CCNA Cybersecurity Operation Training in Cape Town

CCNA Cybersecurity Operation Training Course Outline

Module 1: Network Concepts

• Networking Protocols and Networking Devices
  • What Are Networking Protocols?
  • Common Network Devices
  • Router vs Switch vs Hub
  • Understanding Firewalls and NAT
  • Protocol Encapsulation
  • Real-World Protocol Use Cases
• Layer 2 Fundamentals and Technologies
  • What Is Layer 2 in Networking?
  • MAC Addresses and ARP
  • Layer 2 Switching Logic
  • VLANs and Segmentation
  • Layer 2 Attacks and Mitigation
• Internet Protocol and Layer 3 Technologies
  • What Is IP Addressing?
  • Subnetting in Brief
  • Routing Concepts
  • Static vs Dynamic Routing
  • Static Routing in Cisco Packet Network
  • IP Packet Structure
  • IPv6 Overview
  • Real-World IP Challenges
• Internet Control Message Protocol (ICMP)
  • ICMP Basics
  • Ping and Traceroute Explained
  • ICMP Vulnerabilities
  • ICMP in Security Monitoring
• Domain Control System (DNS)
  • What Is DNS?
  • DNS Record Types
  • DNS Security Risks
  • DNS Monitoring in SOC
• Transport Layer Technologies and Protocols
  • Role of Transport Layer
  • TCP Handshake Explained
  • Port Numbers and Services
  • Transport Layer Security (TLS)
• Network Security Devices and Cloud Services
  • Network Firewalls
  • IDS/IPS Systems
  • Web Proxies and Gateways
  • Introduction to Cloud Security
  • Cisco Umbrella and SecureX
• Introduced Security Cloud-Based
  • Cloud-Based Network Security
• Network Security System
  • Understanding Network Security Systems
• Cisco NetFlow Overview
  • What Is NetFlow?
• Data Loss Prevention

Module 2: TCP/IP and Cryptography Concepts

• Understanding the TCP/IP Protocol Suite
  • Overview of the TCP/IP Model
  • Application Layer Protocols
  • Transport Layer Protocols: TCP vs UDP
  • Internet Layer and IP Protocols
  • Network Access Layer
  • TCP/IP Packet Encapsulation
  • TCP/IP in Security Monitoring
  • Common Attacks at Each Layer
  • TCP/IP Port Mapping and Filtering
• Understanding the Network Infrastructure
  • What Is Network Infrastructure?
  • Topologies and Design Models
  • 3-Tier Cisco Design
  • Physical vs Logical Segmentation
  • Cabling and Media Types
  • Network Infrastructure Vulnerabilities
  • Role of Infrastructure in Incident Response
• Understanding Basic Cryptography Concepts
  • What Is Cryptography?
  • Symmetric vs Asymmetric Encryption
  • Hashing Algorithms
  • Digital Signatures and Certificates
  • Cryptographic Key Lifecycle
  • VPNs and Tunnelling Protocols
  • Cryptography in Wireless Networks
  • Attacks on Cryptographic Systems

