Classify Threats and Threat Profiles

Perform Ongoing Threat Research

The Importance of Risk Management

Assess Risk

Mitigate Risks

Integrating Documentation into Risk Management

Deployment of Incident Handling and Response Architecture

Containment and Mitigation of Incidents

Preparation for Forensic Investigation as a CSIRT

Implementation of Threat Modeling

Reconnaissance: Assessing the Impact

Social Engineering: Assessing the Impact

System Hacking Attacks: Assessing the Impact

Web-Based Attacks: Assessing the Impact

Malware: Assessing the Impact

Hijacking and Impersonation Attacks: Assessing the Impact

DoS Incidents: Assessing the Impact

Threats to Mobile Security: Assessing the Impact

Threats to Cloud Security: Assessing the Impact

Examine Command and Control Techniques

Examine Persistence Techniques

Examine Lateral Movement and Pivoting Techniques

Examine Data Exfiltration Techniques

Examine Anti-Forensics Techniques

Conduct Penetration Tests on Network Assets

Follow Up on Penetration Testing

Deployment of a Security Intelligence Collection and Analysis Platform

Data Collection from Network-Based Intelligence Sources

Data Collection from Host-Based Intelligence Sources

Common Tools to Analyze Logs

SIEM Tools for Analysis

Use a Forensic Investigation Plan

Securely Collect and Analyze Electronic Evidence

Follow Up on the Results of an Investigation

Appendix A: Mapping Course Content to CyberSec First Responder (Exam CFR-310)

Appendix B: Regular Expressions

Appendix C: Security Resources

Appendix D: U.S. Department of Defense Operational Security Practices