40452 Courses delivered Online

Duration 1 Days 6 CPD hours This course is intended for Security operations personnel, including analysts and incident responders Overview By the end of the course, you should be able to meet the following objectives: Utilize Carbon Black EDR throughout an incident Implement a baseline configuration for Carbon Black EDR Determine if an alert is a true or false positive Fully scope out an attack from moment of compromise Describe Carbon Black EDR capabilities available to respond to an incident Create addition detection controls to increase security This course teaches you how to use the VMware Carbon Black© EDR? product during incident response. Using the SANS PICERL framework, you will configure the server and perform an investigation on a possible incident. This course provides guidance on using Carbon Black EDR capabilities throughout an incident with an in-depth, hands-on, scenariobased lab. Course Introduction Introductions and course logistics Course objectives VMware Carbon Black EDR & Incident Response Framework identification and process Preparation Implement the Carbon Black EDR instance according to organizational requirements Identification Use initial detection mechanisms Process alerts Proactive threat hunting Incident determination Containment Incident scoping Artifact collection Investigation Eradication Hash banning Removing artifacts Continuous monitoring Recovery Rebuilding endpoints Getting to a more secure state Lessons Learned Tuning Carbon Black EDR Incident close out

Duration 4 Days 24 CPD hours This course is intended for The primary audience for this course is as follows: Security administrators Security consultants Network administrators System engineers Technical support personnel Channel partners and resellers Overview Upon completing this course, the learner will be able to meet these overall objectives: Define the use and placement IDS/IPS components. Identify Snort features and requirements. Compile and install Snort. Define and use different modes of Snort. Install and utilize Snort supporting software. Securing Cisco Networks with Open Source Snort (SSFSNORT) v3.0 is a 4-day course that shows you how to deploy Snort© in small to enterprise-scale implementations. You will learn how to install, configure, and operate Snort in Intrusion Detection System (IDS) and Intrusion Prevention System (IPS) modes. You?ll practice installing and configuring Snort, utilize additional software tools and define rules to configure and improve the Snort environment, and more. The course qualifies for 32 Cisco Continuing Education credits (CE) towards recertification.This course will help you:Learning how to implement Snort, an open-source, rule-based, intrusion detection and prevention system. Gain leading-edge skills for high-demand responsibilities focused on security. Module 1: Detecting Intrusions with Snort 3.0 History of Snort IDS IPS IDS vs. IPS Examining Attack Vectors Application vs. Service Recognition Module 2: Sniffing the Network Protocol Analyzers Configuring Global Preferences Capture and Display Filters Capturing Packets Decrypting Secure Sockets Layer (SSL) Encrypted Packets Module 3: Architecting Nextgen Detection Snort 3.0 Design Modular Design Support Plug Holes with Plugins Process Packets Detect Interesting Traffic with Rules Output Data Module 4: Choosing a Snort Platform Provisioning and Placing Snort Installing Snort on Linux Module 5: Operating Snort 3.0 Start Snort Monitor the System for Intrusion Attempts Define Traffic to Monitor Log Intrusion Attempts Actions to Take When Snort Detects an Intrusion Attempt License Snort and Subscriptions Module 6: Examining Snort 3.0 Configuration Introducing Key Features Configure Sensors Lua Configuration Wizard Module 7: Managing Snort Pulled Pork Barnyard2 Elasticsearch, Logstash, and Kibana (ELK) Module 8: Analyzing Rule Syntax and Usage Anatomy of Snort Rules Understand Rule Headers Apply Rule Options Shared Object Rules Optimize Rules Analyze Statistics Module 9: Use Distributed Snort 3.0 Design a Distributed Snort System Sensor Placement Sensor Hardware Requirements Necessary Software Snort Configuration Monitor with Snort Module 10: Examining Lua Introduction to Lua Get Started with Lua

