Course Outline
Module 1: Understanding the Cybersecurity Landscape for Government
In this module, you will gain insight into the current cybersecurity landscape and learn how adopting the "Assume Compromise" philosophy can help restrict an attacker’s ability to move laterally between information systems and escalate privileges within those systems. The contemporary cybersecurity environment is extensive and complex, making it challenging for any single individual to fully grasp its entirety. However, there are several key aspects of this landscape that are crucial for those interested in the fundamentals of enterprise security.
Lessons
- Current Cybersecurity Landscape
- Assume Compromise Philosophy
After completing this module, students will be able to:
- Describe the current cybersecurity landscape for government.
- Explain the "Assume Compromise" philosophy.
- Identify factors that contribute to the cost of a breach in governmental systems.
Module 2: Red Team: Penetration, Lateral Movement, Escalation, and Exfiltration for Government
Red team versus blue team exercises involve simulating an attack against an organization’s information systems. The red team mimics and, in some cases, performs proof-of-concept steps to demonstrate potential attacks on the organization's IT infrastructure. The blue team simulates the response to these attacks. This adversarial approach not only helps identify security vulnerabilities but also provides hands-on training for the organization’s information systems staff in detecting and responding to threats. In this module, you will learn about the red team versus blue team methodology used to enhance detection and response capabilities.
Lessons
- Red Team versus Blue Team Exercises
- The Attacker's Objective
- Red Team Kill Chain
After completing this module, students will be able to:
- Distinguish between the responsibilities of red teams and blue teams for government.
- Identify typical objectives of cyber attackers in governmental systems.
- Describe a kill chain carried out by red teams for government.
Module 3: Blue Team Detection, Investigation, Response, and Mitigation for Government
In this module, you will learn about the roles and goals of blue teams in attack exercises. You will understand the structure of an attack against a target (Kill Chain) and methods to limit how attackers can compromise unprivileged accounts. Additionally, you will explore techniques to restrict lateral movement, preventing attackers from using a compromised system to attack other systems, as well as the use of telemetry monitoring to detect attacks.
Lessons
- The Blue Team
- Blue Team Kill Chain
- Restricting Privilege Escalation
- Restricting Lateral Movement
- Attack Detection
After completing this module, students will be able to:
- Describe the role and goals of blue teams in red team exercises for government.
- Explain the structure of an attack against a target (Kill Chain) for government.
- Describe methods to limit how attackers can compromise unprivileged accounts for government.
- Explain techniques used to restrict lateral movement for government.
- Describe how telemetry monitoring is used to detect attacks in governmental systems.
Module 4: Organizational Preparations for Government
This module explores several ongoing preparations that organizations can undertake to enhance their overall approach to information security. You will learn about a conceptual model for understanding the security of information and how to develop a deliberate approach to information security, including the CIA Triad (Confidentiality, Integrity, Availability) and the importance of developing and maintaining policies.
Lessons
- CIA Triad
- Organizational Preparations
- Developing and Maintaining Policies
Lab: Designing a Blue Team Strategy for Government
After completing this module, students will be able to:
- Explain the concept of the CIA Triad (Confidentiality, Integrity, Availability) for government.
- Describe primary activities that should be included in organizational preparations for government.
- Identify main principles of developing and maintaining policies for government.
After completing this lab, students will be able to:
- Design a high-level approach to mitigating threats for government.
- Recommend tools and methodologies for tracking the origins of cyberattacks for government.
- Provide high-level steps for a recovery effort in governmental systems.
- Recommend methods for preventing cyberattacks for government.
- Describe regulatory challenges that result from malware exploits for government.
Requirements
- An understanding of the current cybersecurity landscape
- The ability to analyze breaches on computers and networks
- Fundamentals of risk management
