Overview

The objective of the course is to provide a comprehensive but necessarily high-level overview across industry standard technology and platforms, illuminating the technology and its specific cyber governance, risk, and assurance challenges, including artificial intelligence (AI) adoption, without technically challenging the learner to hands-on labs.

On the first day the course takes the learner back to computer basics to build the individuals understanding common technology platforms through to the network layer and on via virtualisation technologies, cloud systems, telecoms and modern communications and insight into the world of protective monitoring, challenges and issues of security events logs and analysis.

Common methods of attack. Providing the learner with an insight into many of the most popular attack vectors today.

The third day will start the benefits and pitfalls of encryption. Then covering cyber law and the context in which security practitioners and organisations must operate within. Each of us has a digital footprint and the technology we use within our enterprise as an attack surface. The next module joins these two principles and explains the challenges for assurance around leaky data.

During the remainder of day four and five we introduce the layered cyber concepts and the deeper governance required throughout the entire lifecycle covering several specialist areas essential to the rounded security practitioner.

Each day provides insight into the technical subject matter with the crucial security subtext. Knowledge check exercises, where delegates work in groups to discuss and provide solutions to scenarios offering an explanation with a rationale in each instance of why this is important from a security assurance perspective. Learners will also have the opportunity to take part in a real-time ransomware response scenario exercise, ideal as a capstone event to help consolidate learning.

Read more

Prerequisites

There are no prerequisites for this course, however, participants are expected to have a basic understanding of computers and the internet.

Read more

Agenda

  • Understand the threats faced by modern networks, systems, and application platforms.
  • Network fundamentals - explaining basic networking concepts including network services, physical connections, topologies and architecture, and cloud connectivity.
  • Understand network security concepts and network attacks to harden networks against threats.
  • Understand routing technologies and networking devices; ethernet solutions and wireless technologies including Bluetooth, WAN, LAN, MAN, PAN, and BAN
  • Understand the difference between the OSI 7-layer model and the TCP/IP Model
  • Understand the threats, attacks and vulnerabilities from newer custom devices that must be mitigated, such as IoT and embedded devices, DDoS attacks and social engineering attacks based on current events.
  • Understand organisational risk management and compliance with regulations, such as PCI-DSS, SOX, HIPAA, GDPR, FISMA, GLBA and CCPA.
  • Introduction to the risks and security challenges with AI adoption within organisations.
  • Understand organisational security assessment through protective monitoring and incident response procedures, such as basic threat detection, risk mitigation techniques, security controls and basic digital forensics.
  • Understand cloud computing concept and architecture.
  • Understand the physical security components connected to the Internet threat they pose to your organisation. Including RFID, IOT, smart phones.
  • Insider threat, the passive and active threat and how to overcome them.
  • Understand physical, technical, and procedural security controls.
  • Perimeter defences are not enough. Understand de-perimeterisation and how to implement layered security approach using defence in depth.
  • Understand the techniques used to detect, prevent, and respond to threats.
  • Identify areas of testing, audit and review and system development
  • Open-source security tools for active and passive defence techniques
  • Understand the difference between separation of systems and segregation of duties and how that is implemented and validated.
  • Discover and analyse ‘high risk’ weakness within systems.
  • Understand cryptography and its applications in a digital world.
  • Analyse, attribute, and predict the threats and create an active defence posture.
Read more

Course Outline

Day 1

Module 1 Computing Foundation, Data Storage and Memory

  • Computer system components, operating systems (Windows, Linux & Mac), different types of storage, and memory management.

Module 2 Network Computing

  • Switched networks, packet switching vs circuit switching, packet routing delivery, routing, WAN, LAN, MAN, internetworking standards, OSI model 7 layers.

Module 3 Network Communications - TCP/IP protocol suite,

  • Types of addresses, physical address, logical address, IPv4, IPv6, port address, specific address, WAN vs LAN, DHCP (Dynamic Host Configuration Protocol) and network access control.

Module 4 Internet Primer

  • How does data travel across the internet? End to end examples for web browsing, emails, using applications - explaining internet architecture, routing, DNS.

Day 2

Module 5 Network Security

  • Secure planning, policies and mechanisms, Active Directory structure, introducing Group Policy (containers, templates, GPO), security and network layers, IPSEC (IP Security), SSL / TLS (flaws and comparisons) SSH (secure shell), Firewalls (packet filtering, state full inspection and NGFW), application gateways, ACL's.

