Chapter 0 Course Introduction 1

0.0 Welcome to CCNA: Cybersecurity Operations 1

0.0.1 Message to the Student 1

Chapter 1 Cybersecurity and the Security Operations Center 5

1.0 Introduction 5

1.1 The Danger 5

1.1.1 War Stories 5

1.1.1.1 Hijacked People 5

1.1.1.2 Ransomed Companies 5

1.1.1.3 Targeted Nations 6

1.1.1.4 Lab - Installing the CyberOps Workstation Virtual Machine 6

1.1.1.5 Lab - Cybersecurity Case Studies 6

1.1.2 Threat Actors 6

1.1.2.1 Amateurs 6

1.1.2.2 Hacktivists 7

1.1.2.3 Financial Gain 7

1.1.2.4 Trade Secrets and Global Politics 7

1.1.2.5 How Secure is the Internet of Things? 7

1.1.2.6 Lab - Learning the Details of Attacks 7

1.1.3 Threat Impact 8

1.1.3.1 PII and PHI 8

1.1.3.2 Lost Competitive Advantage 8

1.1.3.3 Politics and National Security 8

1.1.3.4 Lab - Visualizing the Black Hats 9

1.2 Fighters in the War Against Cybercrime 9

1.2.1 The Modern Security Operations Center 9

1.2.1.1 Elements of a SOC 9

1.2.1.2 People in the SOC 9

1.2.1.3 Process in the SOC 10

1.2.1.4 Technologies in the SOC 10

1.2.1.5 Enterprise and Managed Security 10

1.2.1.6 Security vs. Availability 11

1.2.1.7 Activity - Identify the SOC Terminology 11

1.2.2 Becoming a Defender 11

1.2.2.1 Certifications 11

1.2.2.2 Further Education 12

1.2.2.3 Sources of Career Information 12

1.2.2.4 Getting Experience 13

1.2.2.5 Lab - Becoming a Defender 13

1.3 Summary 13

Chapter 2 Windows Operating System 17

2.0 Introduction 17

2.1 Windows Overview 17

2.1.1 Windows History 17

2.1.1.1 Disk Operating System 17

2.1.1.2 Windows Versions 18

2.1.1.3 Windows GUI 19

2.1.1.4 Operating System Vulnerabilities 19

2.1.2 Windows Architecture and Operations 20

2.1.2.1 Hardware Abstraction Layer 20

2.1.2.2 User Mode and Kernel Mode 21

2.1.2.3 Windows File Systems 21

2.1.2.4 Windows Boot Process 23

2.1.2.5 Windows Startup and Shutdown 24

2.1.2.6 Processes, Threads, and Services 25

2.1.2.7 Memory Allocation and Handles 25

2.1.2.8 The Windows Registry 26

2.1.2.9 Activity - Identify the Windows Registry Hive 27

2.1.2.10 Lab - Exploring Processes, Threads, Handles, and Windows Registry 27

2.2 Windows Administration 27

2.2.1 Windows Configuration and Monitoring 27

2.2.1.1 Run as Administrator 27

2.2.1.2 Local Users and Domains 27

2.2.1.3 CLI and PowerShell 28

2.2.1.4 Windows Management Instrumentation 29

2.2.1.5 The net Command 30

2.2.1.6 Task Manager and Resource Monitor 30

2.2.1.7 Networking 31

2.2.1.8 Accessing Network Resources 33

2.2.1.9 Windows Server 33

2.2.1.10 Lab - Create User Accounts 34

2.2.1.11 Lab - Using Windows PowerShell 34

2.2.1.12 Lab - Windows Task Manager 34

2.2.1.13 Lab - Monitor and Manage System Resources in Windows 34

2.2.2 Windows Security 34

2.2.2.1 The netstat Command 34

2.2.2.2 Event Viewer 35

2.2.2.3 Windows Update Management 35

2.2.2.4 Local Security Policy 35