Duration 2 Days 12 CPD hours This course is intended for The ProxySG 6.6 Basic Administration course is intended for students who wish to master the fundamentals of the ProxySG. It is designed for students who have not taken any previous training courses about the ProxySG. Overview Describe the major Secure Web Gateway functions of the ProxySG.License and configure a ProxySG.Deploy a ProxySG in either explicit or transparent mode.Use the Visual Policy Manager to write policies to manage web filtering, authentication, and SSL traffic management.Use ProxySG access logs to generate reports. The ProxySG 6.6 Basic Administration course is an introduction to deployment options and management of the individual key features offered using the ProxySG 6.6 solution. Introduction to the Symantec ProxySG Secure Web Gateway Describe the functions of a proxy server Differentiate proxy servers from firewalls Describe the key features and benefits of the ProxySG List the various ProxySG models Access online Symantec community resources ProxySG Security Deployment Options Describe the three network deployment methods Describe the three possible roles of the ProxySG ProxySG Management Console Describe the relationship between the Management Console and the ProxySG CLI Describe the primary function of the major areas of the Management Console Use the Management Console to access on-box help and Symantec product documentation Traffic Interception Using Proxy Services Understand the functions of proxy services, listeners, and proxy types Describe the three most common proxy services Explain how the intercept and bypass settings affect what happens to network traffic passing through the ProxySG Explain the function of common global proxy service settings Hypertext Transfer Protocol Understand how a connection is initiated over the transport layer Identify the components of an HTTP URL Explain the two types of HTTP messages: request and response Identify common response codes Introduction to the Visual Policy Manager Describe the relationship among the VPM, CPL, and the Management Console Describe the default processing order for policy layers and rules Describe triggers and actions that can be used in writing policy Identify the types of objects that the VPM supports Describe some of the best practices to be followed when using the VPM to create policy Filtering Web Content Describe the main concepts of web filtering Describe the primary category databases Describe the category types available to policy Describe how WebFilter and WebPulse work together Using Threat Intelligence to Defend the Network Understand Intelligence Services as provided by the Global Intelligence Network Understand Geolocation and Threat Risk Levels and how they can be used in policy Ensuring Safe Downloads Describe how malware can be transmitted via HTTP Explain the methods, advantages, and disadvantages of file type detection Describe some of the considerations in deciding what content to block as possible malware sources Notifying User of Internet Usage Policies Explain the function and various components of built-in and custom exception pages Describe the function of Notify User objects Identify the types of pages that can be sent to users by using Notify User objects Describe splash pages and coaching pages using Notify User objects in the VPM Access Logging on the ProxySG Describe, at a high level, how the ProxySG performs access logging Describe the components of a ProxySG access log facility Identify default log facilities and log formats Describe common use cases for periodic and continuous uploading of access logs

Duration 2 Days 12 CPD hours This course is intended for Executives, Project Managers, Business Analysts, Business and IT stakeholders working with analysts, Quality and process engineers, technicians, corrective action coordinators or managers; supervisors, team leaders, and process operators; anyone who wants to improve their ability to solve recurring problems. Overview At the completion of this course, you should be able to:Identify the different types of tools and techniques availableApply change management successfullyReview what to look for when applying business case thinking to Root Cause AnalysisDevelop a process to systematically approach problems Problem determination skills cannot be acquired by reading a book. They mostly come from experience. After this course, you will have a general understanding of a structured problem determination approach, which you can then