Cyber Security Course In Noida

Module 01: Ethical Hacking: An Introduction

In this first module, you will learn the basics of ethical hacking that are essential for the CEH exam.

Overview of Information Security

• Internet is an Integral Part of Business and Personal Life – What Happens Online in 60 Seconds
• Essential Terminology
• Elements of Information Security
• The Security, Functionality, and Usability Triangle

Attack Vectors and Threats to Information Security

• Motives, Goals, and Objectives of Information Security Attacks
• Top Information Security Attack Vectors
• Information Security Threat Categories
• Types of Attacks on a System
• Information Warfare

Basic Concepts of Hacking

• What is Hacking?
• Who is a Hacker?
• Hacker Classes
• Hacking Phases

Basic Concepts of Ethical Hacking

• What is Ethical Hacking?
• Why is Ethical Hacking Necessary?
• Scope and Limitations of Ethical Hacking
• Skills of an Ethical Hacker

Information Security Controls

• Information Assurance (IA)
• Information Security Management Program
• Enterprise Information Security Architecture (EISA)
• Network Security Zoning
• Defense-in-Depth
• Information Security Policies
• Physical Security
• What is Risk?
• Threat Modeling
• Incident Management
• Security Incident and Event Management (SIEM)
• User Behavior Analytics (UBA)
• Network Security Controls
• Identity and Access Management (IAM)
• Data Leakage
• Data Backup
• Data Recovery
• Role of AI/ML in Cyber Security

Concepts of Penetration testing

• Penetration Testing
• Why Penetration Testing
• Comparing Security Audit, Vulnerability Assessment, and Penetration Testing
• Blue Teaming/Red Teaming
• Types of Penetration Testing
• Phases of Penetration Testing
• Security Testing Methodology

Laws and Standards of information Security

• Payment Card Industry Data Security Standard (PCI-DSS)
• ISO/IEC 27001:2013
• Health Insurance Portability and Accountability Act (HIPAA)
• Sarbanes Oxley Act (SOX)
• The Digital Millennium Copyright Act (DMCA)
• Federal Information Security Management Act (FISMA)
• Cyber Law in Different Countries

Module 02: Basics of Reconnaissance and Footprinting

Moving ahead in this Ethical Hacking course, you will master the first phase of ethical hacking, i.e. Footprinting and Reconnaissance

Concepts of Footprinting

• What is Footprinting?
• Objectives of Footprinting

Footprinting Using Search Engines

• Footprint Using Advanced Google Hacking Techniques
• Information Gathering Using Google Advanced Search and Image Search
• Google Hacking Database
• VoIP and VPN Footprinting through Google Hacking Database

Footprinting Using Web Services

• Finding Company’s Top-Level Domains (TLDs) and Sub-Domains
• Finding the Geographical Location of the Target
• People Search on Social Networking Sites and People Search Services
• Gathering Information from LinkedIn
• Gathering Information from Financial Services
• Footprinting through Job Sites
• Monitoring Target Using Alerts
• Information Gathering Using Groups, Forums, and Blogs
• Determining the Operating System
• VoIP and VPN Footprinting through SHODAN

Footprinting Using Social Networking Sites

• Collecting Information through Social Engineering on Social Networking Sites

Footprinting of Websites

Website Footprinting

Website Footprinting using Web Spiders

Mirroring Entire Website

Extracting Website Information from https://archive.org

Extracting Metadata of Public Documents

Monitoring Web Pages for Updates and Changes

Footprinting of Emails

• Tracking Email Communications
• Collecting Information from Email Header
• Email Tracking Tools

Competitive Intelligence

• Competitive Intelligence Gathering
• Competitive Intelligence – When When did this company begin? How did it develop?
• Competitive Intelligence – What are the company’s plans?
• Competitive Intelligence – What do expert opinions say about the company?
• Monitoring Website Traffic of Target Company
• Tracking Online Reputation of the Target

Footprinting using Whois

• Whois Lookup
• Whois Lookup Result Analysis
• Whois Lookup Tools
• Finding IP Geolocation Information

DNS Footprinting

• Extracting DNS Information
• DNS Interrogation Tools

Network Footprinting

• Locate the Network Range
• Traceroute
• Traceroute Analysis
• Traceroute Tools

Footprinting by Social Engineering

• Footprinting through Social Engineering
• Collect Information Using Eavesdropping, Shoulder Surfing, and Dumpster Diving

Tools used for Footprinting

• Maltego
• Recon-ng
• FOCA
• Recon-Dog
• OSRFramework
• Additional Footprinting Tools

Countermeasures

• Footprinting Countermeasures

Footprinting Pen Testing

• Footprinting Pen Testing
• Footprinting Pen Testing Report Templates

Module 03: Network Scanning

In this part, you will learn how to scan networks and find vulnerabilities in a network.

