This package consists of CYRIN labs focusing on the NIST National Initiative for Cybersecurity Education (NICE) Cyber Operations specialty area. Completing these labs will help you learn the skills needed for a job in the area.

Prerequisites vary by lab, but are generally: familiarity with the Unix/Linux command line and basic networking concepts (TCP/IP, DNS, etc.).

EXPECTED DURATION

23.0 hours, self-paced. Pause and continue at any time.
23.0 CPEs awarded on successful completion.

• Log Analysis with RSYSLOG

  This lab teaches students to setup and configure a central RSYSLOG server that will receive and store logs from FreeBSD, Linux and Windows clients.

  Students will learn to configure log forwarding on the clients, and log rotation and filtering on the server. They will also learn to use Logwatch to analyze logs and fail2ban to automatically respond to suspicious activity found in the logs.

• Log Analytics with Splunk

  In this lab the student will learn how to configure and securely run the Splunk Enterprise security information collection and analysis platform. The objective of the lab is to deploy multiple instances of Splunk data forwarders through a deployment server and analyze the logs received from the servers. The student will write custom scripts to generate logs, create both visual and textual reports, organize these reports into a single dashboard, and learn to recognize malicious activity.

• Log Analytics with Elastic Stack

  Elastic Stack is a group of services designed to take data from almost any type of source and in almost any type of format, and to search, analyze and visualize that data in real time. In this lab, Elastic Stack will be used for log analytics. Students will learn to set up and run the Elasticsearch, Logstash and Kibana components of Elastic Stack. Multiple computers in a small network will forward their logs to a central server where they will be processed by Elastic Stack. Student will use Kibana to view logs, filter them and set up dashboards. Information in the logs will be used to identify and block an on-going attack.

• Protocol Analysis I: Wireshark Basics

  Where do you begin in network traffic analysis? Learn the process for examining a live or pre-recorded packet capture file using graphical tools such as Wireshark. Is there malicious activity? Learn to think like an attacker, going through the same methods the attacker would, to assess whether what you’re seeing is “normal” or signs of an attack. At the same time, students will run basic network scans using nmap, while seeing how they appear in Wireshark. Finally, students will analyze packet traces indicative of HTTP-based attacks.

• Protocol Analysis II: Extracting Data from Network Traffic

  Build on what you learned in Protocol Analysis I, this time using command line tools and techniques. You will use the ubiquitous tcpdump program, starting with simple capture tasks and then building up to complex filtering and display options. In the process, you will dig deeply into TCP and IP header fields, learning how these can be used to find the traffic you’re interested in. You will examine ICMP, SSH, and HTTP traffic, including that from web shells commonly used in attacks. With the techniques learned in this exercise, you will be able to gather and filter packet capture data from server systems, then later process it on graphical security operations workstations.

• Packet Capture Analysis and Manipulation

  Get valuable experience extracting data from network packet captures! Students will use Wireshark^® to analyze network packet traces containing normal network traffic and active attacks. Detailed information will be extracted from the traces by examining packets and by using Wireshark’s built-in analysis and PCAP-manipulation tools.

• Intrusion Analysis using Network Traffic

  Examine packet captures from actual intrusions and dive deeper into how attackers operate! Students will learn the details of protocols such as SMB and SSH by examining network traffic captures in Wireshark^®, then will proceed to build network packets “by hand” in order to tunnel secret data in normal-looking traffic. Finally, students will learn the details of “web shell” payloads commonly used by attackers.

• Advanced Analysis of Malicious Network Traffic

  Continue your exploration into malware’s behavior on the network! Students will analyze network captures containing real, malicious network traffic, both by hand and using tools such as Security Onion and Sguil. Both malware spreading methods and command and control operations will be explored. In addition, students will create web shell payloads of their own to see how they operate from the inside.

• Conduct a Data Leak Investigation

  Get experience conducting an internal investigation on a realistic corporate network.

  You are a security officer for a shipping company whose trucks have repeatedly been hijacked by a criminal organization. The criminals appear to have advance information on the routes of the trucks, despite the company changing routes frequently. Company executives suspect someone within the company is leaking truck route information to the criminals. Students will have to determine who is leaking the information, how, and to whom.

• ICS OT Man in the Middle Attack

  Would you know if a device on your Operational Technology (OT) network was compromised on its way from the factory to you? Or if a contractor inadvertently installed some malware that didn’t activate until months later?

  This scenario presents just such an attack on the OT network—one of the existing devices on the network is intercepting and modifying SCADA traffic. It could be producing false measurements, or be sending commands to an unsuspecting device on behalf of the SCADA Server!