apply in your daily work. RCA Foundation Concepts and Objectives Section Learning Objectives Discuss Definitions ? IT Perspective Discuss What is a problem and why do they exist? Exercise 1a: Why is RCA important What is Root Cause? RCA Benefits and Approaches Exercise 1b: Why are multiple approaches important? Event and Casual Analysis Exercise 1c: Apply Event and Causal Analysis Event and Causal Analysis: Exercise 1c Worksheet RCA Tools for each approach Exercise 1D: Prepare for Case Study Section Summary and Conclusions Enhance Use of RCA Tools Why use a Particular Method Tool: Change Analysis Change Analysis Examples Exercise 2a: Apply Change Analysis Exercise 2b: Change Analysis Worksheet Tool: How to Resolve Conflict Tool: 5 Why?s Example Learning Management Problem Exercise 2b: Apply 5 Why?s Sequence-of-Events Exercise 2b: Worksheet Tool: Cause and Effect Exercise 2c: Apply Cause and Effect Exercise 2c: Cause and Effect Worksheet Tool: Fault Tree Analysis Why do we use Fault Tree Analysis? How does it work? Fault Tree Diagram Symbols Example #1 of FTA: Car Hits Object Exercise 2D: Apply Fault Tree Analysis Tool: Failure Modes and Effects Analysis (FMEA) Example: Failure Modes and Effects Analysis Exercise 2E: Apply FMEA Tool: Design / Application Review Exercise 2d: Apply Design/Application Review Section summary & conclusions Problem Resolution & Prevention Section Objectives The Secret of Solving Problems A Note about Statistical Control A Note about Fire Fighting Technique: Business Process Mapping Example: IGOE Exercise 3A: Problem as IGOE Exercise 3A: IGOE Template Technique: Lean Six Sigma and DMAIC Lean Six Sigma Benefits Exercise 3B: Apply Lean Six Sigma Importance of Understanding the Business Process The Business Process Mandate Technique: Process Modeling Graphical Notation Standard (BPMN) What is Business Process Modeling Notation (BPMN)? Benefits of BPMN Basic Components of BPMN Exercise 3C: Use BPMN to Document a Current State Technique: Business Process Maturity Model Five Levels of Maturity Exercise 3D: Appraise Business Process Maturity Level Section Summary and Conclusions Capability Improvement for RCA Section Learning Objectives Steps in Disciplined Problem Solving RCA as a RCA Process Key RCA Role Considerations Exercise 4A: Apply RCA to RCA Process Sustainable RCA Improvement Organizational Units Process Area Goals, Practices Specific and General Practices Specific Practice Examples Software Maturity Survey Exercise 4B: Apply Strengths, Weakness, Opportunities and Threats (SWOT) to RCA SWOT Analysis Worksheet Recognize the importance of the Change Management component in your RCA implementation Using the ADKAR Model to Communicate Change Review ADKAR© Model ? Awareness of the need for change Desire to participate and support the change Knowledge on how to change Ability to implement required skills and behaviors Reinforcement to sustain the change Exercise 4C: Create an Ability Checklist The ADKAR Model: Reinforcement Exercise 4D: Find two examples of how ADKAR will be different Section Summary and Conclusions Course Summary & Conclusions Plan the Proposal and Business Case Example: 1 Page Business Case Exercise 5A: Creating Action Plans Resource Guide Questions Additional course details: Nexus Humans BA17 - Advanced Root Cause Analysis training program is a workshop that presents an invigorating mix of sessions, lessons, and masterclasses meticulously crafted to propel your learning expedition forward. This immersive bootcamp-style experience boasts interactive lectures, hands-on labs, and collaborative hackathons, all strategically designed to fortify fundamental concepts. Guided by seasoned coaches, each session offers priceless insights and practical skills crucial for honing your expertise. Whether you're stepping into the realm of professional skills or a seasoned professional, this comprehensive course ensures you're equipped with the knowledge and prowess necessary for success. While we feel this is the best course for the BA17 - Advanced Root Cause Analysis course and one of our Top 10 we encourage you to read the course outline to make sure it is the right content for you. Additionally, private sessions, closed classes or dedicated events are available both live online and at our training centres in Dublin and London, as well as at your offices anywhere in the UK, Ireland or across EMEA.