Concepts Network Scanning

• Overview of Network Scanning
• TCP Communication Flags
• TCP/IP Communication
• Creating Custom Packet Using TCP Flags
• Scanning in IPv6 Networks

Tools used for Scanning

• Nmap
• Hping2 / Hping3
• Scanning Tools
• Scanning Tools for Mobile

Techniques used for Scanning

• Scanning Techniques

Scanning Beyond IDS and Firewall

• IDS/Firewall Evasion Techniques

Banner Grabbing

• Banner Grabbing
• How to Identify Target System OS
• Banner Grabbing Countermeasures

Network Diagrams

• Drawing Network Diagrams
• Network Discovery and Mapping Tools
• Network Discovery Tools for Mobile

Scanning Pen Testing

• Scanning Pen Testing

Module 04: Basics of Enumeration

Concepts of Enumeration

• What is Enumeration?
• Techniques for Enumeration
• Services and Ports to Enumerate

NetBIOS Enumeration

• NetBIOS Enumeration
• NetBIOS Enumeration Tools
• Enumerating User Accounts
• Enumerating Shared Resources Using Net View

SNMP Enumeration

• Simple Network Management Protocol (SNMP) Enumeration
• Working of SNMP
• Management Information Base (MIB)
• SNMP Enumeration Tools

LDAP Enumeration

• LDAP Enumeration
• LDAP Enumeration Tools

NTP Enumeration

• NTP Enumeration
• NTP Enumeration Commands
• NTP Enumeration Tools

SMTP and DNS Enumeration

• SMTP Enumeration
• SMTP Enumeration Tools
• DNS Enumeration Using Zone Transfer

Other Enumeration Techniques

• IPsec Enumeration
• VoIP Enumeration
• RPC Enumeration
• Unix/Linux User Enumeration

Enumeration Countermeasures

• Enumeration Countermeasures

Enumeration Pen Testing

• Enumeration Pen Testing

Module 05: Vulnerability Analysis

This module of Ethical Hacking training will train you in analyzing the vulnerabilities in the system.

Concepts of Vulnerability Assessment

• Vulnerability Research
• Vulnerability Classification
• What is Vulnerability Assessment?
• Types of Vulnerability Assessment
• Vulnerability-Management Life Cycle

Solutions for Vulnerability Assessment

• Comparing Approaches to Vulnerability Assessment
• Working of Vulnerability Scanning Solutions
• Types of Vulnerability Assessment Tools
• Characteristics of a Good Vulnerability Assessment Solution
• Choosing a Vulnerability Assessment Tool
• Criteria for Choosing a Vulnerability Assessment Tool
• Best Practices for Selecting Vulnerability Assessment Tools

Vulnerability Scoring Systems

• Common Vulnerability Scoring System (CVSS)
• Common Vulnerabilities and Exposures (CVE)
• National Vulnerability Database (NVD)
• Resources for Vulnerability Research

Vulnerability Assessment Tools

Vulnerability Assessment Tools

Vulnerability Assessment Tools for Mobile

Vulnerability Assessment Reports

Vulnerability Assessment Reports

Analyzing Vulnerability Scanning Report

Module 06: basics of System Hacking

Moving ahead in this training, you will learn about system hacking; one of the most important topics in the CEH exam.

Concepts of System Hacking

• CEH Hacking Methodology (CHM)
• System Hacking Goals

Cracking Passwords

• Password Cracking
• Types of Password Attacks
• Password Recovery Tools
• Microsoft Authentication
• How Hash Passwords Are Stored in Windows SAM?
• NTLM Authentication Process
• Kerberos Authentication
• Password Salting
• Tools to Extract the Password Hashes
• Password Cracking Tools
• How to Defend against Password Cracking
• How to Defend against LLMNR/NBT-NS Poisoning

Escalating Privileges

• Privilege Escalation
• Privilege Escalation Using DLL Hijacking
• Privilege Escalation by Exploiting Vulnerabilities
• Privilege Escalation Using Dylib Hijacking
• Privilege Escalation using Spectre and Meltdown Vulnerabilities
• Other Privilege Escalation Techniques
• How to Defend Against Privilege Escalation

Executing Applications

• Executing Applications
• Keylogger
• Spyware
• How to Defend Against Keyloggers
• How to Defend Against Spyware

Hiding Files

Rootkits

NTFS Data Stream

What is Steganography?

Covering Tracks

Covering Tracks

Disabling Auditing: Auditpol

Clearing Logs

Manually Clearing Event Logs

Ways to Clear Online Tracks

Covering BASH Shell Tracks

Covering Tracks on Network

Covering Tracks on OS

Covering Tracks Tools

Penetration Testing

Password Cracking

Privilege Escalation

Executing Applications

Hiding Files

Covering Tracks

Module 07: Threats from Malware

Concepts of Malwares

• Introduction to Malware
• Different Ways Malware can Get into a System
• Common Techniques Attackers Use to Distribute Malware on the Web
• Components of Malware

Concepts of Trojans

• What is a Trojan?
• How Hackers Use Trojans
• Common Ports Used by Trojans
• How to Infect Systems Using a Trojan
• Trojan Horse Construction Kit
• Wrappers
• Crypters
• How Attackers Deploy a Trojan
• Exploit Kits
• Evading Anti-Virus Techniques
• Types of Trojans

Concepts of Viruses and Worms

• Introduction to Viruses
• Stages of Virus Life
• Working of Viruses
• Indications of Virus Attack
• How does a Computer Get Infected by Viruses
• Virus Hoaxes
• Fake Antiviruses
• Ransomware
• Types of Viruses
• Creating Virus
• Computer Worms
• Worm Makers

