CyberSec First Responder (CFR): Threat Detection & Response (CFR)

Lesson 1: Assessing Information Security Risk

• Identify the Importance of Risk Management
• Assess Risk
• Mitigate Risk
• Integrate Documentation into Risk Management

Lesson 2: Analyzing the Threat Landscape

• Classify Threats and Threat Profiles
• Perform Ongoing Threat Research

Lesson 3: Analyzing Reconnaissance Threats to Computing and Network Environments

• Implement Threat Modeling
• Assess the Impact of Reconnaissance Incidents
• Assess the Impact of Social Engineering

Lesson 4: Analyzing Attacks on Computing and Network Environments

• Assess the Impact of System Hacking Attacks
• Assess the Impact of Web-Based Attacks
• Assess the Impact of Malware
• Assess the Impact of Hijacking and Impersonation Attacks
• Assess the Impact of DoS Incidents
• Assess the Impact of Threats to Mobile Security
• Assess the Impact of Threats to Cloud Security

Lesson 5: Analyzing Post-Attack Techniques

• Assess Command and Control Techniques
• Assess Persistence Techniques
• Assess Lateral Movement and Pivoting Techniques
• Assess Data Exfiltration Techniques
• Assess Anti-Forensics Techniques

Lesson 6: Evaluating the Organization’s Security Posture

• Conduct Vulnerability Assessments
• Conduct Penetration Tests on Network Assets
• Follow Up on Penetration Testing

Lesson 7: Collecting Cybersecurity Intelligence

• Deploy a Security Intelligence Collection and Analysis Platform
• Collect Data from Network-Based Intelligence Sources
• Collect Data from Host-Based Intelligence Sources

Lesson 8: Analyzing Log Data

• Use Common Tools to Analyze Logs
• Use SIEM Tools for Analysis
• Parse Log Files with Regular Expressions

Lesson 9: Performing Active Asset and Network Analysis

• Analyze Incidents with Windows-Based Tools
• Analyze Incidents with Linux-Based Tools
• Analyze Malware
• Analyze Indicators of Compromise

Lesson 10: Responding to Cybersecurity Incidents

• Deploy an Incident Handling and Response Architecture
• Mitigate Incidents
• Prepare for Forensic Investigation as a CSIRT

Lesson 11: Investigating Cybersecurity Incidents

• Apply a Forensic Investigation Plan
• Securely Collect and Analyze Electronic Evidence
• Follow Up on the Results of an Investigation

• Appendix A: Mapping Course Content to CyberSec First Responder (Exam CFR-210)
• Appendix B: List of Security Resources