Duration 3 Days 18 CPD hours This course is intended for This course is for technical professionals to gain skills in writing rules for Snort-based intrusion detection systems (IDS) and intrusion prevention systems (IPS). The primary audience includes: Security administrators Security consultants Network administrators System engineers Technical support personnel using open source IDS and IPS Channel partners and resellers Overview After taking this course, you should be able to: Describe the Snort rule development process Describe the Snort basic rule syntax and usage Describe how traffic is processed by Snort Describe several advanced rule options used by Snort Describe OpenAppID features and functionality Describe how to monitor the performance of Snort and how to tune rules The Securing Cisco Networks with Snort Rule Writing Best Practices (SSFRules) v2.0 course shows you how to write rules for Snort, an open-source intrusion detection and prevention system. Through a combination of expert-instruction and hands-on practice, this course provides you with the knowledge and skills to develop and test custom rules, standard and advanced rules-writing techniques, how to integrate OpenAppID into rules, rules filtering, rules tuning, and more. The hands-on labs give you practice in creating and testing Snort rules. Course Outline Introduction to Snort Rule Development Snort Rule Syntax and Usage Traffic Flow Through Snort Rules Advanced Rule Options OpenAppID Detection Tuning Snort Lab outline Connecting to the Lab Environment Introducing Snort Rule Development Basic Rule Syntax and Usage Advanced Rule Options OpenAppID Tuning Snort

Duration 4 Days 24 CPD hours This course is intended for Information Assurance Managers/Auditors System Implementors/administrators IT Administrators Auditors/Auditees Federal Agencies/Contractors Security Vendors and Consulting Groups Overview Upon completion, the IS20 Security Controls candidate will be able to not only competently take the IS20 Controls exam but will also have an understanding of how to implement the top 20 most critical controls in the work place. IS20 controls are the Top Twenty Most Critical Security Controls in Information Technology.ÿ This 4 day training course covers proven tools and methodologies needed to execute and analyze the Top Twenty Most Critical Security Controls. Nearly all organizations that maintain sensitive information are adopting these Security Controls. These controls were chosen by leading government and private organizations who are experts on how attacks work and what can be done to prevent them from happening. The controls were selected as the best way to block known attacks as well as help search for and alleviate any damage from the attacks that are successful. This course allows the security professional to see how to implement controls in an existing network through highly effective and economical automation. For management, this training is the best way to distinguish how you will assess whether these security controls are effectively being administered. Introduction Critical Control 1 Critical Control 2 Critical Control 3 Critical Control 4 Critical Control 5 Critical Control 6 Critical Control 7 Critical Control 8 Critical Control 9 Critical Control 10 Critical Control 11 Critical Control 12 Critical Control 13 Critical Control 14 Critical Control 15 Critical Control 16 Critical Control 17 Critical Control 18 Critical Control 19 Critical Control 20

Duration 4 Days 24 CPD hours This course is intended for This course is for technical professionals who need to know how to deploy open source intrusion detection systems (IDS) and intrusion prevention systems (IPS), and how to write Snort rules. Security administrators Security consultants Network administrators System engineers Technical support personnel Channel partners and resellers Overview After taking this course, you should be able to: Describe Snort technology and identify resources available for maintaining a Snort deployment Install Snort on a Linux-based operating system Describe the Snort operation modes and their command-line options Describe the Snort intrusion detection output options Download and deploy a new rule set to Snort Describe and configure the snort.conf file Configure Snort for inline operation and configure the inline-only features Describe the Snort basic rule syntax and usage Describe how traffic is processed by the Snort engine Describe several advanced rule options used by Snort Describe OpenAppID features and functionality Describe how to monitor Snort performance and how to tune rules The Securing Cisco Networks with Open Source Snort (SSFSNORT) v2.1 course shows you how to deploy a network intrusion detection system based on Snort. You?ll learn how to install, configure, operate, and manage a Snort system, rules writing with an overview of basic options, advanced rules writing, how to configure Pulled Pork, and how to use OpenAppID to provide protection of your network from malware. You will learn techniques of tuning and performance monitoring, traffic flow through Snort rules, and more Course outline Introduction to Snort Technology Snort Installation Snort Operation Snort Intrusion Detection Output Rule Management Snort Configuration Inline Operation and Configuration Snort Rule Syntax and Usage Traffic Flow Through Snort Rules Advanced Rule Options OpenAppID Detection Tuning Snort Additional course details: Nexus Humans Cisco Securing Cisco Networks with Open Source Snort v2.1 (SSFSNORT) training program is a workshop that presents an invigorating mix of sessions, lessons, and masterclasses meticulously crafted to propel your learning expedition forward. This immersive bootcamp-style experience boasts interactive lectures, hands-on labs, and collaborative hackathons, all strategically designed to fortify fundamental concepts. Guided by seasoned coaches, each session offers priceless insights and practical skills crucial for honing your expertise. Whether you're stepping into the realm of professional skills or a seasoned professional, this comprehensive course ensures you're equipped with the knowledge and prowess necessary for success. While we feel this is the best course for the Cisco Securing Cisco Networks with Open Source Snort v2.1 (SSFSNORT) course and one of our Top 10 we encourage you to read the course outline to make sure it is the right content for you. Additionally, private sessions, closed classes or dedicated events are available both live online and at our training centres in Dublin and London, as well as at your offices anywhere in the UK, Ireland or across EMEA.