2.2.2.5 Windows Defender 36

2.2.2.6 Windows Firewall 37

2.2.2.7 Activity - Identify the Windows Command 37

2.2.2.8 Activity - Identify the Windows Tool 37

2.3 Summary 37

Chapter 3 Linux Operating System 41

3.0 Introduction 41

3.1 Linux Overview 41

3.1.1 Linux Basics 41

3.1.1.1 What is Linux? 41

3.1.1.2 The Value of Linux 42

3.1.1.3 Linux in the SOC 42

3.1.1.4 Linux Tools 43

3.1.2 Working in the Linux Shell 43

3.1.2.1 The Linux Shell 43

3.1.2.2 Basic Commands 43

3.1.2.3 File and Directory Commands 44

3.1.2.4 Working with Text Files 44

3.1.2.5 The Importance of Text Files in Linux 44

3.1.2.6 Lab - Working with Text Files in the CLI 45

3.1.2.7 Lab - Getting Familiar with the Linux Shell 45

3.1.3 Linux Servers and Clients 45

3.1.3.1 An Introduction to Client-Server Communications 45

3.1.3.2 Servers, Services, and Their Ports 45

3.1.3.3 Clients 45

3.1.3.4 Lab - Linux Servers 45

3.2 Linux Administration 46

3.2.1 Basic Server Administration 46

3.2.1.1 Service Configuration Files 46

3.2.1.2 Hardening Devices 46

3.2.1.3 Monitoring Service Logs 47

3.2.1.4 Lab - Locating Log Files 48

3.2.2 The Linux File System 48

3.2.2.1 The File System Types in Linux 48

3.2.2.2 Linux Roles and File Permissions 49

3.2.2.3 Hard Links and Symbolic Links 50

3.2.2.4 Lab - Navigating the Linux Filesystem and Permission Settings 50

3.3 Linux Hosts 51

3.3.1 Working with the Linux GUI 51

3.3.1.1 X Window System 51

3.3.1.2 The Linux GUI 51

3.3.2 Working on a Linux Host 52

3.3.2.1 Installing and Running Applications on a Linux Host 52

3.3.2.2 Keeping the System Up To Date 52

3.3.2.3 Processes and Forks 52

3.3.2.4 Malware on a Linux Host 53

3.3.2.5 Rootkit Check 54

3.3.2.6 Piping Commands 54

3.3.2.7 Video Demonstration - Applications, Rootkits, and Piping Commands 55

3.4 Summary 55

Chapter 4 Network Protocols and Services 59

4.0 Introduction 59

4.1 Network Protocols 59

4.1.1 Network Communications Process 59

4.1.1.1 Views of the Network 59

4.1.1.2 Client-Server Communications 60

4.1.1.3 A Typical Session: Student 60

4.1.1.4 A Typical Session: Gamer 61

4.1.1.5 A Typical Session: Surgeon 61

4.1.1.6 Tracing the Path 62

4.1.1.7 Lab - Tracing a Route 62

4.1.2 Communications Protocols 62

4.1.2.1 What are Protocols? 62

4.1.2.2 Network Protocol Suites 63

4.1.2.3 The TCP/IP Protocol Suite 63

4.1.2.4 Format, Size, and Timing 64

4.1.2.5 Unicast, Multicast, and Broadcast 64

4.1.2.6 Reference Models 65

4.1.2.7 Three Addresses 65

4.1.2.8 Encapsulation 65

4.1.2.9 Scenario: Sending and Receiving a Web Page 66

4.1.2.10 Lab - Introduction to Wireshark 67

4.2 Ethernet and Internet Protocol (IP) 67

4.2.1 Ethernet 67

4.2.1.1 The Ethernet Protocol 67

4.2.1.2 The Ethernet Frame 68

4.2.1.3 MAC Address Format 68

4.2.1.4 Activity - Ethernet Frame Fields 68

4.2.2 IPv4 68

4.2.2.1 IPv4 Encapsulation 68

