Cyber Security: First Responder

INTRODUCTION

The CyberSec First Responder (CFR) training course is designed to cover network defence and incident response methods, tactics, and procedures aligned with industry frameworks such as NIST 800-61r2 (Computer Security Incident Handling Guide), US-CERT's National Cyber Incident Response Plan (NCIRP), and Presidential Policy Directive (PPD)-41 on Cyber Incident Coordination, NIST 800.171r2 (Protecting Controlled Unclassified Information in Nonfederal Systems and Organisations). It is ideal for individuals responsible for monitoring and detecting security incidents in information systems and networks, as well as for executing standardised responses to such incidents. The course introduces tools, tactics, and procedures to manage cybersecurity risks, defend cybersecurity assets, identify various types of common threats, evaluate the organisation's security, collect and analyse cybersecurity intelligence, and remediate and report incidents as they occur. This comprehensive methodology equips individuals with the skills to effectively defend their organisation's cybersecurity.

This training course is designed to assist students in preparing for the CertNexus CyberSec First Responder (Exam CFR-410) certification examination. The knowledge and practices acquired in this training course are a significant part of the certification preparation.

Specific prerequisites are mandatory to ensure success in this course. The program prerequisites can be accessed and viewed by visiting the following hyperlinked file: CFR Prerequisites, and CertNexus Exam Blueprints.

TRAINING OBJECTIVES

In this training course, you will:

• Assess cybersecurity risks to the organisation.

• Analyse the threat landscape.

• Analyse various reconnaissance threats to computing and network environments.

• Analyse various attacks on computing and network environments.

• Analyse various post-attack techniques.

• Assess the organisation's security posture through auditing, vulnerability management, and penetration testing.

• Collect cybersecurity intelligence from various network-based and host-based sources.

• Analyse log data to reveal evidence of threats and incidents.

• Perform active asset and network analysis to detect incidents.

• Respond to cybersecurity incidents using containment, mitigation, and recovery tactics.

• Investigate cybersecurity incidents using forensic analysis techniques.

WHO SHOULD ATTEND?

This course is primarily designed for cybersecurity practitioners preparing for or currently performing job functions related to protecting information systems by ensuring their availability, integrity, authentication, confidentiality, and non-repudiation. It is ideal for those in federal contracting companies and private sector firms whose missions or strategic objectives require the execution of Defensive Cyber Operations (DCO) or DoD Information Network (DoDIN) operation and incident handling. The course focuses on the knowledge, ability, and skills necessary to provide defence for information systems in a cybersecurity context, including protection, detection, analysis, investigation, and response processes.

Additionally, the course ensures that all members of an IT team—regardless of size, rank, or budget—understand their role in the cyber defense, incident response, and incident handling process.

TRAINING OUTLINE

Day One: Assessing Cybersecurity Risk

• Identify the Importance of Risk Management

• Assess Risk

• Mitigate Risk

• Integrate Documentation into Risk Management

Day Two: Analysing the Threat Landscape

• Classify Threats

• Analyse Trends Affecting Security Posture

Day Three: Analysing Reconnaissance Threats to Computing and Network Environments

• Implement Threat Modelling

• Assess the Impact of Reconnaissance

• Assess the Impact of Social Engineering

Day Four: Analysing Attacks on Computing and Network Environments

• Assess the Impact of System Hacking Attacks

• Assess the Impact of Web-Based Attacks

• Assess the Impact of Malware

• Assess the Impact of Hijacking and Impersonation Attacks

• Assess the Impact of DoS Incidents

• Assess the Impact of Threats to Mobile Security

• Assess the Impact of Threats to Cloud Security

Day Five: Analysing Post-Attack Techniques

• Assess Command and Control Techniques

• Assess Persistence Techniques

• Assess Lateral Movement and Pivoting Techniques

• Assess Data Exfiltration Techniques

• Assess Anti-Forensics Techniques

• Assessing the Organisation's Security Posture

• Implement Cybersecurity Auditing

• Implement a Vulnerability Management Plan

• Assess Vulnerabilities

• Conduct Penetration Testing

Format: On-site and Online

Language(s): English and Arabic 

Duration: One Week

Certificate of Completion: Upon successful completion of the program, participants will receive an Al-Majd Pathways Centre (APC) Certificate of Completion.