Duration 2 Days 12 CPD hours This course is intended for This in an introductory-level course geared for QA, Test team members and others who want to use the Python testing framework PyTest to implement code testing strategies. Attendees should have prior basic Python scripting experience. Students should have some familiarity with tools to be used in this course: PyCharm, Jupyter Notebook and basic GIT. Overview Working within in a hands-on learning environment students will learn to: Become proficient with pytest from day one by solving real-world testing problems Use pytest to write tests more efficiently Scale from simple to complex and functional testing Write and run simple and complex tests Organize tests in fles and directories Find out how to be more productive on the command line Markers and how to skip, xfail and parametrize tests Explore fxtures and techniques to use them effectively, such as tmpdir, pytestconfg, and monkeypatch Convert unittest suites to pytest using little-known techniques The pytest framework is simple to use but powerful enough to cover complex testing integration scenarios. PyTest is considered by many to be the true Pythonic approach to testing in Python. Geared for QA, Test team members and others who want to use the Python testing framework PyTest to implement code testing strategies, Test Automation with Python is a hands-on, two day Python testing course that provides students with the skills required to get started with PyTest right away. Participnats will learn how to get the most out of it in their daily workflow, exploring powerful mechanisms and plugins to facilitate many common testing tasks. Students will also learn how to use pytest in existing unittestbased test suites and will learn some tricks to make the jump to a pytest-style test suite quickly and easily. Python Refresher Python Overview Python Basics Python Lab Introducing PyTest Why Spend time writing test UnitTest Module Why PyTest? Introductory Lab Writing and Running Test Installing PyTest Writing and Running Tests Organizing files and packages Command Line options Configure pytest.ini Install and Config Lab Markers and Parameters Mark Basics Built-in marks Parameterization Markers and Parameters Lab Fixtures Introduction to Fixtures Sharing fixtures with conftest.py files Scopes Autouse Parameterizing fixtures Using marks from fixtures Built-in fixtures Best Practices Fixtures Lab Fixtures Lab 2 Plugins Finding and installing plugins Overview of plugins Plugin Lab From UnitTest to PyTest Use PyTest as a Test Runner Convert asserts with unitest2pytest Handling setup/teardown Managing test hierarchies Refactoring test utilities Migration strategies Additional course details: Nexus Humans Test Automation with Python (TTPS4832) training program is a workshop that presents an invigorating mix of sessions, lessons, and masterclasses meticulously crafted to propel your learning expedition forward. This immersive bootcamp-style experience boasts interactive lectures, hands-on labs, and collaborative hackathons, all strategically designed to fortify fundamental concepts. Guided by seasoned coaches, each session offers priceless insights and practical skills crucial for honing your expertise. Whether you're stepping into the realm of professional skills or a seasoned professional, this comprehensive course ensures you're equipped with the knowledge and prowess necessary for success. While we feel this is the best course for the Test Automation with Python (TTPS4832) course and one of our Top 10 we encourage you to read the course outline to make sure it is the right content for you. Additionally, private sessions, closed classes or dedicated events are available both live online and at our training centres in Dublin and London, as well as at your offices anywhere in the UK, Ireland or across EMEA.

