Specifications include, but are not limited to: A. System and Network Security Training course outline: 1. Building a Secure Organization: a. Real threats that impact cybersecurity i. Hackers inside and out ii. Eavesdropping iii. Spoofing iv. Sniffing v. Trojan Horses vi. Viruses vii. Wiretaps 2. A Cryptography Primer a. Securing data with symmetric encryption i. Choosing the algorithm: DES, AES, Rc4, and others ii. Assessing key length and key distribution b. Ensuring integrity with hashes i. Hashing with Md5 and SHA ii. Protecting data in transit iii. Building the digital signature 3. Verifying User and Host Identity a. Authenticating hosts i. Distrusting IP addresses ii. Address-spoofing issues and countermeasures iii. Solutions for wireless networks 4. Preventing System Intrusions a. Discovering system vulnerabilities i. Searching for operating system vulnerabilities ii. Discovering file permission issues iii. Limiting access via physical security b. Hardening the operating system i. Locking down users accounts ii. Securing administrator’s permissions iii. Protecting against viruses 5. Guarding Against Network Instrusions a. Scanning for vulnerabilities i. Searching for rogue servers ii. Profiling systems and services b. Reducing Denial of Service (DoS) attacks i. Securing DNS ii. Limiting the impact of common attacks c. Deploying firewalls to control network traffic i. Preventing intrusions with filters ii. Implementing cyber security policy iii. Deploying personal firewalls 6. Ensuring Network Confidentiality a. Threats from the LAN i. Sniffing the network ii. Mitigating threats from connected hosts iii. Partitioning the network to prevent data leakage iv. Identifying wireless LAN vulnerabilities b. Confidentiality on external connections i. Ensuring confidentiality with encryption ii. Securing communication with IPSec B. .NET Application Security Training: 1. Understanding HTTP and Web Technologies a. HTTP Protocol (Requests, Responses, Headers, Cookies, Parameters, Response, Codes) i. Security of GET vs. POST ii. SSL and Certificates iii. Man-in-the-Middle Threat iv. HTTP Strict Transport Security b. Introducing a Security Testing Proxy i. WebGoat Architecture Walkthrough
