Cybersecurity Master Annual Program 2024

Students will understand modern identity attack techniques, including the Pass-the-Hash, Pass-the-Ticket, Kerberoasting and others. Further, they will learn what can be done to mitigate the threat from such attacks and how to do it.

a) Modern Identity Attack Techniques
b) Preventing Credential Theft and Misuse
c) Recommended AD Configuration Options
d) OS-Level Credential Protection Features: LSA Protected Process, Credential Guard, and RDP Restricted Admin Mode
e) Detecting Backdoors in Active Directory

Students become familiar with cryptography basics and the essence of Public Key Infrastructure. Further CQURE Expert will show best practices for PKI architecture. Students will also learn about attacks on certificate infrastructure and mitigations.

a) Cryptography basic
b) Essence of PKI
c) Best practices for PKI Architecture
d) Active Directory Certificate Services Migration
e) Attacks on Certificates Infrastructure & Mitigations

Students will understand SQL Server Security baseline and will be able to effectively manage logins and passwords for MS SQL servers.

a) SQL Server Security Baseline Concepts
b) SQL Server Instance Security
c) Managing Logins & Passwords

Students will understand and be able to implement and manage On-Prem and Cloud-service Privileged Access Workstations.

a) Privileged Access Workstations – how and why?
b) Different hardware and VM solutions for implementing PAWs
c) Difference between normal and privileged access
d) Implementing and Managing On-prem PAWs
e) Implementing and Managing Cloud-service PAWs

Students will learn the general idea on good practices regarding the evidence gathering. They will be able to perform memory dumps, analyze them and recognize indicators of compromise. Students will also learn how to dump and analyze forensic data from disks, and how to properly extract as well as interpret evidence.

a) Evidence Gathering
b) Memory: Dumping and Analysis
c) Memory: Indicators of compromise
d) Disk: dumping & analysis
e) Disk: extracting and interpreting evidence

Students become familiar with Microsoft EDR and SIEM solutions.

a) Microsoft 365 security from SOC Analyst perspective
b) Microsoft 365 Defender for Endpoint – EDR story
c) Detection and Response with Sentinel – Let’s attack Contoso network

The task to create and maintain secure applications, or fixing existing applications, can be difficult. It is no different for APIs. This module has been designed to give you an overview and working understanding of how to develop secure APIs and Web applications.

a) Introduction to OWASP Secure Coding
b) Authentication and Access Control
c) Hardening your API and Web application

Students will be able to utilize specific PowerShell tools related to security, such as DSInternals. They will learn advanced PowerShell features which will allow them to audit Active Directory for vulnerabilities.

a) PowerShell security and specific hacktools (like DSlnternals)
b) Advanced PowerShell course
c) Auditing Active Directory using PowerShell

Students will become familiar with the most important Azure Active Directory security settings. After completing the module they will be able to implement: AAD Identity Protection, AAD PI and AAD Password Protection.

a) Azure AD security settings
b) AAD Identity Protection
c) AAD Privileged Identity Management (PIM)
d) AAD Password Protection

Students will become familiar with key aspects of web application pentesting. They will learn what vulnerabilities are often found in web apps and how they may be exploited. This knowledge can be useful both for offensive and defensive purposes – it might be interesting also to web app developers.

a) Cross Site Scripting
b) Injections
c) Insecure File Handling
d) Testing API

Students will be able to implement, manage and troubleshoot AppLocker.

a) Whitelisting in General
b) Implementing AppLocker
c) Managing AppLocker
d) Troubleshooting AppLocker

Students will become familiar with all configuration parameters for the Azure Kubernetes Services from the security perspective. Further, they will learn how to plan optimal specification and design to secure cluster infrastructure by going through:

a) Planning and designing the secure cluster infrastructure in Azure
b) Securing DevOps pipeline for AKS
c) Confidential computing with AKS

Students will become familiar with threat intelligence and modeling. Further, they will learn how to use open-source intelligence tools and techniques. During this module CQURE Experts will present different patterns attacks.

a) Threat Intelligence, Assessment and Threat Modeling
b) Open-Source Intelligence Tools and Techniques
c) Patterns of Attack

During this module, students will become familiar with detecting and hunting for malware activities.

1. Intro to malware and malware functionalities.
2. Hunting for malware C&C communication in network activities.
3. Hunting for malware behavior in sysmon logs.
4. Creating a Yara rule for malware family or a suspicious functionality.