Cyber Intrusion Analyst

Overview

Cyber Intrusion Analyst Overview

Cyber Intrusion Analyst apprentices are taught how to detect breaches in network security for escalation to incident response or other determined function. They'll understand and interpret the alerts that are automatically generated by those tools, including integrating and correlating information from a variety of sources and in different forms and where necessary seek additional information to inform the Analyst's judgement on whether or not the alert represents a security breach.

To achieve their Cyber Intrusion Analyst apprenticeship, apprentices must:

• Demonstrate competence against five knowledge modules: Networks, Operating Systems, Information and Cyber Security Foundations, Business Processes and Law, Regulation and Ethics. These are assessed by examinations set by the British Computer Society and regulated by Ofqual. Apprentices must pass all five modules.
• Submit a portfolio of evidence showing how they have applied the knowledge from these modules to projects and activities in their workplace.
• Complete their formal End Point Assessment, which comprises: a synoptic project to showcase knowledge and skills from across the apprenticeship; a review of their portfolio of evidence; and a final interview with an independent EPA assessor.

Successful Cyber Intrusion Analyst apprentices go on into roles such as a Secure Operations Centre (SOC) Analyst, Intrusion Analyst, Network Intrusion Analyst, Incident Response Centre (IRC) Analyst, Network Operations Centre (NOC) Security Analyst.

Technical Competencies

Upon completion of their Cyber Intrusion Analyst apprenticeship, individuals will be able to:

• integrate and correlate information from various sources (including log files from different sources, network monitoring tools, Secure Information and Event Management (SIEM) tools, access control systems, physical security systems) and compare to known threat and vulnerability data to form a judgement based on evidence with reasoning that the anomaly represents a network security breach
• recognise anomalies in observed network data structures (including. by inspection of network packet data structures) and network behaviours (including by inspection of protocol behaviours) and by inspection of log files and by investigation of alerts raised by automated tools including SIEM tools
• accurately, impartially and concisely record and report the appropriate information, including the ability to write reports (within a structure or template provided)
• recognise and identify all the main normal features of log files generated by typical network appliances, including servers and virtual servers, firewalls, routers
• recognise and identify all the main features of a normally operating network layer (including TCP/IP, transport and session control or ISO OSI layers 2-5), including data structures and protocol behaviour, as presented by network analysis and visualisation tools
• use and effect basic configuration of the required automated tools, including network monitoring and analysis tools, SIEM tools, correlation tools, threat and vulnerability databases
• undertake root cause analysis of events and make recommendations to reduce false positives and false negatives
• interpret and follow alerts and advisories supplied by sources of threat and vulnerability (including OWASP, CISP, open source) and relate these to normal and observed network behaviour
• undertake own research to find information on threat and vulnerability (including using the internet)
• manage local response to non-major incidents in accordance with a defined procedure
• interact and communicate effectively with the incident response team/process and/or customer incident response team/process for incidents
• operate according to service level agreements or employer defined performance targets

Technical Knowledge and Understanding

Upon completion of their Cyber Intrusion Analyst apprenticeship, individuals will understand:

• IT network features and functions, including virtual networking, principles and common practice in network security and the OSI and TCP/IP models, and the function and features of the main network appliances
• and utilise at least three Operating System (OS) security functions and associated features
• and can propose appropriate responses to current and new attack techniques, hazards and vulnerabilities relevant to the network and business environment
• and can propose how to deal with emerging attack techniques, hazards and vulnerabilities relevant to the network and business environment
• the lifecycle and service management practices to Information Technology Infrastructure Library (ITIL) foundation level
• and can adhere to and can advise on the ethical responsibilities of a cyber security professional
• the lifecycle
• the main features and applicability of law, regulations and standards (including Data Protection Act/Directive, Computer Misuse Act, ISO 27001) relevant to cyber network defence and follows these appropriately
• and can advise others on cyber incident response processes, incident management processes and evidence collection/preservation requirements to support incident investigation
• and can apply the foundations of information and cyber security including: explaining the importance of cyber security and basic concepts including harm, identity, confidentiality, integrity, availability, threat, risk and hazard, trust and assurance and the insider threat as well as explaining how the concepts relate to each other and the significance of risk to a business

Underpinning Skills, Attitudes and Behaviours

• logical and creative thinking skills
• analytical and problem solving skills
• ability to work independently and to take responsibility
• can use own initiative
• a thorough and organised approach
• ability to work with a range of internal and external people
• ability to communicate effectively in a variety of situations
• maintain productive, professional and secure working environment
• ability to interpret written requirements and technical specification documents
• effective telephone and e mail skills, including ability to communicate effectively with strangers under pressure, including reporting a security breach

Qualifications

Apprentices will achieve five BCS qualifications.

Funding

£18,000

Level

This is a level 4 apprenticeship.

Professional Recognition

This apprenticeship is recognised for entry onto the register of IT technicians confirming SFIA level 3 professional competence and those completing the apprenticeship are eligible to apply for registration.

Duration

The duration of this Firebrand apprenticeship is 16 months. Because this period involves both training and the final End Point Assessment (some of which must be carried out in the workplace), employers need to ensure the apprentice’s contract covers the full programme duration.

Registration to the Register of IT Technicians (RITTech)

Once apprentices have completed their apprenticeship they are officially recognised by the British Computer Society (BCS) for entry onto the Register of IT Technicians, confirming SFIA level 3 professional competence.