GIAC - Cloud Forensics Responder (GCFR)

Curriculum

• Module 1: AWS Cloud Platform Logging
• The candidate will demonstrate an understanding of the information available from the generation, collection, retention and storage of logs from AWS
• Module 2: AWS Structure and Access Methods
• The candidate will demonstrate an understanding of AWS architectures, logging, data access and the investigative possibilities
• Module 3: Azure & M365 Cloud Platform Logging
• The candidate will demonstrate an understanding of the information available from the generation, collection, retention and storage of logs from Azure & M365
• Module 4: Azure & M365 Structure and Access Methods
• The candidate will demonstrate an understanding of Azure and M365 architectures, logging, data access and the investigative possibilities
• Module 5: Cloud Forensic Artifact Techniques
• The candidate will demonstrate an understanding of the services, tools and resources available to assist with and automate forensic investigations
• Module 6: Cloud Storage Platforms
• The candidate will demonstrate an understanding of the different characteristics of each cloud's storage resources.
• The candidate will demonstrate an understanding of ways to create, secure, access and use each storage type.
• Module 7: Cloud Virtual Machine Architecture
• The candidate will demonstrate an understanding of the different types, configuration and availability of virtual machines offered in each cloud environment.
• Module 8: Cloud-based Attacks
• The candidate will demonstrate an understanding of the tactics and techniques used to attack major cloud provider's computing resources.
• Module 9: GCP and Google Workspace Cloud Platform Logging
• The candidate will demonstrate an understanding of the information available from the generation, collection, retention and storage of logs from GCP and Google Workspace
• Module 10: GCP and Google Workspace Structure and Access Methods
• The candidate will demonstrate an understanding of GCP and Google Workspace architectures, logging, data access and the investigative possibilities
• Module 11: In-Cloud Investigations
• The candidate will demonstrate an understanding of how to collect forensic images and how to extract data from cloud resources to conduct forensic investigations.
• Module 12: Introduction to Enterprise Cloud Digital Forensics and Incident Response
• The candidate will demonstrate an understanding of the most popular cloud concepts. The candidate will demonstrate an understanding of key cloud resources and logs used to facilitate incident response and forensics.
• Module 13: Multi-Cloud Virtual Networking
• The candidate will demonstrate an understanding of each cloud networking topology and the grouping of resources for network communication. The candidate will demonstrate an understanding of the inspection and control of network traffic.