Abnormal Stimulus Response

The candidate will show a fundamental understanding of abnormal looking network traffic that results from specific hacking techniques.

Advanced Analysis with Tcpdump

The candidate will demonstrate an understanding of how to determine specific attacks by analyzing network traffic with tcpdump.

Advanced Snort Concepts

The candidate will demonstrate a fundamental understanding of advanced Snort concepts such as rule ordering, false negatives and positives.

Analyst Toolkit

The candidate will demonstrate an understanding of the different tools that are available when analyzing intrusions.

Checksums

The candidate will demonstrate a fundamental understanding of what checksums are and how they can be used to validate packets.

Correlating Traffic

The candidate will show an understanding of the issues and solutions of data correlation.

Dissecting Datagrams

The candidate will demonstrate a thorough understanding of how to dissect a datagram using tcpdump.

Domain Name System (DNS)

The candidate will show a thorough understanding of how DNS works for both legitimate and malicious purposes.

Examining ICMP Fields

The candidate will show a thorough understanding of normal and abnormal ICMP fields.

Examining IP Header Fields

The candidate will show a thorough understanding of normal and abnormal IP header fields.

Examining Packet Crafting

The candidate will demonstrate familiarity with how packets are crafted using different tools.

Examining TCP Fields

The candidate will show a thorough understanding of normal and abnormal TCP fields.

Examining TCPDump Output

The candidate will demonstrate a thorough understanding of how to analyze a packet header using tcpdump.

Examining UDP Fields

The candidate will show a thorough understanding of normal and abnormal UDP fields.

Firewalls and Intrusion Prevention

The candidate will understand how firewall technology can be employed to improve intrusion detection/prevention

ICMP Theory

The candidate will understand the ICMP protocol, how ICMP can be used for mapping, and the concepts behind ICMP based attacks

IDS Interoperability

The candidate will show a fundamental understanding of the different types of interoperability models.

IDS Patterns

The candidate will show a thorough understanding of in the wild detects including DoS attacks, network mapping, and coordinated attacks.

IDS Signatures & Response Time

The candidate will show a fundamental understanding of the flow and process of detecting intrusions.

IDS/IPS Architecture Issues

The candidate will show a thorough understanding of the specific technical related issues with regard to deploying IDS/IPS systems.

IDS/IPS Management Issues

The candidate will show a thorough understanding of the management related issues with regard to deploying IDS/IPS systems.

Indications & Warnings

The candidate will show an understanding of the importance of two indication and warning models.

Introduction to Snort

The candidate will demonstrate a fundamental understanding of the installation of Snort as an Intrusion Detection System.

IP Routing

The candidate will demonstrate an understanding of how packets are routed across IP networks.

IPv6 Theory

Outcome Statement Not Available At This Time

Malicious Fragmentation

The candidate will show an understanding of the concepts behind fragmentation-based attacks.

Manual & Automated Correlation

The candidate will show an understanding of with the importance of correlation in intrusion detection.

Microsoft Protocols

The candidate will demonstrate an understanding of Microsoft's SMB/CIFS, RPC, and Active Directory protocols.

Network Mapping & Info Gathering

The candidate will demonstrate a thorough understanding of the reconnaissance techniques that attackers use to gather information.

NIDS Evasion & Insertion

The candidate will show a fundamental understanding of the evasion and insertion techniques hackers utilize to confuse NID systems.

Normal Fragmentation

The candidate will demonstrate an understanding of how fragmentation works through theory and packet capture examples.

Normal Stimulus Response

The candidate will show a fundamental understanding of everyday network traffic behavior and typical responses.

Snort Configuration

The candidate will demonstrate an understanding of how to configure the Snort Intrusion Detection System.

Snort GUIs & Sensor Management

The candidate will show familiarity with GUI tools that are available to management a Snort implementation.

Snort Modes of Operation

The candidate will show an understanding of the different methods of operation that Snort currently supports.

Snort Performance, Active Response & Tagging

The candidate will demonstrate a fundamental understanding of Snort performance options, active response techniques and tagging.

Snort Rules

The candidate will demonstrate familiarity with how to effectively configure Snort rules.

TCPIP Refresher & Beyond

The candidate will demonstrate familiarity with tcpdump/windump, and have a thorough understanding of IP.

Traffic Analysis

The candidate will be familiar with organizing multiple log formats for analysis, how to detect the source of an event, normal vs abnormal behavior, link analysis, periodic reports, and profiling.

Traffic Analysis with Tcpdump

The candidate will demonstrate an understanding of how to analyze network traffic in relation to other traffic using tcpdump.

Writing Tcpdump Filters

The candidate will demonstrate familiarity with the techniques that are involved when writing tcpdump filters.