As you are reading this document, more than 100 successful hacking has occurred in the world per minute. With all the news stories about hackers, botnets, and breaches involving personal information, it's easy for the security message to sound over-used and tired. It's easy for people to say, "It won't happen here."

Currently, Security Operation Centre (SOC) Analyst role is being only used in Security Operation Centers (SOC) that are monitoring financial institutions. Instead, we can upscale every IT person in an organization by equipping them with the skillset of a SOC Analyst so that they have the ability to review logs and identify attacks that are happening in their own organization and enable their organization to respond to them effectively.

 

1. Gain in-depth knowledge of security threats, attacks, vulnerabilities, attacker’s behaviors, cyber kill chain, SOC processes, procedures, technologies, and automation workflows.
2. Understand the MITRE ATT&CK Framework and Able to identify attacker techniques, tactics, and procedures (TTP) to investigate on indicators of compromise (IOCs) and provide automated / manual responses to eliminate the attack/incident.
3. Understand SOC and its processes, roles, responsibilities and implementation models.
4. Able to monitor and work on alerts generated based on various log sources. Ex: IDS/IPS, AV, EDR, Firewall, Network Monitoring applications, etc.
5. Gain in-depth knowledge on all the latest defense technologies that are used in next generation SOC deployments. Ex : NGAV, SIEM, EDR, SOAR, TI, UEBA, IAM/PAM, etc.
6. Gain knowledge of Incident Response Methodology, processes and in-depth knowledge on how to integrate SOC processes with Incident Response processes and learn how to automate them as a single workflow.
7. Able to understand the concepts of Threat Intelligence and gain in-depth knowledge on how to integrate Threat Intelligence with the SIEM, SOAR, EDR and other SOC technologies to reduce the Mean time to Detect (MTTD) and Mean time to Respond (MTTR).

Module 1: Introduction to Cybersecurity & Latest Attack Trends

1. What is Security, Vulnerabilities & O-Days, Attack life Cycle, Different Attack Vectors
2. Threats Vs. Risks, Why Perimeter defenses are failing? Why Anti-Virus is not enough?
3. Financial Implications of a Cyber Attack
4. Business Email Compromise (BEC) (Demo)
5. Ransomware (Demo)
6. Advanced Persistent Threat (Demo)
7. File-less Malwares (Demo)
8. Mobile Malwares (Demo)
9. Identity Theft (Demo)
10. Web Data Breach (Demo)
11. Malvertising (Demo)
12. Payment Gateway based attacks (Demo)
13. Social Media based attacks (Demo)
14. Password based attacks (Password Stuffing,
15. Account Takeover, Phishing, etc) (Demo)
16. State sponsored attacks (Case Study)
17. Distributed Denial of Service (Case Study)
18. Insider Threat (Case Study)

Module 2: Security Operations Center (SOC) – Introduction

1. What is a Security Operations Center and why we need it ?
2. NOC vs. SOC
3. Overview of Continuous Adaptive Risk and Trust Assessment (CARTA)
4. SOC v1.0 vs SOC v2.0
5. SOC v2.0 : Components
6. Security Operations Center roles and responsibilities
7. SOC team roles and responsibilities
8. Challenges of Security Operations Center
9. Measuring the ROI of Security Operations Center

Module 3 : Understanding Attack DNA

1. What is MITRE ATT&CK Framework?
2. Tactics, Techniques and Procedures (TTP)
3. Indicators of Compromise (IoC) and Indicators of Attack (IoA)
4. Mapping to ATT&CK from Raw Data – Lab

Module 4 : Latest Cybersecurity Defence Technologies

1. Anti-Virus & Next Generation Anti-Virus (NGAV)
   • How it works and Where is the Gap ?
   • Deep Learning & Machine Learning & Artificial Intelligence
   • Cybersecurity use cases
2. Security Information and Event Management (SIEM)
   • How it Works ?
   • Understanding Logs & Log Correlation
   • SIEM Deployment options
   • Application Level Incident Detection Use Case Examples
   • Network Incident Detection Use Case Examples
   • Host Malware Incident Detection Use Case Examples
   • Understanding why SIEM is not enough and why Noise/False
   • Positives ?
   • Lab / Demo
3. Endpoint Detection and Response (EDR)
   • How it Works ?
   • EDR vs. NGAV
   • Understanding Memory and Process Detection & Mapping
   • What is Managed Detection and Response
   • Understanding various Response actions
   • Lab / Demo
4. Security Orchestration, Automation and Response (SOAR)
   • Alert / Notification Handling Challenges
   • Why SOAR ?
   • Sample Automated Playbooks
   • Lab / Demo
5. Cyber Range
   • Cyber Range Components
   • Cyber Range Simulation Scenarios
6. Data Leakage Prevention (DLP)
7. User Behavior Analytics
8. Identity Management
9. Virtual Dispersive Networking (VDN)

Module 5 : Cybersecurity Incident Response

1. Introduction to Incident Response
   • Types of Computer Security Incidents
   • Fingerprint of an Incident
   • Incident Categories & Incident Prioritization
   • Why Incident Response?
2. Incident Reporting
   • Incident Response & Handling Methodology
   • Incident Response Plan
   • Incident Response and Handling:
     
     Identification, Incident Recording, Initial Response, Communicating the Incident, Containment, Formulating a Response Strategy, Incident Classification, Incident Investigation, Data Collection, Forensic Analysis, Evidence Protection, Systems Recovery, Incident Documentation, Incident Damage and Cost Assessment, Review and Update the Response Plan and Policies
      
   • Incident Response Checklist and Best Practices
   • CSIRT & its best practices
   • Incident Response Team
   • Incident Tracking and Reporting
   • Incident handling : Real Word examples and exercises on
3. Malware, Web Application attacks, Email attacks and Insider attacks.