Malware Analysis

• What is Sheep Dip Computer?
• Anti-Virus Sensor Systems
• Introduction to Malware Analysis
• Malware Analysis Procedure: Preparing Testbed
• Static Malware Analysis
• Dynamic Malware Analysis
• Virus Detection Methods
• Trojan Analysis: ZeuS/Zbot
• Virus Analysis: WannaCry

Countermeasures

• Trojan Countermeasures
• Backdoor Countermeasures
• Virus and Worms Countermeasures

Anti-Malware Software

• Anti-Trojan Software
• Antivirus Software

Malware Penetration Testing

• Malware Penetration Testing

Module 08: Basics of Sniffing

Concepts of Sniffing

• Network Sniffing
• Types of Sniffing
• How an Attacker Hacks the Network Using Sniffers
• Protocols Vulnerable to Sniffing
• Sniffing in the Data Link Layer of the OSI Model
• Hardware Protocol Analyzers
• SPAN Port
• Wiretapping
• Lawful Interception

Sniffing Technique: MAC Attacks

• MAC Address/CAM Table
• How CAM Works
• What Happens When CAM Table Is Full?
• MAC Flooding
• Switch Port Stealing
• How to Defend against MAC Attacks

Sniffing Technique: DHCP Attacks

• How DHCP Works
• DHCP Request/Reply Messages
• DHCP Starvation Attack
• Rogue DHCP Server Attack
• How to Defend Against DHCP Starvation and Rogue Server Attack

Sniffing Technique: ARP Poisoning

• What Is Address Resolution Protocol (ARP)?
• ARP Spoofing Attack
• Threats of ARP Poisoning
• ARP Poisoning Tools
• How to Defend Against ARP Poisoning
• Configuring DHCP Snooping and Dynamic ARP Inspection on Cisco Switches
• ARP Spoofing Detection Tools

Sniffing Technique: Spoofing Attacks

• MAC Spoofing/Duplicating
• MAC Spoofing Technique: Windows
• MAC Spoofing Tools
• IRDP Spoofing
• How to Defend Against MAC Spoofing

Sniffing Technique: DNS Poisoning

• DNS Poisoning Techniques
• How to Defend Against DNS Spoofing

Tools for Sniffing

• Sniffing Tool: Wireshark
• Display Filters in Wireshark
• Additional Wireshark Filters
• Sniffing Tools
• Packet Sniffing Tools for Mobile

Countermeasures

• How to Defend Against Sniffing

Sniffing Detection Techniques

• How to Detect Sniffing
• Sniffer Detection Techniques
• Promiscuous Detection Tools

Sniffing Pen Testing

• Sniffing Penetration Testing

Module 09: Social Engineering

Moving ahead in this Ethical Hacking course, you will learn social engineering

Concepts of Social Engineering

• What is Social Engineering?
• Phases of a Social Engineering Attack

Techniques of Social Engineering

• Types of Social Engineering
• Human-based Social Engineering
• Computer-based Social Engineering
• Mobile-based Social Engineering

Insider Threats

• Insider Threat / Insider Attack
• Type of Insider Threats

Impersonation on Social Networking Sites

• Social Engineering Through Impersonation on Social Networking Sites
• Impersonation on Facebook
• Social Networking Threats to Corporate Networks

Identity Theft

• Identity Theft

Countermeasures

• Social Engineering Countermeasures
• Insider Threats Countermeasures
• Identity Theft Countermeasures
• How to Detect Phishing Emails?
• Anti-Phishing Toolbar
• Common Social Engineering Targets and Defense Strategies

Social Engineering Pen-Testing

• Social Engineering Pen-Testing
• Social Engineering Pen-Testing Tools

Module 10: Denial-of-Service Attack

DoS/DDoS Concepts

• What is a Denial-of-Service Attack?
• What is Distributed Denial-of-Service Attack?

Techniques used for DoS/DDoS Attacks

• Basic Categories of DoS/DDoS Attack Vectors
• UDP Flood Attack
• ICMP Flood Attack
• Ping of Death and Smurf Attack
• SYN Flood Attack
• Fragmentation Attack
• HTTP GET/POST and Slowloris Attacks
• Multi-Vector Attack
• Peer-to-Peer Attacks
• Permanent Denial-of-Service Attack
• Distributed Reflection Denial-of-Service (DRDoS)

Botnets

• Organized Cyber Crime: Organizational Chart
• Botnet
• A Typical Botnet Setup
• Botnet Ecosystem
• Scanning Methods for Finding Vulnerable Machines
• How Malicious Code Propagates?
• Botnet Trojans

DDoS Case Study

• DDoS Attack
• Hackers Advertise Links to Download Botnet
• Use of Mobile Devices as Botnets for Launching DDoS Attacks
• DDoS Case Study: Dyn DDoS Attack

Tools used for DoS/DDoS Attack

• DoS/DDoS Attack Tools
• DoS and DDoS Attack Tool for Mobile

Countermeasures

• Detection Techniques
• DoS/DDoS Countermeasure Strategies
• DDoS Attack Countermeasures
• Techniques to Defend against Botnets
• DoS/DDoS Countermeasures
• DoS/DDoS Protection at ISP Level
• Enabling TCP Intercept on Cisco IOS Software