Duration 2 Days 12 CPD hours This course is intended for Network Video Engineer Voice/UC/Collaboration/Communications Engineer Collaboration Tools Engineer Collaboration Sales/Systems Engineer Overview Install, Configure, and Implement Cisco Emergency Responder (Cisco ER). Configure CUCM for CER Configure Emergency Response Locations (ERLs) Configure Emergency Location Identification Numbers (ELINs) Configure PSAP calls and PSAP CallBack Configure Users and onsite Security Management This is a 2-day hands-on course, where students will Install, Deploy, and Configure Cisco Emergency Responder (Cisco ER) 12.5. Student will also integrate emergency communication system with Cisco Unified Communications Manager. Students will learn how Cisco ER automatically notifies and routes calls to the local public safety answering point (PSAP) operator. Students will configure emergency response locations (ERLs) and emergency location identification numbers (ELINs) in CER to properly route enhanced 911 (E911) calls. You will also examine CER disaster recovery and user management. Cisco Emergency Responder Overview PSAP/ Emergency Calling Overview National Emergency Number Association Legislation and Regulation Service Provider ALI Automatic Number Identification (ANI) Automatic Location Identification (ALI) NENA Emergency Response Location NENA Guidelines for ERLs NENA Emergency Location Identification Number (ELIN) E911 Preparation Cisco Emergency Call Handler Cisco Emergency Responder 11.x Enhancements License Management Emergency Responder Redundancy Clustering CER over the WAN Integration with UC Manager Intrado Architecture CER Wireless Features Overview Installing Cisco Emergency Responder Supported Hardware Platforms CER Virtual Server Requirements Deploy Cisco CER OVF/OVA Installation of CER CER CLI Interface Reset Application Administrator Password Add 2nd CER Server - Subscriber Upgrade VMware Tools on Cisco Emergency Responder Server CER Backup and Restore CER PLM Licensing Unified Communication Manager CER Configuration Cisco Unified Communications Manager Administrator Interfaces Cisco Unified Communications Manager Required Services for CER CUCM SNMP Settings Phone Partition and Calling Search Spaces Partitions for 911 Services CER CUCM Configuration for CTI Route Points and CTI Ports Configure CER Route Patterns for 911 and Security Personal Create Translation Patterns for ELINs Create Emergency Responder Cisco Unified Communications Manager User Location Awareness Overview Configure Wireless Endpoint Tracking Feature on UCM 11.5 Cisco Emergency Responder (CER) Configuration Emergency Responder Interface E.164 Dial Plan Support Cisco Emergency Responder Groups Setup CER Groups CER Telephony Settings for CER Cisco CER License Manager Cisco CER Email Settings Cisco CER - Add Subscriber Onsite Security Alerts for Security Personnel Pager Alert Configuration Configure Emergency Response Location (ERL) Configure Emergency Location Identification Number (ELIN) ERL Migration Tool Configure SNMP Configure Phone Tracking Configure LAN Switch Tracking Configuring IP Subnet-based ERLs Configuring Manual Phone Tracking Emergency Responder User Management Manage Onsite Alerts, ERLs, and ALI Data User and Security Logins CER - Web Alerts CER - ERL Audit Trail Export PS-ALI Records ERL Debug Tool

Duration 2 Days 12 CPD hours This course is intended for The intended audience for this comprehensive course on Information Assurance and STIGs includes professionals with roles such as: IT professionals - System administrators, network engineers, and security analysts who are responsible for maintaining and securing IT infrastructure and web applications. Developers - Software engineers and web developers who design, implement, and maintain web applications, and need to integrate security best practices throughout the development process. Project teams - Cross-functional teams that collaborate on application development projects, including members from development, testing, and deployment teams. Technical leads - Senior software engineers or architects who oversee technical aspects of projects and ensure the implementation of secure design and coding practices. Project managers - Professionals responsible for planning, executing, and closing projects, ensuring that security requirements are met throughout the project lifecycle. Overview Working in an interactive learning environment, guided by our application security expert, you'll explore: The concepts and terminology behind defensive coding Threat Modeling as a tool in identifying software vulnerabilities based on realistic threats against meaningful assets The entire spectrum of threats and attacks that take place against software applications in today's world The role that static code reviews and dynamic application testing to uncover vulnerabilities in applications The vulnerabilities of programming languages as well as how to harden installations The basics of Cryptography and Encryption and where they fit in the overall security picture The requirements and best practices for program management as specified in the STIGS The processes and measures associated with the Secure Software Development (SSD) The basics of security testing and planning Understand the concepts and terminology behind defensive coding Understand Threat Modeling as a tool in identifying software vulnerabilities based on realistic