Module 3: Network Applications and Endpoint Security

• Describing Information Security Concepts
  • CIA Triad in Cybersecurity
  • Risk, Threats, and Vulnerabilities
  • Security Controls and Their Types
  • Principle of Least Privilege
• Understanding Network Applications
  • What Are Network Applications?
  • Email Protocols and Security
  • Web-Based Applications (HTTP/S)
  • DNS and Web Browsing
  • Remote Access Applications
• Understanding Common Network Application Attacks
  • Introduction to Application-Layer Attacks
  • Cross-Site Scripting (XSS)
  • SQL Injection (SQLi)
  • DNS Spoofing and Cache Poisoning
  • Application DDoS Attacks
  • Insider Threats in Applications
• Understanding Windows Operating System Basics
  • Windows OS Architecture Overview
  • Windows Registry and Services
  • Task Manager and Resource Monitoring
  • Windows Logs for Security Monitoring
  • Patch Management and Updates
• Understanding Common Endpoint Attacks
  • Introduction to Endpoint Threats
  • Keyloggers and Spyware
  • Ransomware Attacks
  • Credential Dumping
  • Privilege Escalation Techniques
  • Persistence Mechanisms
  • Fileless Malware and LOLBins
  • Endpoint Attack Chain Example
• Understanding Linux Operating System Basics
  • Linux Structure and Distributions
  • Linux File System Hierarchy
  • Key Linux Commands
  • Linux User and Permission System
  • Linux Logs and Auditing
  • Scheduled Jobs and Cron
  • Cron Job Format Task
  • Package Management and Updates
• Understanding Network Security Technologies
  • Antivirus and Anti-Malware Tools
  • Host-Based Intrusion Prevention Systems (HIPS)
  • Endpoint Detection and Response (EDR)
• Understanding Endpoint Security Technologies
  • Application Whitelisting and Sandboxing
  • Host Firewall and Device Control
  • Integrating Endpoint Tools with SOC

Module 4: Security Monitoring and Analysis

• Describing Security Data Collection
  • Importance of Security Data Collection
  • Types of Security Data
  • Role of Log Sources
  • Normal vs Suspicious Log Behaviour
  • SIEM Systems in Data Aggregation
  • Legal and Compliance Considerations
• Packet-Level Data
  • What Is Packet-Level Data?
  • Packet Capture Tools
  • Packet Structure Overview
  • Benefits of Packet Capture
  • Packet Capture Limitations
• Collection method of Packet
  • Network Taps and SPAN Ports
  • Host-Based Packet Capture
  • Inline vs Passive Capture
  • Packet Storage Strategies
  • Filtering Captures with BPF
• Classification of Packet-Level Data
  • Deep Packet Inspection (DPI)
  • Protocol-Based Classification
  • Behavioural Classification
  • Statistical Classification Models
  • Encrypted Traffic Identification
  • Packet Classification for SOC Triage
• Describing Security Event Analysis
  • What Is Security Event Analysis?
  • Correlation Rules and Logic
  • Indicators of Compromise (IoCs)
  • Event Triage and Escalation
  • SOC Analyst Roles in Event Analysis
• Four-Diamond Model Nodes
  • Introduction to the Diamond Model
  • Adversary Node
  • Infrastructure Node
  • Capability Node
  • Victim Node
  • Diamond Model in SOC Practice

Module 5: SOC Overview

• Defining the Security Operations Centre
  • What Is a Security Operations Center (SOC)?
  • Objectives of a SOC
  • SOC Types and Deployment Models
  • SOC vs NOC (Network Operations Center)
• Understanding NSM Tools and Data
  • What Is Network Security Monitoring (NSM) ?
  • Key NSM Tools Overview
  • Suricata in IDS/IPS Mode
  • Zeek for Protocol and Behavioural Analysis
  • NetFlow and Metadata Use
  • Security Onion as NSM Stack
  • Full Packet Capture (FPC) Tools
  • Normalisation and Parsing in NSM
  • Correlation Across NSM Sources
• Understanding Incident Analysis in a Threat-Centric SOC
  • Threat-Centric vs Compliance-Centric SOCs
  • Incident Lifecycle: From Detection to Resolution
  • Use of Playbooks in Incident Analysis
  • Use of Playbooks in Incident Analysis - Step-by-Step Workflow
  • Threat Intelligence in Investigation
  • Identifying Lateral Movement
  • SOC Metrics for Incident Analysis
• Identifying Resources for Hunting Cyber Threats
  • What Is Threat Hunting?
  • Key Threat Hunting Techniques
  • Tools for Threat Hunting
  • Using MITRE ATT&CK in Hunting
  • Developing Hunting Hypotheses