Tools used for DoS/DDoS Protection

• Advanced DDoS Protection Appliances
• DoS/DDoS Protection Tools

DoS/DDoS Penetration Testing

• Denial-of-Service (DoS) Attack Pen-Testing

Module 11: Session Hijacking

Concepts of Session Hijacking

• What is Session Hijacking?
• Why Session Hijacking is Successful?
• Session Hijacking Process
• Packet Analysis of a Local Session Hijack
• Types of Session Hijacking
• Session Hijacking in OSI Model
• Spoofing vs. Hijacking

Application Level Session Hijacking

• Application Level Session Hijacking
• Compromising Session IDs using Sniffing and Predicting Session Token
• Compromising Session IDs Using Man-in-the-Middle Attack
• Compromising Session IDs Using Man-in-the-Browser Attack
• Compromising Session IDs Using Client-side Attacks
• Compromising Session IDs Using Client-side Attacks: Cross-site Script Attack
• Compromising Session IDs Using Client-side Attacks: Cross-site Request Forgery Attack
• Compromising Session IDs Using Session Replay Attack
• Compromising Session IDs Using Session Fixation
• Session Hijacking Using Proxy Servers
• Session Hijacking Using CRIME Attack
• Session Hijacking Using Forbidden Attack

Network Level Session Hijacking

• TCP/IP Hijacking
• IP Spoofing: Source Routed Packets
• RST Hijacking
• Blind Hijacking
• UDP Hijacking
• MiTM Attack Using Forged ICMP and ARP Spoofing

Session Hijacking Tools

• Session Hijacking Tools
• Session Hijacking Tools for Mobile

Countermeasures

• Session Hijacking Detection Methods
• Protecting against Session Hijacking
• Methods to Prevent Session Hijacking: To be Followed by Web Developers
• Methods to Prevent Session Hijacking: To be Followed by Web Users
• Session Hijacking Detection Tools
• Approaches Vulnerable to Session Hijacking and their Preventative Solutions
• Approaches to Prevent Session Hijacking
• IPSec
• Session Hijacking Prevention Tools

Penetration Testing

• Session Hijacking Pen Testing

Module 12: How to Evade IDS, Firewalls, and Honeypots

Concepts of IDSs, Firewalls, and Honeypots

• Intrusion Detection System (IDS)
• Firewall
• Honeypot

IDS, Firewall, and Honeypot Solutions

• Intrusion Detection Tool
• Firewalls
• Honeypot Tools

IDS Evasion

• IDS Evasion Techniques

Firewall Evasion

• Firewall Evasion Techniques

Tools for IDS/Firewall Evasion

• IDS/Firewall Evasion Tools
• Packet Fragment Generator Tools

Detecting Honeypots

• Detecting Honeypots
• Detecting and Defeating Honeypots
• Honeypot Detection Tool: Send-Safe Honeypot Hunter

IDS/Firewall Evasion Countermeasures

• How to Defend Against IDS Evasion
• How to Defend Against Firewall Evasion

Penetration Testing

• Firewall/IDS Penetration Testing

Module 13: Basics of Hacking Web Servers

Web Server Concepts

• Web Server Operations
• Open Source Web Server Architecture
• IIS Web Server Architecture
• Web Server Security Issue
• Why Web Servers Get Compromised?
• Impact of Web Server Attacks

Attacks of Web Servers

• DoS/DDoS Attacks
• DNS Server Hijacking
• DNS Amplification Attack
• Directory Traversal Attacks
• Man-in-the-Middle/Sniffing Attack
• Phishing Attacks
• Website Defacement
• Web Server Misconfiguration
• HTTP Response Splitting Attack
• Web Cache Poisoning Attack
• SSH Brute Force Attack
• Web Server Password Cracking
• Web Application Attacks

Methodology of Web Server Attacks

• Information Gathering
• Web Server Footprinting/Banner Grabbing
• Website Mirroring
• Vulnerability Scanning
• Session Hijacking
• Web Server Passwords Hacking
• Using Application Server as a Proxy

Tools of Web Server Attacks

• Metasploit
• Web Server Attack Tools

Countermeasures

• Place Web Servers in Separate Secure Server Security Segment on Network
• Countermeasures
• Detecting Web Server Hacking Attempts
• How to Defend Against Web Server Attacks
• How to Defend against HTTP Response Splitting and Web Cache Poisoning
• How to Defend against DNS Hijacking

Patch Management

• Patches and Hotfixes
• What is Patch Management
• Installation of a Patch
• Patch Management Tools

Tools of Web Server Security

• Web Application Security Scanners
• Web Server Security Scanners
• Web Server Security Tools

Web Server Pen Testing

• Web Server Penetration Testing
• Web Server Pen-Testing Tools

Module 14: Web Application Hacking

Web App Concepts

• Introduction to Web Applications
• Web Application Architecture
• Web 2.0 Applications
• Vulnerability Stack

Threats to Web App

• OWASP Top 10 Application Security Risks – 2017
• Other Web Application Threats

Hacking Methodology

• Web App Hacking Methodology
• Footprint Web Infrastructure
• Attack Web Servers
• Analyze Web Applications
• Bypass Client-Side Controls
• Attack Authentication Mechanism
• Attack Authorization Schemes
• Attack Access Controls
• Attack Session Management Mechanism
• Perform Injection/Input Validation Attacks
• Attack Application Logic Flaws
• Attack Database Connectivity
• Attack Web App Client
• Attack Web Services

