EC-Council CAST® — Advanced Network Defense®

The EC-Council Centre of Advanced Security Training has arrived at Firebrand Training. This three-day Advanced Network Defense course is intensive, and will make you think like a hacker. You will learn how to defend against the latest attacks.

Warning: This is not a beginner’s course. You'll be expected to know how to attempt attacks against many platforms and architectures. The instructor will challenge you to attack a device or system, then you will learn how to defend against it. The course is right for you if you're a: firewall administrator, system architect, or system / Windows administrator.

You will learn:

• How to identify security weaknesses in computer systems or networks, before it's too late
• How to use hacking and pen testing to defend against various attacks
• Best practices in developing secure system and network configurations
• How to deploy machines in a protected state
• Techniques critical to the protection of your entire enterprise against some of today‚Äôs most advanced threats
• How to detect malware

Note: this course doesn't include an exam, but you'll become Advanced Network Defense certified.

9x Accredited Training Centre of the Year

Firebrand Training has again won the EC-Council Accredited Training Centre of the Year Award, from a Training Partner network that has more than 700 training centres across 107 countries. This extends a record-breaking run of successive awards to nine years.

Jay Bavisi, President of EC-Council said: “The annual EC-Council Awards highlights the commitment and achievements of our global partners and trainers that have contributed to the information security community.”

Module 1: Firewalls

• Firewalls
• Firewall Types: Stateless Packet Filters
• Improving Device Remote-Access Security
• Locking Down the Console Port
• Protecting Terminal Lines
• Establishing Encrypted Communications
• Configuring HTTPS
• Configuring SSH

LAB: Securing the Perimeter

Module 2: Advanced Filtering

• Advanced Filtering Techniques
• Ingress Filtering
• Egress Filtering
• Source Address Verification (SAV)
• uRPF
• Additional Filtering Considerations
• Time-Based ACLs
• Reflexive ACLs
• Reflexive ACL vs. Static ACL
• Context-Based Access Control (CBAC)
• Essential Steps to Harden Routers

LAB: Advanced Filtering

Module 3: Firewall Configuration

• Firewall Types: Stateful Packet Filters
• Application Proxies
• Application Proxies vs. Stateful Packet filters
• Web Application Firewalls
• Web Application Firewall Types
• Web Application Firewall Products
• Firewall Architecture
• Screened Subnet Firewall
• The Classic Firewall Architecture
• Belt and Braces Firewall
• Separate Services Subnet
• Fortress Mentality
• De-parameterization
• Perimeter Configuration

LAB: Selecting a Firewall Architecture

Module 4: Hardening: Establishing a Secure Baseline

• Windows NT/2000/2003 and XP
• Windows 2000/2003/XP
• Windows 2003
• Windows Vista
• Server 2003 Architecture
• Broken Kernel
• Modes of the OS
• UNIX/Linux
• Secure Server Guidelines
• Hardening Systems
• Security Compliance Manager
• Device Security
• Essential Steps to Harden Switches

LAB: Hardening

Windows Server 2008 Security (Part I)

• Server 2008 Components
• Enterprise Protection
• AD RMS
• AD RMS Components
• EFS
• EFS Enhancements in Server 2008
• EFS Best Practices

LAB: Server 2008 Lab

Windows Server 2008 Security (Part II)

• IPsec Rules
• Firewall Scripting
• netsh
• Isolating a Server
• Group Policy Object
• Server Isolation Steps
• Domain Isolation
• Domain Isolation Issues
• Best Practices
• Trusted Platform Module
• Wave Systems
• TPM Architecture
• Crypto API
• Example
• Embassy Server Software
• Embassy Client Software
• Self-Encrypting Drives

LAB: TPM

Module 5: Intrusion Detection and Prevention

• Why Intrusion Detection?
• Fortress Mentality
• Intrusion Detection 101
• What is Intrusion Detection?
• False positives!
• Topology concerns
• Recommended in most circles
• Realistic
• Intrusion Prevention
• Types of IPS
• Host-Based Intrusion Prevention Systems
• Host-Based Intrusion Prevention Systems

LAB: Intrusion Detection

Module 6: Protecting Web Applications

• Top 10 www.owasp.org
• Injection Flaws
• Cross Site Scripting
• Broken Authentication
• Insecure Cryptographic Storage
• Reverse Engineering Web Apps
• Tools
• Hackbar
• Tamper Data
• The Two Main Attacks for Web
• XSS
• SQL Injection
• xp_cmdshell
• There is More
• More Tools
• SQL Inject Me
• XSS ME
• Choose The Right Database
• Practice, Practice, Practice
• Tutorials
• Mutillidae
• Web Application Firewalls
• Components of Web Application Firewall

LAB: Protecting Web Apps

Module 7: Memory Analysis

• Data Types Revisited
• Volatile
• System date and time
• Current network connections and Open ports
• Processes that opened ports
• Cached NetBIOS Names
• Users Currently Logged On
• Internal routing
• Running Processes
• Pslist
• Trivia
• Pslist ‚Äìt
• Tasklist
• Tlist
• Running Services
• Open Files
• Process Memory Dumps

LAB: Memory Analysis

Module 8: Endpoint protection

• Introduction to NAC
• NAC Defined
• NAC General Architecture
• NAC General Architecture Illustrated
• NAC Concepts
• Inline NAC
• Out-of-Band
• Identifying NAC Requirements
• Implementing User-Based Identity Access Control
• Network Access Protection (NAP)
• NAP Components
• NAP Enforcement
• NAP Best Practices
• 802.1x
• EAP Explained

• LAB 1: Network Access Protection with DHCP
• LAB 2: Network Access Protection with IPsec
• LAB 3: Endpoint Protection

Module 9: Securing Wireless

• Wireless Tools
• Wireless Vulnerabilities Summary
• MAC Filtering
• Hiding Access Points
• Hijacking
• Jamming
• Identifying Targets
• Wardriving
• Sniffing on Wireless
• Attacking Encrypted Networks
• Wep Data
• The other case
• Reality
• WPA Tools
• WPA
• LEAP
• Asleap
• Comparison

LAB: Securing Wireless

Warning: This is not a beginner’s course. You'll be expected to know how to attempt attacks against many platforms and architectures. The instructor will challenge you to attack a device or system, then you will learn how to defend against it. The course is right for you if you're a: firewall administrator, system architect, or system / Windows administrator.

You must be familiar with IT security best practices, and have a good understanding of programming logic and common web technologies, as well as binary applications:

• Basic Windows administration for servers and workstations
• Basic Linux/NIX system administration skill
• Basic command line proficiency on both Windows and NIX systems

Ideally, the you'll be EC-Council CEH or ECSA certified - or have the equivalent experience.