threats against meaningful assets Learn the entire spectrum of threats and attacks that take place against software applications in today's world Discuss the role that static code reviews and dynamic application testing to uncover vulnerabilities in applications Understand the vulnerabilities of programming language as well as how to harden installations Understand the basics of Cryptography and Encryption and where they fit in the overall security picture Understand the fundamentals of XML Digital Signature and XML Encryption as well as how they are used within the web services arena Understand the requirements and best practices for program management as specified in the STIGS Understand the processes and measures associated with the Secure Software Development (SSD) Understand the basics of security testing and planning The Information Assurance (STIG) Overview is a comprehensive two-day course that delves into the realm of Information Assurance, empowering you to enhance your cybersecurity skills, understand the essentials of STIGs, and discover cutting-edge web application security practices. This immersive experience is tailored for IT professionals, developers, project teams, technical leads, project managers, testing/QA personnel, and other key stakeholders who seek to expand their knowledge and expertise in the evolving cybersecurity landscape. The course focuses on the intricacies of best practices for design, implementation, and deployment, inspired by the diverse and powerful STIGs, ultimately helping participants become more proficient in application security.The first half of the course covers the foundations of DISA's Security Technical Implementation Guides (STIGs) and learn the ethical approach to bug hunting, while exploring the language of cybersecurity and dissecting real-life case studies. Our expert instrtors will guide you through the importance of respecting privacy, working with bug bounty programs, and avoiding common mistakes in the field.The next half delves into the core principles of information security and application protection, as you learn how to identify and mitigate authentication failures, SQL injections, and cryptographic vulnerabilities. You?ll gain experience with STIG walkthroughs and discover the crucial steps for securing web applications.Throughout the course, you'll also explore the fundamentals of application security and development, including checklists, common practices, and secure development lifecycle (SDL) processes. You?ll learn from recent incidents and acquire actionable strategies to strengthen your project teams and IT organizations. You'll also have the opportunity to explore asset analysis and design review methodologies to ensure your organization is prepared to face future cybersecurity challenges. DISA's Security Technical Implementation Guides (STIGs) The motivations behind STIGs Requirements that the various software development roles must meet Implementing STIG requirements and guidelines Why Hunt Bugs? The Language of CyberSecurity The Changing Cybersecurity Landscape AppSec Dissection of SolarWinds The Human Perimeter Interpreting the 2021 Verizon Data Breach Investigation Report First Axiom in Web Application Security Analysis First Axiom in Addressing ALL Security Concerns Lab: Case Study in Failure Safe and Appropriate Bug Hunting/Hacking Working Ethically Respecting Privacy Bug/Defect Notification Bug Bounty Programs Bug Hunting Mistakes to Avoid Principles of Information Security Secuity Is a Lifecycle Issue Minimize Attack Surface Area Layers of Defense: Tenacious D Compartmentalize Consider All Application States Do NOT Trust the Untrusted Identification and Authentication Failures Applicable STIGs Quality and Protection of Authentication Data Proper hashing of passwords Handling Passwords on Server Side Session Management HttpOnly and Security Headers Lab: STIG Walk-Throughs Injection Applicable STIGs Injection Flaws SQL Injection Attacks Evolve Drill Down on Stored Procedures Other Forms of Server-Side Injection Minimizing Injection Flaws Client-side Injection: XSS Persistent, Reflective, and DOM-Based XSS Best Practices for Untrusted Data Lab: STIG Walk-Throughs Applications: What Next? Common Vulnerabilities and Exposures CWE/SANS Top 25 Most Dangerous SW Errors Strength Training: Project Teams/Developers Strength Training: IT Organizations Cryptographic Failures Applicable STIGs Identifying Protection Needs Evolving Privacy Considerations Options for Protecting Data Transport/Message Level Security Weak Cryptographic Processing Keys and Key Management Threats of Quantum Computing Steal Now, Crack Later Threat Lab: STIG Walk-Throughs Application Security and Development Checklists Checklist Overview, Conventions, and Best Practices Leveraging Common AppSec Practices and Control Actionable Application Security Additional Tools for the Toolbox Strength Training: Project Teams/Developers Strength Training: IT Organizations Lab: Recent Incidents SDL Overview Attack Phases: Offensive Actions and Defensive Controls Secure Software Development Processes Shifting Left Actionable Items Moving Forward Lab: Design Study Review Asset Analysis Asset Analysis Process Types of Application-Related Assets Adding Risk Escalators Discovery and Recon Design Review Asset Inventory and Design Assets, Dataflows, and Trust Boundaries Risk Escalators in Designs Risk Mitigation Options