CND: Certified Network Defender

Course Information

Course Name

CND: Certified Network Defender

Exam code

312-38

Duration

5 Days

Certification

Certified Network Defender (CND)

Overview

Certified Network Defender (C|ND) is an essential vendor-neutral network security certification for every IT and systems administrator who needs to operate with a secure mindset.

Students will learn the critical skills required to defend their networks and operating environments across local networks, endpoints, cloud infrastructure, applications, OT, and mobile. They will also acquire knowledge of effective proper log analysis, network traffic monitoring, basic investigation and response, as well as business continuity and disaster recovery. Additionally, they will dive into threats, analyzing the attack surface, and studying threat prediction and threat intelligence as it relates to their administration and defense responsibilities.

Often referred to as blue-teaming, C|NDS will be able to apply defense and countermeasure strategies in their organizations, playing a critical role not only in attack prevention but also in detection, response, and remediation as they configure networks and systems to operate securely. The C|ND program will cover the concepts and fortify skills through hands-on practice across over 100+ labs delivered on live target machines.

The C|ND program designed by industry experts prepares network defenders with strategic, technological, and operational network security capabilities, enabling them to design, develop, and maintain secure networks.

Certified Network Defender (C|ND) program, a network security course is a pathway to start your career in cybersecurity and in blue team. C|ND’s network security course stands out from other networking programs as it offers a comprehensive approach that extends beyond networking skills and builds robust networking security skills.

Audience Profile

C|ND is a network security C|ND certification designed to help organizations create and deploy the most comprehensive network security system. C|ND certification is mapped to the below job roles based on common job role frameworks recognized by organizations worldwide.

• Network Administrators

• Network Security Administrators

• Network Engineer

• Security Analyst

• Network Security Engineer

• Network Security Analyst

• Cybersecurity Engineer

Prerequisites

At Course Completion

1. Planning and administering network security for organizations

2. Recognizing security risks, threats, and vulnerabilities

3. Ensuring compliance with regulatory standards

4. Designing and implementing network security policies

5. Applying security principles in distributed and mobile computing environments

6. Implementing Identity and Access Management, encryption, and network segmentation

7. Managing Windows and Linux Security Administration

8. Addressing security risks in mobile devices and lot

9. Implementing strong data security techniques

10. Managing security in virtualization technologies and cloud platforms

11. Implementing wireless network security

12. Conducting risk and vulnerability assessments

13. Providing first response to security incidents

14. Identifying Indicators of Compromise and Attack

15. Integrating threat intelligence for proactive defense

16. Conducting Attack Surface Analysis

17. Assisting in Business Continuity and Disaster Recovery planning

18. Monitoring network traffic and performing log management

19. Managing proxy, content filtering, and troubleshooting network issues

20. Hardening security of endpoints and selecting firewall solutions

21. Configuring IDS/IPS for enhanced security

22. Maintaining an inventory of network devices

23. Providing security awareness guidance and training

24. Managing AAA for network devices

25. Reviewing audit logs and analyzing security anomalies

26. Maintaining and configuring security platforms

27. Evaluating security products and operations procedures

28. Identifying and classifying organizational assets

29. Implementing system integrity monitoring tools

30. Understanding EDR/XDR and UEBA solutions

31. Conducting PIA processes for privacy assessment

32. Collaborating on threat hunting and incident response

33. Understanding SOAR platforms in cybersecurity operations

34. Integrating Zero Trust principles into security architectures

35. Staying updated on emerging cyber threats

36. Understanding the role of AI/ML in cyber defense.

Course Outline

Module 1: Network Attacks and Defense Strategies

This module covers mechanisms of various attack techniques and hacking methodologies that attackers use to breach the security of an organization’s networks.

It also introduces defense strategies that network defenders should adopt to ensure comprehensive network security. Key topics covered: Attack, threat, threats sources, threat actors, vulnerability, risk, network attacks, application attacks, social engineering attacks, email attacks, mobile attacks, cloud attacks, supply chain attacks, wireless attacks, hacking methodologies and frameworks, adaptive security strategy, and defense-in-depth security.

The hands-on lab exercises in this module help to understand the modus operandi of different attacks at network, application, and host levels.

Module 2: Administrative Network Security

This module covers administrative security measures, including compliance efforts, creating and enforcing security policies, security awareness training, asset management, etc.

Key topics covered: Compliance, regulatory frameworks, security policies, security awareness, asset management, and recent cybersecurity trends.

The hands-on lab exercises in this module help to demonstrate skills in security policy implementation, asset management, employee monitoring, etc.