Web App Hacking Tools

• Web Application Hacking Tools

Countermeasures

• Web Application Fuzz Testing
• Source Code Review
• Encoding Schemes
• How to Defend Against Injection Attacks
• Web Application Attack Countermeasures
• How to Defend Against Web Application Attacks

Web App Security Testing Tools

• Web Application Security Testing Tools
• Web Application Firewall

Web App Pen Testing

• Web Application Pen Testing
• Web Application Pen Testing Framework

Module 15: Basics of SQL Injection

SQL Injection Concepts

• What is SQL Injection?
• SQL Injection and Server-side Technologies
• Understanding HTTP POST Request
• Understanding Normal SQL Query
• Understanding an SQL Injection Query
• Understanding an SQL Injection Query – Code Analysis
• Example of a Web Application Vulnerable to SQL Injection: aspx
• Example of a Web Application Vulnerable to SQL Injection: Attack Analysis
• Examples of SQL Injection

Types of SQL Injection

• Types of SQL Injection

SQL Injection Methodology

• SQL Injection Methodology

SQL Injection Tools

• SQL Injection Tools
• SQL Injection Tools for Mobile

Evasion Techniques

• Evading IDS
• Types of Signature Evasion Techniques

Countermeasures

• How to Defend Against SQL Injection Attacks
• SQL Injection Detection Tools
• SQL Injection Detection Tools

Module 16: Wireless Network Hacking

Wireless Concepts

• Wireless Terminologies
• Wireless Networks
• Wireless Standards
• Service Set Identifier (SSID)
• Wi-Fi Authentication Modes
• Wi-Fi Authentication Process Using a Centralized Authentication Server
• Types of Wireless Antennas

Wireless Encryption

• Types of Wireless Encryption
• WEP vs. WPA vs. WPA2
• WEP Issues
• Weak Initialization Vectors (IV)

Wireless Threats

• Wireless Threats

Wireless Hacking Methodology

• Wireless Hacking Methodology

Tools for Wireless Hacking

• WEP/WPA Cracking Tools
• WEP/WPA Cracking Tool for Mobile
• Wi-Fi Sniffer
• Wi-Fi Traffic Analyzer Tools
• Other Wireless Hacking Tools

Bluetooth Hacking

• Bluetooth Stack
• Bluetooth Hacking
• Bluetooth Threats
• How to BlueJack a Victim
• Bluetooth Hacking Tools

Countermeasures

• Wireless Security Layers
• How to Defend Against WPA/WPA2 Cracking
• How to Defend Against KRACK Attacks
• How to Detect and Block Rogue AP
• How to Defend Against Wireless Attacks
• How to Defend Against Bluetooth Hacking

Tools Wireless Security

• Wireless Intrusion Prevention Systems
• Wireless IPS Deployment
• Wi-Fi Security Auditing Tools
• Wi-Fi Intrusion Prevention System
• Wi-Fi Predictive Planning Tools
• Wi-Fi Vulnerability Scanning Tools
• Bluetooth Security Tools
• Wi-Fi Security Tools for Mobile

Wireless Pen Testing

• Wireless Penetration Testing
• Wireless Penetration Testing Framework

Module 17: Hacking Mobile Platforms

Moving ahead, we will learn about Hacking Mobile Platforms; an essential topic for the CEH exam.

Mobile Platform Attack Vectors

• Vulnerable Areas in Mobile Business Environment
• OWASP Top 10 Mobile Risks – 2016
• Anatomy of a Mobile Attack
• How a Hacker Can Profit from Mobile when Successfully Compromised
• Mobile Attack Vectors and Mobile Platform Vulnerabilities
• Security Issues Arising from App Stores
• App Sandboxing Issues
• Mobile Spam
• SMS Phishing Attack (SMiShing) (Targeted Attack Scan)
• Pairing Mobile Devices on Open Bluetooth and Wi-Fi Connections

Hacking Android OS

• Android OS
• Android Rooting
• Blocking Wi-Fi Access using NetCut
• Hacking with zANTI
• Hacking Networks Using Network Spoofer
• Launching DoS Attack using Low Orbit Ion Cannon (LOIC)
• Performing Session Hijacking Using DroidSheep
• Hacking with Orbot Proxy
• Android-based Sniffers
• Android Trojans
• Securing Android Devices
• Android Security Tool: Find My Device
• Android Security Tools
• Android Vulnerability Scanner
• Android Device Tracking Tools

Hacking iOS

• Apple iOS
• Jailbreaking iOS
• iOS Trojans
• Guidelines for Securing iOS Devices
• iOS Device Tracking Tools
• iOS Device Security Tools

Mobile Spyware

• Mobile Spyware
• Mobile Spyware: mSpy
• Mobile Spywares

Mobile Device Management

• Mobile Device Management (MDM)
• Mobile Device Management Solutions
• Bring Your Own Device (BYOD)

Mobile Security Guidelines and Tools

• General Guidelines for Mobile Platform Security
• Mobile Device Security Guidelines for Administrator
• SMS Phishing Countermeasures
• Mobile Protection Tools
• Mobile Anti-Spyware

Mobile Pen Testing

• Android Phone Pen Testing
• iPhone Pen Testing
• Mobile Pen Testing Toolkit: Hackode

