cloud security systems [1.2]
• SIEM, SOAR and log management [1.2.d]
• NetFlow, firewall and content-filtering data [2.2]
• Full packet, session, transaction, statistical and alert data [2.4]

LAB Choose the right data source for each question

• ACLs, NAT/PAT, tunneling and TOR [2.3.a-d]
• Encryption, P2P, encapsulation and load balancing [2.3.e-h]
• Network, host and cloud visibility gaps [1.8]
• Data-loss signals in traffic profiles [1.9]

LAB Find exfiltration in traffic statistics

• Rule-based vs. behavioral and statistical detection [1.11]
• The 5-tuple for isolating hosts [1.10]
• True/false positives and negatives [4.2]
• Sliding-window anomaly detection [1.3.g]

LAB Triage an alert queue

• HIDS, antimalware and host firewalls [3.1]
• Rules, signatures and predictive AI on endpoints [3.1]
• Processes, services and logs on Windows and Linux [3.2, 3.6]
• Interpreting command-line and application logs [3.6]

LAB Hunt for persistence on a Linux host

• Attribution: assets, IOCs, IOAs, chain of custody [3.3]
• Best, corroborative and indirect evidence [3.4]
• Tampered vs. untampered disk images [3.5]
• Sandbox report interpretation [3.7]

LAB Build a timeline from host evidence

• Ethernet, IPv4, IPv6, TCP, UDP and ICMP headers [4.8]
• DNS, email, HTTP/HTTPS and ARP [4.8]
• Key elements of an intrusion in a PCAP [4.7]
• Inline interrogation vs. taps and NetFlow [4.4-4.5]

LAB Read protocol headers in a capture

• Mapping events to IDS/IPS, firewall and proxy sources [4.1]
• DPI vs. packet filtering vs. stateful inspection [4.3]
• Extracting files from TCP streams [4.6]
• Artifacts and regular expressions [4.9-4.10]

LAB Investigate an IDS alert end to end

• Incident response plan elements [5.2]
• The NIST SP 800-61 process, preparation to lessons learned [5.3-5.4]
• Stakeholders and IR categories [5.5]
• Evidence collection per NIST SP 800-86 [5.6]

LAB Run an incident response tabletop

• Asset, configuration, patch and vulnerability management [5.1]
• Network and server profiling; PII, PHI and PSI [5.7-5.9]
• Cyber Kill Chain and Diamond Model [5.10]
• Full-length practice exam

LAB Capstone: investigate a multi-stage intrusion