Topics

• Fundamentals: Understanding the CIA triad (Confidentiality, Integrity, Availability).
• Access Control: Comparing models such as Discretionary (DAC), Mandatory (MAC), Role-based (RBAC), and Attribute-based (ABAC).
• Risk Management: Differentiating between risk, threats, vulnerabilities, and exploits; understanding risk scoring and weighting.
• Terminology: Mastery of terms like Threat Intelligence (TI), Threat Hunting, Malware Analysis, and DevSecOps. 

• Data Types: Identifying data from technologies like TCP dump, NetFlow, Next-Gen Firewalls (NGFW), and Email/Web content filtering.
• Attack Identification: Describing network attacks (DDoS, MITM), web application attacks (SQL injection, XSS), and social engineering.
• Visibility: Analyzing the impact of NAT/PAT, tunneling, and encryption on network data visibility.
• Cryptography: Understanding the impact of PKI, certificates, and symmetric/asymmetric encryption on security. 

• Endpoint Technology: Functionality of host-based intrusion detection (HIDS), antimalware, and host-based firewalls using rules and AI-based detection.
• Operating Systems: Identifying components of Windows and Linux relevant to security.
• Forensics Foundations: The role of attribution, indicators of compromise (IoC) vs. indicators of attack (IoA), and the chain of custody.

• Event Mapping: Mapping security events to source technologies like IDS/IPS, Firewalls, and Proxy logs.
• Traffic Analysis: Comparing deep packet inspection (DPI) with stateful packet filtering; interpreting PCAP files using Wireshark to extract files or identify intrusion elements.
• Protocol Headers: Interpreting fields in headers for Ethernet, IPv4/IPv6, TCP/UDP, ICMP, DNS, and HTTP/HTTPS. 

• Management Concepts: Understanding asset, configuration, patch, and vulnerability management.
• Incident Response: Applying the NIST SP800-61 framework (Preparation, Detection/Analysis, Containment/Eradication, Post-incident activity).
• Evidence Collection: Principles from NIST SP800-86 regarding data integrity and volatile data collection.
• Frameworks: Classifying events using the Cyber Kill Chain and Diamond Model of Intrusion. 

Trainers

Md Alamgir Khan

CEO-AT Computer Solution Limited 
CCNA, CCNP, CCIE (W), RHCSA, HP-UX, MCSE

Duration

** Duration: 3 Months
** Class Schedule: Friday: 4:30 pm - 7:30 pm & Saturday: 7:00 pm - 9:00 pm (online/offline)
** 27th MArch 2026,Friday **

Benefits