Objectives of the training
To provide the knowledge and skills required to identify the various types of intrusions and attacks on TCP/IP networks as well as the mechanisms which can be used to detect them, and to choose among the available detection tools.Targeted audience
Network specialists (other than DBAs) .Prerequisite
Knowledge of TCP/IP (Course RE102).Trainers
Course architecture
- Uses of intrusion detection systems
- Common security threats: examples and characteristics of certain attacks
- Security problems with TCP/IP: fragmentation, ICMP, OS fingerprinting, DNS, denial of service, etc.
- Principles of vulnerability identification, presentation of tools for detecting intrusions and analyzing vulnerability: commercial and free software, and examples of use (TCPdump, Wireshark, Snort 2.9.X, Kali, Nessus, DenyAll and Nikto)
- Architecture of an intrusion detection system: IDS vs. IPS, physical and logical location in the network, system disturbance analysis and system abuse detection, alarms, logging, link with the security gateway (Firewall)
- Errors to avoid, false positives and false negatives
- Securing servers and workstations
- Trace analysis
- Autopsies (Forensic)
- Managing security incidents: preparing an action plan for handling intrusions
- Administering an intrusion detection system
- Trace analysis case studies and exercises.
Private or personalized training
Do you have several employees interested in the same training course? Whether in person at your offices or remotely in virtual mode, we offer private training courses tailored to your team's needs. Group rates are available. Contact us for more details or request a quote online.
Request a quotePrivate or personalized training
Do you have several employees interested in the same training course? Whether in person at your offices or remotely in virtual mode, we offer private training courses tailored to your team's needs. Group rates are available. Contact us for more details or request a quote online.
Request a quote