Module 6 Modern Communications

  • VoIP, Smishing, Vishing, wireless LAN (WI-FI), Network Analysis and Sniffing, Wireshark. IOT communication data, SHODAN, Bluetooth, Zwave, Zigbee, PAN (personal area network), HAN (home area network), BAN (body area network) and 5G.

Module 7 Virtualisation & Cloud Technologies

  • Virtualisation definitions, virtualisation models, Cloud Security Alliance (CSA), terminologies, ISO/IEC 27017 is an information security framework for organisations using (or considering) cloud services. Virtual models, virtual platforms, what is cloud computing, cloud essentials, cloud service models, security & privacy in the cloud ISO 27018, multi-tenancy issues, infrastructure vs data security. Cloud Security Technical Reference Architecture from Cybersecurity & Infrastructure Security Agency (CISA)

Module 8 Protective Monitoring (Security Information Event Management SIEM)

  • Security Information Event Management (SIEM) processes and architecture, SOAR security orchestration, automation, and response. SIEM features, user activity monitoring, real time event correlation, log retention, file integrity monitoring, security auditing & automation auditing, what to audit, implementation guidelines, what to collect, Windows Event Log, UNIX Syslog, logging at an application level, audit trail analysis, approaches to data analysis.

Module 9 Common Methods of Attack

  • Cyber exploits, understanding malware, cross site scripting, SQL Injection, virus, worm, DDOS, input validation, ransomware, buffer-overflow, targeted attacks, cyber threat intelligence, MITRE ATT&CK®, D3FEND Matrix | MITRE D3FEND™, Cyber Kill Chain and advanced persistent threats (APT).

CyberFish DoJo Ransomware response scenario

Day 3

Module 10 Encryption

  • Uses of encryption technology, symmetric / asymmetric key encryption, public and private keys, weaknesses, decryption, hashing, digital signatures, PKI, certificates authorities, data at rest and in transit, SSL/TLS, and SSL stripping.

Module 11 Cyber and the Legal Framework

  • Legislation, chain of custody, reporting and assurance within the context of a legal framework, Artificial Intelligence (AI) Governance, EU General Data Protection Regulation (GDPR & DPA), California Consumer Privacy Act (CCPA), Federal Computer Fraud and Abuse act versus Computer Misuse Act. HIPAA, Sarbanes Oxley (SOX). The Federal Information Security Management Act (FISMA), Freedom Act and Federal Trade Commission Act (FTCA).

Module 12 Digital Footprints

  • Internet foundations, WHOIS (Inc. worked example), Internet analysis, search engines, OSINT techniques offensive and defensive, Tools for finding information on people and companies, username searchers, email searching, passwords, surface, dark and deep web. Data breach websites. Phishing, Spear Phishing, Whaling, Deep Fake attack. Social Engineering attacks.

Module 13 Information Assurance

  • Overview – Drivers for Information Assurance, CIA Triad, what do attackers want? Threats to your organisation and the capabilities

Day 4

Module 14 Risk Management and Risk Treatment

  • Business context and risk management approach, return on security investment (ROSI/ROI), risk management lifecycle, who delivers risk management - where in the lifecycle, understanding the context, legal and regulatory. Risk Treatment - Identify the ways of treating risks, methods of gaining assurance, understanding the nature of inherent/residual risk, collecting evidence that supports decisions, risk management decisions.

Module 15 Physical Security

  • Physical security - lighting, CCTV, fencing, intrusion detection, screening, destruction, UPS and generators, access, and control of entry.

Module 16 Personnel Security

  • People, employees, contractors, customers (resource, vulnerability, threat), recruitment, screening, Social Engineering, Common People Exploits, T&C's, in role, change in role, termination, insider threat, supply chain challenges.

Module 17 Service Assurance & Standards

  • Assurance perspective - including CPA/CAPS, FIPS, CE, Common Criteria, SPF. Summary of common industry standards. (Inc. OWASP, ISO27001/2, PCI-DSS)

Day 5

Module 18 Software Security Assurance

  • Principles for software security, (securing the weakest link, defence in depth, failing securely, least privilege, separation of privilege), IA design principles.

Module 19 Secure Development Process

  • Secure by Design, Secure Development Life Cycle (SDLC). AI Governance in the System Development Life Cycle: Insights on Responsible Machine Learning Engineering. Testing, audit and review and system development. UAT (user acceptance testing. White, grey, and black box testing.