Module 6 : Threat Intelligence & Threat Hunting

1. Introduction to Threat Intelligence
   • Understanding Threats, Threat Modeling and Risk
   • What is Threat Intelligence
   • Need for Threat Intelligence
   • Benefits of Threat Intelligence
   • Types of Threat Intelligence
   • Threat Intelligence Life Cycle
   • Sources of Threat Intelligence
   • Technologies contributing to Threat Intelligence (SIEM, EDR, Log Sources)
   • Incident Response & Threat Intelligence
   • Applications of Threat Intelligence
   • Threat Intelligence Frameworks (CIF, MISP, TAXII)
   • Role of Threat Intelligence Analyst & Threat Hunters
2. Role of Threat Intelligence in SOC operations
   • Setting up Threat Intel Framework
   • Enterprise Threat Landscape Mapping
   • Scope & Plan Threat Intel Program
   • Setup Threat Intel Team
   • Threat Intelligence Feeds, Sources & Data Collections
   • Open source Threat Intel Collections (OSINT and more)
   • Dark Web Threat Intel Collections
   • SIEM / Log Sources Threat Intel Collections
   • Pubic Web data Threat Intel Collections (Maltego, OSTrICa, and more)
   • Threat Intel collections with YARA
   • EDR Threat Intel Collections
   • Incorporating Threat Intel into Incident Response
   • Threat Intel & Actionable Contextual Data
3. MISP Lab

Mr. Clement Arul
Chief Executive Officer
Cybertronium Sdn Bhd
 

• Clement is a two-time recipient of Cyber Security Professional of the Year in 2017 and 2014 as well as a three-time Regional Award winner of Cyber Security Professional of the Year Asia and APAC in 2020, 2019 and 2017.
• A Principal Technology Architect, Security Professional and an Evangelist with Twenty Two (22) years of IT experience in Cyber Security, Ethical Hacking, Cyber Security Framework, Security Risk & Governance, Big Data, IoT, Systems Analysis, Design, Development, Secure Coding, Implementation, Digital Forensics and Project Management.
• Founder and CEO of Kaapagam Technologies Sdn. Bhd. and Kaapagam Education Services Sdn. Bhd. Also, Founder and Chief Technology Officer of Vigilant Asia (M) Sdn. Bhd.
• He has contributed to National Cyber Security Framework and many more national initiatives and now working with few ASEAN governments in developing and implementing National Cyber Security Frameworks. He was also part of the Secure Implementation of Nigerian ID system Project in 2019 as the prime security expert consultant.
• Presented in more than 120 public conferences and Talks in last Year and more than 600+ in last 5 Years across ASEAN
• Chief Architect for KALAM – IT Security Collaboration Platform : An MOHE Award Winning Platform
• Chief Architect for VALARI : Common Criteria Certified (the only) Malaysian Web Application Firewall
• Chief Architect for SOC 2.0 – A Regional Managed Detection and Response Platform for SME
• Security Consultant for many Multi-National and Leading IT Companies and Agencies in ASEAN Region
• Specializes in Payment Gateway Hacking, Application Security & Penetration Testing, Big Data & IoT Security.
• Issued 100+ Web Vulnerability Disclosure Documents in last 4 years on Vulnerabilities discovered in Government, Corporate, Banks, Online Payment Gateways and e-Shopping websites in ASEAN.
• Provide Penetration Testing, Vulnerability Assessments, Security Consultations, Security Frameworks, Disaster Recovery & Business Continuity, and Security Audit Services for Customers in APAC Region.
• Conduct Workshops across ASEAN region on Penetration Test, Mobile Security, IoT Security, Forensics Investigations, Secure Programming, Disaster Recovery, Incident Handling, Business Data Analytics, and many more.
• Created a Security Awareness Certification under KALAM and have trained and certified 5300 people across ASEAN including Singapore, Malaysia, Laos, Cambodia, Indonesia in the last year.
• Delivered Security Awareness Talk on Social Media & Cyber Attacks & Defences for public in THR Raaga Malaysia FM Radio: For the entire Nation
• Delivered 13 capsules (days) on various cyber security awareness topics and DO's and Dont's for general public : Nationwide Indian Audience on ASTRO Malaysia Vanavil TV.

The CSOC examination is certified by the Global ACE Certification. The examination framework is designed to align with a set of relevant Knowledge, Skills and Attitudes (KSA) that are necessary for a Secure Application Professional. Candidates will be tested via a combination of either continual assessment (CA), multiple choice (MC), theory/underpinning knowledge assessment (UK), practical assessment (PA), assignments (AS) and case studies (CS) as required.

Candidates can take the examination at authorized examination centres in participating member countries. Candidates who have successfully passed the CSOC examination will be eligible to apply as an associate or professional member by fulfilling the membership criteria defined under the Global ACE Certification.

Click here to register for certified examination

 

• 6 - 10 March 2023
• 12 - 16 June 2023
• 4 - 8 September 2023
• 16 - 20 October 2023

*dates are tentative, unless specified

 

Training Fee: MYR6,300.00
Exam Fee: MYR1,255.80
(subject to 6% SST)

Please click here to register

Contact us to request for a quotation

30 CPD Point

Please submit the Certificate of Completion to Global ACE Certification at www.globalace.org

Click here to download brochure