Official websites use .gov
A .gov website belongs to an official government organization in the United States.
Secure .gov websites use HTTPS
A lock ( ) or https:// means you’ve safely connected to the .gov website. Share sensitive information only on official, secure websites.
Supply Chain - Live-fire scenario
Cybercriminals often take advantage of trusted vendors of an organization as a means to gain access to the internal network of their victims. These attacks are targeted at the organizations weakest link, trusted vendors with privilege access, like SolarWinds. Your team's job will be to investigate an alert regarding leaked data from your organization. During your investigation you will learn to locate the source of the leak, detect evasive techniques, and restore your network to normal operating activity.
Course Overview
Knowledge of basic and main logs (Windows, Firewalls, AV, Servers, Linux etc.) Experience working with Security Information and Event Management (SIEM) Basic knowledge of cyber-attacks and attackers' TTP's (Tactics, techniques, and procedures) Experience working with process investigation tools Familiarity with network forensics
Learning Objectives
Your team's job will be to investigate an alert regarding leaked data from your organization. During your investigation you will learn to locate the source of the leak, detect evasive techniques, and restore your network to normal operating activity.
Framework Connections
The materials within this course focus on the NICE Framework Task, Knowledge, and Skill statements identified within the indicated NICE Framework component(s):
Competency Areas
Feedback
If you would like to provide feedback on this course, please e-mail the NICCS team at NICCS@mail.cisa.dhs.gov. Please keep in mind that NICCS does not own this course or accept payment for course entry. If you have questions related to the details of this course, such as cost, prerequisites, how to register, etc., please contact the course training provider directly. You can find course training provider contact information by following the link that says “Visit course page for more information...” on this page.