Module 18: Basics of IoT Hacking

IoT Concepts

• What is IoT
• How IoT Works
• IoT Architecture
• IoT Application Areas and Devices
• IoT Technologies and Protocols
• IoT Communication Models
• Challenges of IoT
• Threat vs Opportunity

Attacks on IoT

• IoT Security Problems
• OWASP Top 10 IoT Vulnerabilities and Obstacles
• IoT Attack Surface Areas
• IoT Threats
• Hacking IoT Devices: General Scenario
• IoT Attacks
• IoT Attacks in Different Sectors
• Case Study: Dyn Attack

Methodology used for IoT Hacking

• What is IoT Device Hacking?
• IoT Hacking Methodology

Tools used for IoT Hacking

• Information Gathering Tools
• Sniffing Tools
• Vulnerability Scanning Tools
• IoT Hacking Tools

Countermeasures

• How to Defend Against IoT Hacking
• General Guidelines for IoT Device Manufacturing Companies
• OWASP Top 10 IoT Vulnerabilities Solutions
• IoT Framework Security Considerations
• IoT Security Tools

IoT Pen Testing

• IoT Pen Testing

Module 19: Basics of Cloud Computing

Cloud Computing Concepts

• Introduction to Cloud Computing
• Separation of Responsibilities in Cloud
• Cloud Deployment Models
• NIST Cloud Deployment Reference Architecture
• Cloud Computing Benefits
• Understanding Virtualization

Cloud Computing Threats

• Cloud Computing Threats

Cloud Computing Attacks

• Service Hijacking using Social Engineering Attacks
• Service Hijacking using Network Sniffing
• Session Hijacking using XSS Attack
• Session Hijacking using Session Riding
• Domain Name System (DNS) Attacks
• Side-Channel Attacks or Cross-guest VM Breaches
• SQL Injection Attacks
• Cryptanalysis Attacks
• Wrapping Attack
• Denial-of-Service (DoS) and Distributed Denial-of-Service (DDoS) Attacks
• Man-in-the-Cloud Attack

Cloud Security

• Cloud Security Control Layers
• Cloud Security is the Responsibility of both Cloud Provider and Consumer
• Cloud Computing Security Considerations
• Placement of Security Controls in the Cloud
• Best Practices for Securing Cloud
• NIST Recommendations for Cloud Security
• Organization/Provider Cloud Security Compliance Checklist
• Cloud Security Tools
• What is Cloud Pen Testing?
• Key Considerations for Pen Testing in the Cloud
• Cloud Penetration Testing
• Recommendations for Cloud Testing

Module 20: Basics of Cryptography

Cryptography Concepts

• Cryptography
• Government Access to Keys (GAK)

Encryption Algorithms

• Ciphers
• Data Encryption Standard (DES)
• Advanced Encryption Standard (AES)
• RC4, RC5, and RC6 Algorithms
• Twofish
• The DSA and Related Signature Schemes
• Rivest Shamir Adleman (RSA)
• Diffie-Hellman
• Message Digest (One-Way Hash) Functions

Cryptography Tools

• MD5 Hash Calculators
• Hash Calculators for Mobile
• Cryptography Tools
• Cryptography Tools for Mobile

Public Key Infrastructure (PKI)

• Public Key Infrastructure (PKI)

Email Encryption

• Digital Signature
• Secure Sockets Layer (SSL)
• Transport Layer Security (TLS)
• Cryptography Toolkit
• Pretty Good Privacy (PGP)

Disk Encryption

• Disk Encryption
• Disk Encryption Tools

Cryptanalysis

• Cryptanalysis Methods
• Code Breaking Methodologies
• Cryptography Attacks
• Cryptanalysis Tools
• Online MD5 Decryption Tools

Countermeasures

• How to Defend Against Cryptographic Attacks

Ethical Hacking Projects and Case Studies

Threat Detection

You will have the opportunity to participate in a number of cases where you will get first-hand experience as a member of the ethical hacking team. You will assist in anticipating and preventing cybercrimes as well as identifying threats and data breaches.

Cracking Wifi

In this project, you will learn a lot about WiFi cracking. You will use a variety of pertinent tools, technologies, and techniques to crack WiFi. You will learn how to break into different WiFi routers. The WPA/WPA2 are usually used.

Improvement of Auditing in the Restaurant

The project gives you the knowledge you need to learn how to improve any restaurant’s security system as needed. You will primarily employ a variety of techniques, including system resilience and the implementation of KPIs.

Data Security of a BPO Firm

You will understand the BPO firm’s data security. Working with data that has been generated by machines, you will search for irregularities, threats, and other things like suspicious activity. Additionally, the Splunk SIEM tool will be used to manage a sizable database.