Module 3: Technical Network Security

This module covers the technical aspects of network security. It describes the concepts of access control, Identity and Access Management (IAM), cryptographic security techniques, and various network security devices and protocols.

Key topics covered: Access controls, Authentication, Authorization, and Accounting (AAA), IAM, cryptography, network segmentation, zero trust, network security controls, and network security protocols.

The hands-on lab exercises in this module help demonstrate skills in implementing access controls, VPN, etc.

Module 4: Network Perimeter Security

This module covers the security configuration of network perimeter devices such as firewalls, intrusion detection and intrusion protection systems (IDSS/IPSs), routers, switches, etc., for effective perimeter protection.

Key topics covered: Firewalls, firewall types, firewall topologies, firewall selection, firewall implementation and deployment, firewall administration, IDS/IPS, IDS/IPS classification, IDS/IPS selection, false positives, false negatives, router security, switch security, software-defined perimeter (SDP).

The hands-on lab exercises in this module help to demonstrate skills in perimeter security, which includes how to configure and implement firewalls and IDS/IPS with the help of well-known tools such as pfSense, Smoothwall, Windows Firewall, iptables, Suricata, Wazuh, ModSecurity, etc.

Module 5: Endpoint Security – Windows Systems

This module covers various security features and secure configuration techniques used to secure Windows systems.

Key topics covered: Windows security risks, Windows security components, Windows security features, Windows security baseline configurations, user account and password management, Windows patch management, Windows user access management, active directory security, Windows network services and protocol security, and Windows security best practices.

The hands-on lab exercises in this module help demonstrate Windows security skills, including but not limited to Windows patch management, Windows file integrity, Windows endpoint protection, Windows security configuration baseline, active directory security, security troubleshooting, permissions, etc.

Module 6: Endpoint Security – Linux Systems

This module covers the Linux OS, its security features, and the various techniques to harden the OS security.

Key topics covered: Linux security risks, Linux installation and patching, Linux user access and password management, Linux OS hardening techniques, Linux network and remote access security, and Linux security tools and frameworks.

The hands-on lab exercises in this module help demonstrate skills in Linux security, including but not limited to system hardening, system security auditing, file integrity monitoring, permissions, access controls, etc.

Module 7: Endpoint Security – Mobile Devices

This module covers securing the use of mobile devices under various mobile usage policies implemented and enforced in enterprises.

Key topics covered: Bring Your Own Device (BYOD), Choose Your Own Device (CYOD), Corporate Owned, Personally Enabled (COPE), Company Owned, Business Only (COBO), Mobile Device

Management (MDM), Mobile Application Management (MAM), Mobile Threat Defense (MTD), Unified Endpoint Management (UEM), Mobile Email Management (MEM), Mobile Content Management (MCM), Enterprise Mobility Management (EMM), mobile device security, android security, and iPhone security.

The hands-on lab exercises in this module help demonstrate skills in implementing MDM solutions and various mobile security measures.

Module 8: Endpoint Security – IoT Devices

This module covers the use of loT devices, the associated security challenges and risks, as well as appropriate security measures implemented to secure loT-enabled environments.

Key topics covered: IoT devices, loT application areas, loT ecosystem, loT communication models, loT-enabled environments, loT security risk and challenges, lot security in IoT-enabled IT environments, loT security tools, loT security best practices, loT security standards, initiatives, and efforts.

The hands-on lab exercises in this module help demonstrate skills to secure loT device communication.

Module 9: Administrative Application Security

This module covers various application security measures implemented to monitor, patch, and upgrade the installed applications constantly.

Key topics covered: Application whitelisting, application blacklisting, application sandboxing, application patch management, and web application firewalls (WAFs).

The hands-on lab exercises in this module help demonstrate skills in application whitelisting, application sandboxing, WAF, etc.

Module 10: Data Security

This module covers various security measures implemented to secure an organization’s data from prying eyes.

Key topics covered: Data security, data encryption data at rest, data encryption at transit, data masking, data backup, data retention, data destruction, data loss prevention (DLP), and data integrity.

The hands-on lab exercises in this module help demonstrate skills in data encryption at rest, data encryption at transit, database encryption, email encryption, data backup, data recovery, disk encryption, etc.

Module 11: Enterprise Virtual Network Security

This module covers virtualization concepts and technologies such as network virtualization, software-defined network, and network function virtualization and their security.

Key topics covered: Network virtualization (NV), software-defined network (SDN), network function virtualization (NFV) security, OS virtualization security, container security, docker security, and Kubernetes security.

The hands-on lab exercises in this module help demonstrate skills in docker security audit, SDN communication security, Kubernetes security, etc.