Module 20 Threat Modelling and STRIDE

  • What is threat modelling, threat modelling processes, STRIDE: Risk Mitigation options

Module 21 Introduction to Security Architecture

  • Security design architecture, enterprise design frameworks (TOGAF, ZACHMAN, SABSA), patterns (NCSC, Open Security Architecture).

Module 22 Security Best Practice

  • Reduce the attack surface, defence in depth, test security, weaknesses and vulnerabilities, secure coding, learn from mistakes, NCSC 10 steps to cybersecurity and NIST Cybersecurity framework.

Exam Information

Candidates will receive individual emails to access their APMG candidate portal, typically available two weeks post exam.

Knowledge Check – Quiz

End of module knowledge check – exam style questions

Duration 50 Minutes

Questions 50, multiple choice (4 multiple choice answers only 1 of which is correct)

Pass Mark 50%

Read more

Why choose QA

NCSC Assured Training

You will be issued with the Cyber Exercise Responder digital badge, upon completing the gamified CyberFish Dojo cyber ransomware attack simulation exercise, which is included within your course as a capstone knowledge consolidation exercise.

Dates & Locations

Cyber Security learning paths

Want to boost your career in cyber security? Click on the roles below to see QA's learning pathways, specially designed to give you the skills to succeed.

Required Star = Required
Certification = Certification
Application Security
Cloud Security
Information Security Management
Security Risk
Cyber Tech Generalist
DFIR Digital Forensics & Incident Response
Industrial Controls & OT Security
NIST Pathway
OffSec
Privacy Professional
Security Auditor
Secure Coding
Cyber Blue Team
Vulnerability Assessment & Penetration Testing
Emerging Tech Security
Reverse Engineer
Security Architect

Cyber Defensive Operations learning paths

Want to boost your career in Cyber Defensive Operations? View QA's learning pathways below, specially designed to give you the skills to succeed.

Required Star = Required
Certification = Certification
Cyber Blue Team
DFIR Digital Forensics & Incident Response
Cyber Tech Generalist

Frequently asked questions

See all of our FAQs

How can I create an account on myQA.com?

There are a number of ways to create an account. If you are a self-funder, simply select the "Create account" option on the login page.

If you have been booked onto a course by your company, you will receive a confirmation email. From this email, select "Sign into myQA" and you will be taken to the "Create account" page. Complete all of the details and select "Create account".

If you have the booking number you can also go here and select the "I have a booking number" option. Enter the booking reference and your surname. If the details match, you will be taken to the "Create account" page from where you can enter your details and confirm your account.

Find more answers to frequently asked questions in our FAQs: Bookings & Cancellations page.

How do QA’s virtual classroom courses work?

Our virtual classroom courses allow you to access award-winning classroom training, without leaving your home or office. Our learning professionals are specially trained on how to interact with remote attendees and our remote labs ensure all participants can take part in hands-on exercises wherever they are.

We use the WebEx video conferencing platform by Cisco. Before you book, check that you meet the WebEx system requirements and run a test meeting (more details in the link below) to ensure the software is compatible with your firewall settings. If it doesn’t work, try adjusting your settings or contact your IT department about permitting the website.

Learn more about our Virtual Classrooms.

How do QA’s online courses work?

QA online courses, also commonly known as distance learning courses or elearning courses, take the form of interactive software designed for individual learning, but you will also have access to full support from our subject-matter experts for the duration of your course. When you book a QA online learning course you will receive immediate access to it through our e-learning platform and you can start to learn straight away, from any compatible device. Access to the online learning platform is valid for one year from the booking date.

All courses are built around case studies and presented in an engaging format, which includes storytelling elements, video, audio and humour. Every case study is supported by sample documents and a collection of Knowledge Nuggets that provide more in-depth detail on the wider processes.

Learn more about QA’s online courses.

When will I receive my joining instructions?

Joining instructions for QA courses are sent two weeks prior to the course start date, or immediately if the booking is confirmed within this timeframe. For course bookings made via QA but delivered by a third-party supplier, joining instructions are sent to attendees prior to the training course, but timescales vary depending on each supplier’s terms. Read more FAQs.

When will I receive my certificate?

Certificates of Achievement are issued at the end the course, either as a hard copy or via email. Read more here.

Contact Us

Please contact us for more information