Module 6: Security Incident Investigations

• Understanding Event Correlation and Normalisation
  • What Is Event Correlation?
  • Use Cases for Event Correlation
  • Event Normalisation in SIEMs
  • Tools Supporting Correlation
  • Challenges in Event Correlation
  • Correlation in Action: Credential Misuse
• Identifying Common Attack Vectors
  • What Are Attack Vectors?
  • Phishing and Social Engineering
  • Drive-By Downloads and Malicious Ads
  • Credential Stuffing and Brute Force
  • Supply Chain Attacks
  • Lateral Movement and Privilege Escalation
• Detecting Malicious Activity 
  • IOC vs IOA
  • Signature-Based Detection
  • Behavioural and Anomaly-Based Detection
  • Malware Sandboxing
  • DNS Monitoring and Beaconing
  • Use of Deception Technologies
• Analysing Malware Network Behaviour
  • Common Malware Communications
  • Identifying Data Exfiltration
  • Malware Tactics, Techniques and Procedures (TTPs)
  • Encryption and Obfuscation

Module 7: SOC Operations

• Describing the SOC Playbook
  • What Is a SOC Playbook?
  • Components of a Good Playbook
  • Common Playbook Examples
  • Manual vs Automated Playbooks
• Understanding the SOC Metrics
  • Why SOC Metrics Matter
  • Mean Time to Detect (MTTD)
  • Mean Time to Respond (MTTR)
  • Alert Fatigue and Analyst Load
  • False Positives and True Positives
  • What Is an Incident Response Plan (IRP)?
• Describing the Incident Response Plan
  • Post-Incident Activity – Learning and Strengthening
• Describing the Computer Security Incident Response Team
  • What Is a CSIRT?
  • Types of CSIRT
  • CSIRT Roles and Responsibilities
  • Building a CSIRT Capability
  • CSIRT vs SOC
• VERIS Framework
  • Introduction to the VERIS Framework
  • VERIS Components
  • Using VERIS in Reporting
  • Benefits of VERIS in SOC Operations

Who Should Attend this CCNA Cybersecurity Operation Training?

The CCNA Cybersecurity Operation Training Course is essential for individuals seeking to enhance their expertise in identifying and responding to security incidents using Cisco technologies. Here are the professionals who can benefit from attending this Cisco Training:

• Security Analysts
• Aspiring Cybersecurity Analysts
• IT Support Specialists
• System Engineers
• IT Security Managers
• Security Operations Centre Personnel
• Network Engineers

Prerequisites of the CCNA Cybersecurity Operation Training

There are no formal prerequisites for this CCNA Cybersecurity Operation Training Course. However, familiarity with basic networking concepts and general IT principles can be beneficial for the delegates.

CCNA Cybersecurity Operation Training Overview

The CCNA Cybersecurity Operations Course is part of Cisco Networking Courses, designed to build essential cybersecurity knowledge and skills for monitoring, detecting, and responding to threats.

This Cisco Training equips learners with technical and practical skills to tackle real-world cybersecurity challenges. Key topics include network concepts, host analysis, security monitoring, and attack methods.

The Knowledge Academy’s 3-Day CCNA Cybersecurity Operations Training offers practical experience through simulations and real-world scenarios, helping delegates identify and respond to security incidents effectively.

CCNA Cybersecurity Operation Training Course Objectives

• To understand the fundamentals of cybersecurity and its importance in protecting networks
• To learn the tools and techniques for monitoring and responding to cybersecurity threats
• To develop skills in network security management and incident response
• To prepare for the Cisco Certified CyberOps Associate Certification exam
• To gain practical experience through simulations and real-world scenarios

This Cisco Course is designed to offer a comprehensive introduction to the field of cybersecurity, focusing on the essential skills and knowledge needed to protect networks and information.

What’s Included in this CCNA Cybersecurity Operation Training?

• World-Class Training Sessions from Experienced Instructors
• CCNA Cybersecurity Operation Certificate
• Digital Delegate Pack