Module 12: Enterprise Cloud Security

This module covers the various aspects of enterprise cloud security that are important for an organization to securely store or process data on the cloud.

Key topics covered: Cloud Computing, cloud security, shared responsibility model, Amazon Cloud (AWS) Security, Microsoft Azure cloud security, and Google Cloud Platform (GCP) security.

The hands-on lab exercises in this module help demonstrate skills in AWS IAM, AWS KMS, AWS Storage, Azure MFA, GCP IAM, Azure Resource locking, and GCP Cloud IAP.

Module 13: Enterprise Wireless Network Security

This module covers various security measures and best practices used to secure wireless networks in enterprises.

Key topics covered: Wireless network, wireless standards, wireless topologies, wireless network components, wireless network

encryption, wireless network authentication, wireless network security measures, and Wi-Fi security tools.

The hands-on lab exercises in this module help demonstrate skills in wireless router security.

Module 14: Network Traffic Monitoring and Analysis

This module covers threat, bandwidth, and performance monitoring with the help of network traffic monitoring and analysis.

Key topics covered: Network traffic monitoring, baseline traffic signatures, suspicious network traffic signatures, threat detection with Wireshark, bandwidth monitoring, performance monitoring, network anomaly detection, and behavior analysis.

The hands-on lab exercises in this module help demonstrate skills in packet capturing, traffic monitoring, traffic analysis, threat detection, and bandwidth monitoring with tools such as Wireshark, tcpdump, PRTG, Capsa, NTOP, etc.

Module 15: Network Logs Monitoring and Analysis

This module covers threat detection with the help of log monitoring and analysis.

Key topics covered: Logs, Windows log analysis, Linux log analysis, Mac log analysis, firewall log analysis, router log analysis, web server log analysis, and centralized log management.

The hands-on lab exercises in this module help demonstrate skills in configuring, viewing, and analyzing logs in a local as well as a centralized location.

Module 16: Incident Response and Forensics Investigation

This module covers the role of incident response and forensic investigation in an organization’s security.

Key topics covered: First responder, incident handling and response process, SOAR, endpoint detection and response (EDR), extended detection and response (XDR), and forensics investigation.

The hands-on lab exercises in this module help demonstrate skills in incident ticketing, reporting, and escalations with OSSIM.

Module 17: Business Continuity and Disaster Recovery

This module covers concepts around business continuity and disaster recovery.

Key topics covered: Business Continuity (BC), Disaster Recovery (DR), Business Continuity Management (BCM), BC/DR Activities, Business Impact Analysis (BIA), Recovery Time Objective (RTO), Recovery Point Objective (RPO), Business Continuity Plan (BCP), and Disaster Recovery Plan (DRP).

The hands-on lab exercises in this module help demonstrate skills in implementing business continuity and disaster recovery scenarios with NLB.

Module 18: Risk Anticipation with Risk Management

This module covers various phases in implementing and executing an organization’s risk management program.

Key topics covered: Risk management, risk identification, risk assessment, risk treatment, risk treatment steps, risk tracking and review, risk management frameworks (RMFs), vulnerability management, vulnerability scanning, vulnerability reporting, and privacy impact assessment (PIA).

The hands-on lab exercises in this module help demonstrate skills in network security audit, vulnerability management, application vulnerability scanning, and analysis.

Module 19: Threat Assessment with Attack Surface Analysis

This module covers concepts around visualizing, analyzing, and reducing the attack surface.

Key topics covered: Attack surface, attack surface analysis, system attack surface, network attack surface, software attack surface, physical attack surface, human attack surface, Indicators of Exposures (loEs), attack simulation, attack surface reduction, attack surface monitoring tools, and cloud and lot attack surface analysis.

The hands-on lab exercises in this module help demonstrate skills in system attack surface analysis, application attack surface analysis, attack surface mapping, etc.

Module 20: Threat Prediction with Cyber Threat Intelligence

This module covers leveraging threat intelligence capabilities for responding quickly, decisively, and effectively to emerging threats.

Key topics covered: Cyber threat intelligence, threat Intelligence types, Indicators of Compromise (loCs), Indicators of Attack (loA), threat intelligence layers, threat intelligence sources, threat intelligence feeds, threat intelligence platforms (TIP), and threat hunting.

The hands-on lab exercises in this module help demonstrate skills in integrating OTX threat feeds, threat hunting, etc.

All EC-Council certification courses are conducted by certified trainers from Iverson.

Digital Methods acts as the official training partner and assists with program consultation, registration, coordination, scheduling, and administrative arrangements to ensure a smooth and professionally managed training experience.