4.2.2.2 IPv4 Characteristics 69

4.2.2.3 Activity - IPv4 Characteristics 70

4.2.2.4 The IPv4 Packet 70

4.2.2.5 Video Demonstration - Sample IPv4 Headers in Wireshark 70

4.2.3 IPv4 Addressing Basics 70

4.2.3.1 IPv4 Address Notation 70

4.2.3.2 IPv4 Host Address Structure 70

4.2.3.3 IPv4 Subnet Mask and Network Address 71

4.2.3.4 Subnetting Broadcast Domains 71

4.2.3.5 Video Demonstration - Network, Host, and Broadcast Addresses 72

4.2.4 Types of IPv4 Addresses 72

4.2.4.1 IPv4 Address Classes and Default Subnet Masks 72

4.2.4.2 Reserved Private Addresses 73

4.2.5 The Default Gateway 73

4.2.5.1 Host Forwarding Decision 73

4.2.5.2 Default Gateway 74

4.2.5.3 Using the Default Gateway 74

4.2.6 IPv6 75

4.2.6.1 Need for IPv6 75

4.2.6.2 IPv6 Size and Representation 75

4.2.6.3 IPv6 Address Formatting 75

4.2.6.4 IPv6 Prefix Length 76

4.2.6.5 Activity - IPv6 Address Notation 76

4.2.6.6 Video Tutorial - Layer 2 and Layer 3 Addressing 76

4.3 Connectivity Verification 76

4.3.1 ICMP 76

4.3.1.1 ICMPv4 Messages 76

4.3.1.2 ICMPv6 RS and RA Messages 77

4.3.2 Ping and Traceroute Utilities 78

4.3.2.1 Ping - Testing the Local Stack 78

4.3.2.2 Ping - Testing Connectivity to the Local LAN 79

4.3.2.3 Ping - Testing Connectivity to Remote Host 79

4.3.2.4 Traceroute - Testing the Path 80

4.3.2.5 ICMP Packet Format 80

4.4 Address Resolution Protocol 81

4.4.1 MAC and IP 81

4.4.1.1 Destination on Same Network 81

4.4.1.2 Destination on Remote Network 82

4.4.2 ARP 82

4.4.2.1 Introduction to ARP 82

4.4.2.2 ARP Functions 82

4.4.2.3 Video - ARP Operation - ARP Request 83

4.4.2.4 Video - ARP Operation - ARP Reply 84

4.4.2.5 Video - ARP Role in Remote Communication 84

4.4.2.6 Removing Entries from an ARP Table 85

4.4.2.7 ARP Tables on Networking Devices 85

4.4.2.8 Lab - Using Wireshark to Examine Ethernet Frames 85

4.4.3 ARP Issues 85

4.4.3.1 ARP Broadcasts 85

4.4.3.2 ARP Spoofing 86

4.5 The Transport Layer 86

4.5.1 Transport Layer Characteristics 86

4.5.1.1 Transport Layer Protocol Role in Network Communication 86

4.5.1.2 Transport Layer Mechanisms 87

4.5.1.3 TCP Local and Remote Ports 87

4.5.1.4 Socket Pairs 88

4.5.1.5 TCP vs UDP 88

4.5.1.6 TCP and UDP Headers 89

4.5.1.7 Activity - Compare TCP and UDP Characteristics 90

4.5.2 Transport Layer Operation 90

4.5.2.1 TCP Port Allocation 90

4.5.2.2 A TCP Session Part I: Connection Establishment and Termination 91

4.5.2.3 Video Demonstration - TCP 3-Way Handshake 92

4.5.2.4 Lab - Using Wireshark to Observe the TCP 3-Way Handshake 92

4.5.2.5 Activity - TCP Connection and Termination Process 92

4.5.2.6 A TCP Session Part II: Data Transfer 92

4.5.2.7 Video Demonstration - Sequence Numbers and Acknowledgments 94

4.5.2.8 Video Demonstration - Data Loss and Retransmission 94

4.5.2.9 A UDP Session 94

4.5.2.10 Lab - Exploring Nmap 95

4.6 Network Services 95