Module 01: Attacks, Threats, and Vulnerabilities

• Different types of social engineering techniques
• Potential indicators to determine the type of attack
• Potential indicators associated with network attacks
• Different threat actors, vectors, and intelligence sources
• Security concerns associated with various types of vulnerabilities
• Techniques used in Security Assessments & Penetration testing

Module 1: CISSP Introduction

Overview

Module 2: Security and Risk Management

• Security and risk management
• Information security management
• Security controls
• Information security management and governance
• Goals, missions, and objectives
• Due care
• Security policy
• Compliance
• Cybercrimes
• Legal systems
• Intellectual Property (IP) law
• Privacy
• General data protection regulation
• Security
• Risk analysis and types
• Security control assessment
• Threat modeling
• Supply-chain risk management
• Third-party management
• Business continuity planning and phases
• Personal security management
• Security awareness training
• Program effectiveness evaluation

Module 3: Asset Security

• Information and data classification
• Data life cycle and management
• Different roles
• Data remanence
• Privacy
• Data states
• Data loss prevention

Module 4: Security Engineering

• Security engineering and architecture
• Security models
• Evaluation criteria
• System security
• CPU
• Memory
• Security mode
• Cloud Computing
• IoT
• Industrial control system (ICS)
• Cryptography
• Encryption methods
• DES
• Asymmetric cryptography
• Public key infrastructure
• Cryptanalysis
• Key management
• Critical path analysis
• Site location
• Fire
• HVAC

Module 5: Identity and Access Management

• Identity management
• Biometrics
• Passwords
• Tokens
• Memory cards and smart cards
• Access and authorization
• Identity management implementation
• Kerberos
• Access control types and models
• Access control tools and techniques
• Accountability
• Access control monitoring
• Identity proofing
• Markup languages
• Identity as a Service (IDaaS)

Module 6: Communications and Network Security

• Network architecture and design
• IP addressing
• Network protocols
• Transmission media
• Firewall
• Intrusion detection and prevention system
• Network access control (NAC)
• Content delivery network (CDN)
• Networks
• Software-defined networking (SDN)
• Remote access
• Internet Security Protocol (IPsec)
• Voice Over Internet Protocol (VoIP)
• Phreaking
• Secure access protocols
• Wireless technologies
• Network attacks

Module 7: Security Operations

• Investigation
• Forensic investigation
• Evidence
• Electronic discovery
• Incident management
• Security operations management
• Identity and access management
• Assets
• Malware
• Management
• Recovery and backup
• Disaster recovery
• Perimeter security

Module 8: Security Assessment and Testing

• Security assessment
• Vulnerability assessment
• Penetration testing
• Audits
• Log management
• Synthetic and real transaction
• Testing
• Software testing
• Interface
• Key performance indicators (KPIs)

Module 9: Software Development Security

• Importance of software development security
• Programming concepts
• Systems development life cycle
• Application program interface
• Software security and assurance
• Database and data warehouse environments
• Knowledge management
• Web application environment
• Security threats and attacks

Module 01 – Cloud Concepts, Architecture, and Design

• Security concepts
• Defense in due care, depth, and due diligence
• Security functionalities and controls
• Concepts of Cloud Computing
• Business drivers
• Elasticity, scalability, vendor lock-in, and vendor lock-out
• Advantages of Cloud Computing concepts
• Architecture of cloud reference
• Cloud Computing: Actors and roles
• Categories of cloud service: Infrastructure as a Service (IaaS), Platform as a Service (PaaS), and Software as a Service (SaaS)
• Management of cloud service categories
• Deployment models of cloud: Public cloud, private cloud, hybrid cloud, and community cloud
• Characteristics and models
• Cloud deployment models: Comparison
• Cloud technology roadmap
• Related technologies and the impact
• Key management, cryptography, and other concepts of security
• Access control and IAM
• Data remanence
• Cloud Computing: Threats
• Virtualization
• Secure Cloud Computing: Design principles
• Analysis of costs and benefits
• Cloud service providers: Evaluation
• SOC
• Evaluating IT security
• FIPS

Module 02 – Cloud Data Security

• Life cycle of cloud data: Create, use, store, and share
• Life cycle of cloud data: Archive
• Life cycle of cloud data: Destroy and other key data functions
• Architectures of cloud data storage types: IaaS, PaaS, and SaaS
• Architectures of cloud data storage: Storage types and threats
• Strategies of data security: Encryption challenges, IaaS encryption, encryption of databases, key management, cloud key storage, masking, tokenization, data anonymization, bit splitting, homomorphic encryption, and data loss prevention
• Data classification and discovery technology: Data classification and cloud data challenges
• Jurisdictional data protections for Personally Identifiable Information (PII)
• Privacy acts: GDPR, and policies of data protection
• Privacy acts: HIPAA, FISMA, and SOX
• Jurisdictional data protection for PII: Cloud services responsibilities
• Management of data rights
• Data retention and deletion
• Archiving policies
• Legal hold
• Auditability, accountability, and traceability of data events
• SIEM
• Custody chain
• Nonrepudiation

Module 03 – Cloud Platform and Infrastructure Security

• Components of cloud infrastructure
• Communications and network
• Virtualization and management plane
• Factors impacting data center design
• Physical design: Buy or build, design standards of a data center, uptime institute, tiers, and features of tier
• Considerations of environmental design
• Connectivity
• Resource allocation and hypervisor
• Risks associated using cloud infrastructure
• Policy, general, and virtualization risks
• Cloud-specific and non-cloud-Specific risks, along with legal ones
• Compensating controls and cloud attack vectors
• Designing and planning security controls
• Business continuity plan and disaster recovery
• Disruptive events and BCDR planning factors
• Cloud infrastructure characteristics
• Strategies of BCDR and returning to normal
• Creation of BCDR: Test, revise, and report
• Testing types, availability, uptime, and activity
• Security awareness and training

