Course Outline
Module 1: Understanding the Cybersecurity Landscape for Government
In this module, you will gain an understanding of the current cybersecurity landscape and learn how adopting the "assume compromise" philosophy can help restrict an attacker’s ability to move laterally between information systems and escalate privileges within those systems. The cyber landscape is vast and complex, making it challenging for any single individual to grasp in its entirety. However, there are several key aspects that those interested in the fundamentals of enterprise security should focus on.
Lessons
- Current Cybersecurity Landscape for Government
- Assume Compromise Philosophy
After completing this module, students will be able to:
- Describe the current cybersecurity landscape for government.
- Explain the Assume Compromise Philosophy.
- Identify factors that contribute to the cost of a breach in government environments.
Module 2: Red Team: Penetration, Lateral Movement, Escalation, and Exfiltration
This module covers red team versus blue team exercises, which simulate attacks against an organization’s information systems. The red team simulates and performs proof-of-concept steps in the attack, while the blue team simulates the response. This adversarial approach helps identify security vulnerabilities and allows staff to learn how to detect and respond to attacks effectively. In this module, you will learn about the practice of using red teams and blue teams to enhance security threat detection and response.
Lessons
- Red Team versus Blue Team Exercises
- The Attacker's Objective
- Red Team Kill Chain
After completing this module, students will be able to:
- Distinguish between the responsibilities of red teams and blue teams.
- Identify typical objectives of cyber attackers in government settings.
- Describe a kill chain carried out by red teams in government exercises.
Module 3: Blue Team Detection, Investigation, Response, and Mitigation
In this module, you will learn about the roles and goals of blue teams in attack simulations. You will understand the structure of an attack (Kill Chain) and methods to limit how attackers can compromise unprivileged accounts and restrict lateral movement. Additionally, you will explore how telemetry monitoring is used to detect attacks.
Lessons
- The Blue Team
- Blue Team Kill Chain
- Restricting Privilege Escalation
- Restrict Lateral Movement
- Attack Detection
After completing this module, students will be able to:
- Describe the role and goals of blue teams in red team exercises.
- Explain the structure of an attack against an objective (Kill Chain).
- Identify methods for limiting how attackers can compromise unprivileged accounts.
- Describe techniques used to restrict lateral movement by attackers.
- Explain how telemetry monitoring is utilized to detect attacks in government systems.
Module 4: Organizational Preparations for Government
This module focuses on the ongoing preparations that organizations can take to enhance their approach to information security. You will learn about a conceptual model for thinking about information security, including the CIA Triad (Confidentiality, Integrity, Availability), and how to ensure your organization has a deliberate and structured approach to information security.
Lessons
- CIA Triad
- Organizational Preparations for Government
- Developing and Maintaining Policies
Lab: Designing a Blue Team Strategy for Government
After completing this module, students will be able to:
- Explain the concept of the CIA Triad (Confidentiality, Integrity, Availability).
- Describe primary activities that should be included in organizational preparations for government.
- Identify key principles of developing and maintaining policies for government information security.
After completing this lab, students will be able to:
- Design a high-level approach to mitigating threats for government systems.
- Recommend tools and methodologies for tracking down the origins of cyberattacks in government environments.
- Outline high-level steps for a recovery effort following a cyberattack.
- Propose methods for preventing cyberattacks in government organizations.
- Discuss regulatory challenges that arise from malware exploits in government contexts.
Requirements
In addition to their professional experience, participants in this training should already possess the following technical knowledge:
- An understanding of the current cybersecurity landscape for government
- The ability to analyze cyber incidents on computers and networks
- Fundamentals of risk management
