Selected intrusion IP address (source and destination) elements includes but Client and server port identity not limited to: Process (file or registry) Hashes URI or URL Common source NetFlow technologies includes IDS/IPS but not limited to: Firewall Network application control Antivirus Incident response plan Mapping elements of analysis: includes but not limited Preparation to: Detection and analysis Containment, eradication and recovery Post-incident analysis Mapping organisational stakeholders: Preparation Detection and analysis Containment, eradication and recovery Post-incident analysis Network profiling Total traffic throughput includes but not limited Session duration to: Ports used Address space utilized Server profiling Listening ports includes but not limited Logged in users to: Running processes Running tasks Applications Steps and methods The process of data normalization used to gather data 5-turple correlation structure and methods includes but not limited Retrospective analysis to: Identifying compromised networked hosts Alternative tools and Deterministic methods of data analysis techniques used for Probabilistic methods of data analysis includes data analysis Heuristic methods of data analysis but not limited to: Diamond model of Reconnaissance classify intrusion Weponization events includes but not Delivery limited to: Exploitation Installation Command and control Action on objectives
Selected intrusion elements includes but not limited to: IP address (source and destination) Client and server port identity Process (file or registry) Hashes URI or URL Common source technologies includes but not limited to: NetFlow IDS/IPS Firewall Network application control Antivirus Incident response plan includes but not limited to: Mapping elements of analysis: Preparation Detection and analysis Containment, eradication and recovery Post-incident analysis Mapping organisational stakeholders: Preparation Detection and analysis Containment, eradication and recovery Post-incident analysis Network profiling includes but not limited to: Total traffic throughput Session duration Ports used Address space utilized Server profiling includes but not limited to: Listening ports Logged in users Running processes Running tasks Applications Steps and methods used to gather data includes but not limited to: The process of data normalization 5-turple correlation structure and methods Retrospective analysis Identifying compromised networked hosts Alternative tools and techniques used for data analysis includes but not limited to: Deterministic methods of data analysis Probabilistic methods of data analysis Heuristic methods of data analysis Diamond model of classify intrusion events includes but not limited to: Reconnaissance Weponization Delivery Exploitation Installation Command and control Action on objectives
currCyber%20Security%20Advanced%20Diploma22445VIC.docx