Module 04 – Cloud Application Security

• Application security: Awareness and advocate training
• Common pitfalls
• Awareness of encryption dependency
• Understanding the Software Development Life Cycle (SDLC) process
• Risks and vulnerabilities
• Threat modeling
• Encryption
• Application virtualization and sandboxing
• Federated identity management
• Authentication of SAML
• Identity and Access Management (IAM) and Multi-factor Authentication (MFA)
• Cloud access security broker
• Security testing of application
• Supply chain management of software

Module 05 – Cloud Security Operations

• Hardware secure configuration: Servers, storage controllers, and virtual switches
• VM tools configuration: Physical infrastructure running
• Configuration of securing the network
• Clustered hosts
• Clustered storage and dynamic optimization
• Patch management and maintenance mode
• Performance monitoring
• Network security controls: Honeypots, layered security, and SIEM
• Log management and orchestration
• Guest OS availability
• Operations management
• Process of risk management: Framing of risks and risk assessment
• Quantitative risk analysis
• Risk monitoring and response
• Preservation and collection of digital evidence
• Communication using relevant parties
• Center of security operations

Module 06 – Legal Risk and Compliance

• Concepts of legislative
• Intellectual property laws
• Agreements and acts
• NERC
• Generally accepted privacy principles (GAPP) and privacy shield
• Data privacy jurisdictional difference
• E-discovery and related terminology
• PII and forensic requirements
• SOC reports, gap analysis, and chain of custody
• Vendor management
• Risk attitude and Cloud Computing policies
• SLA
• Quality of Service (QoS)
• Risk mitigation and risk management metrics
• ISO 28000:2007

CCSP Projects

Cloud System Encryption

You will primarily focus on efficiently analyzing and encrypting various cloud systems. You will be trained to utilize this in your e-commerce website. Various other topics such as encryption and virtualization will be covered.

Cloud Security Updation

You will learn all the aspects of updating the cloud security system. This includes understanding of concepts such as cloud application security, cloud operations and troubleshooting of software-defined networking.

Module 1 – Information System Auditing Process.

In this module of the ISACA CISA certification program, you get to learn more about the concepts like IS Audit Standards, Guidelines, Codes of Ethics Business Processes, Types of Controls, Risk-Based Audit Planning, Types of Audits and Assessments, Audit Project Management, Sampling Methodology, Audit Evidence Collection Techniques, and a lot more.

Module 2 – Governance and Management of IT

In this segment of the ISACA CISA training program, you get to learn more about the ways to identify critical flaws and loopholes in the process. You learn the best enterprise-specific spractices that can help you safeguard the governance of information and associated technologies.

Module 3 – Information Systems Acquisition, Development, and Implementation

This module of the CISA training program helps you get a better knowledge of the concepts like Project Governance and Management, Business Case and Feasibility Analysis, Testing Methodologies Configuration and Release Management, and a lot more

Module 4 – Information Systems Operations and Business Resilience

In this module ISACA CISA certification, you get to learn about Common Technology Components, IT Asset Management, Job Scheduling, Production Process Automation, System Interfaces, End-User Computing, Data Governance, Systems Performance Management, and more.

Module 5 – Protection of Information Assets

In this segment of ISACA CISA certification, you get to learn more about the different aspects of Information Asset Security Frameworks, Standards, and Guidelines Privacy Principles, Physical Access and Environmental Controls, Identity and Access Management, Network and End-Point Security, and more.

Module 1: Information Security Governance.

Part A: Enterprise Governance

• Importance of Information Security Governance
• Organizational Culture
• Legal, Regulatory and Contractual Requirements
• Organizational Structures, Roles and Responsibilities

Part B: Information Security Strategy

• Information Security Strategy Development
• Information Governance Frameworks and Standards
• Strategic Planning

Domain 2: Information Security Risk Management

Part A: Information Risk Assessment

• Emerging Risk and Threat Landscape
• Vulnerability and Control Deficiency Analysis
• Risk Analysis, Evaluation and Assessment

Part B: Information Risk Response

• Risk Treatment/Risk Response Options
• Risk and Control Ownership
• Risk Monitoring and Reporting

Domain 3: Information Security Program

Part A: Information Security Program Development

• Information Security Program Overview
• Information Security Program Resources
• Information Asset Identification and Classification
• Industry Standards and Frameworks for Information Security
• Information Security Policies, Procedures and Guidelines
• Defining an Information Security Program Road Map
• Information Security Program Metrics

Part B: Information Security Program Management

• Information Security Control Design and Selection
• Information Security Control Implementation and Integration
• Information Security Control Testing and Evaluation
• Information Security Awareness and Training
• Integration of the Security Program with IT Operations
• Management of External Services and Relationships
• Information Security Program Communications and Reporting

Domain 4: Incident Management

Part A: Incident Management Readiness

• Incident Management and Incident Response Overview
• Incident Management and Incident Response Plans
• Business Impact Analysis
• Business Continuity Plan
• Disaster Recovery Plan
• Incident Classification/Categorization
• Incident Management Training, Testing and Evaluation

Part B: Incident Management Operations

• Incident Management Tools and Technologies
• Incident Investigation and Evaluation
• Incident Containment Methods
• Incident Response Communications
• Incident Eradication and Recovery
• Post-Incident Review Practices