Need for Security
Information has become the most valuable asset. Over the years, the need for data security has been consistently increasing and thus, many organizations are now taking as much precautions and extra steps to safeguard this valuable information of their clients. It is very important to prevent misuse of critical data of people. Thus information security deals with protecting the confidentiality, integrity, and availability of data from any misuse or malicious activity of hackers. But the question is how to protect the data? Where to acquire skills for becoming an expert in this field? How to get started?
About Institute of Information Security
Introduction to CISC (3 Months)
Certified Information Security Consultant (CISC) - 3 Months, is one such course of the many, which they offer at IIS. This course is devised such that even a beginner can get well versed with different aspects of Information Security. By the end of this course even a person with no technical background can build up a strong foundation in this field. That does not mean, it should be taken only by beginners but my suggestion would be to check the syllabus completely and then decide. This course is equally helpful to others who are familiar with this field also because unlike any other course, this will take you through the core and important concepts which are demanded today by any firm. Also, these concepts together sum up to form the current scenarios of attacks and data breaches in the cyber world. This course is very comprehensive and I will make sure that I cover each and every aspect in detail.
Syllabus
CISC (3 Months) covers a very vast syllabus consisting of 5 modules totally. They are:
 |
| 5 Modules of CISC (3 Months) course |
Module 1: Network Fundamentals
It is important to be well versed with networking before getting our hands on any actual testing. Hence, Network Fundamentals is the very first module of CISC. This module comprises of the basic networking concepts which has to be well understood. Only if you understand the network, you will be able to figure out measures to secure it. Also this module will give you a brief idea about windows and linux operating system. It will cover the concepts of windows and since we will be practicing in linux, it will cover the important linux commands which we will be using in the further modules. This module is designed only for giving a basic idea about the concepts and the same will come again in detail in the later part of this course. This module includes:
Topic
|
Summary
|
Basic concepts of Information Security
|
Difference between white hat, black hat and grey hat hackers, difference between Penetration Testing and ethical hacking, types of testing, and also, careers in Infosec.
|
Network fundamentals
|
Introduction to networks, Components of Data communication, network topology, Internet and Protocols, OSI Model, ICMP, IP Fragmentation and reassembly, IPv4, IPv6.
|
Advanced Networking
|
Subnetting, Supernetting, Routing, Switching, Port security, VPN, Access Control lists, Firewall, IDS, IPS, Network Packet Analysis.
|
Windows
|
Architecture, File systems and permissions, Memory Management, System files, Password Hashing, Windows Registry, Shell commands in windows, Windows Server 2008, Active Directory etc..
|
Linux
|
Introduction to UNIX/LINUX, Architecture, Linux file system, basic commands, file permissions, Kali Linux etc..
|
Module 2: Network Security
After learning the basics of networking, it is now important to understand how to secure it in order to keep it away from malicious activities. If we intend to protect our data we must be aware of how it can be compromised.
It includes:
Topic
|
Summary
|
Reconnaissance
|
DNS lookup, Banner Grabbing, GHDB, Social engineering
|
Packet Crafting
|
Hping3 and Scapy
|
nmap
|
Port scanning , Version, OS detection of target machine services and system respectively.
|
Concepts
|
Hacking servers,Vulnerability, Exploit, Payload, Vulnerability Assessment, Penetration Testing
|
Testing common services
|
FTP, SMTP, HTTP, DNS
|
DNS
|
DNS records, zone transfer, DNS cache poisoning
|
Hacking Passwords
|
online and offline based attacks
|
Automated network scan
|
nessus
|
Metasploit
|
msfconsole, Meterpreter and shell
|
Wireless Networks
|
Wireless operating modes
|
Network Architecture Review
|
Configuration review using Nipper, network audit methodology
|
Cracking
|
Wifi handshake, WEP/WPA/WPA2 cracking, Evil twin
|
Module 3: Server Security
Server Security is divided into 2 sub modules:
1. Database Security: Information is stored in the database. So, it is mandatory to take steps to protect our database from being compromised. This module highlights different steps that we can take to protect our database.
This module also includes learning of SQL (Query language to retrieve data from the database)
Topic
|
Summary
|
Database fundamentals
|
Introduction to DBMS, Types, tier architecture, database security, AAA in database
|
Understanding SQL statements
|
DML, DDL,DCL, Comments, stored procedures, views
|
Oracle
|
Architecture, Securing oracle parameters, Users and Profiles, Roles and privileges, default passwords, SID
|
Tools
|
Oscanner, Aquadata Studio, Scuba
|
Others
|
Introduction to Big Data, MongoDB and its security measures, Hadoop and securing hadoop
|
OS Security: In the first module we learnt about the basic functions, architecture, of OS. Here, we learn OS Hardening. Hardening is the process of taking necessary steps to protect our OS from falling prey to malicious intents.
It includes:
Topic
|
Summary
|
Windows Security
|
Physical security, BIOS, Security Policy(local and GPO), Event log, General security practices, Attack surface analyzer, webserver hardening, OS Hardening, Microsoft windows server 2012
|
Linux Security
|
Boot security, Linux security model, OS hardening, SELinux
|
Module 4: Web Application Security
This is a very important module from the knowledge gaining point of view. Today, everything happens online. Right from buying small groceries to performing heavy bank transactions there is a website to ease the task. People rely mainly on these websites to get their works done. These websites rely on their web servers and services. Because of this web application security has gained its own place in information Security. This module widely covers every possible risk that can cause a web application to be compromised. It is in this module where we learn common mistakes which developers make while developing these web apps and how critical these mistakes can be. It also includes some secure coding practices which everyone can imbibe for ensuring a robust and secure web application. Also, various packages can be included in the web application which are built for securing it.
This module includes:
Topic
|
Summary
|
Introduction
|
Architecture
|
OWASP Top 10
|
A1-A10
|
Browser based Vulnerabilities
|
Browser cache, back and refresh attack, autocomplete
|
Others
|
POODLE, WebDAV, WASC, Poor coding practices
|
OWASP ESAPI
|
ESAPI Library
|
Threat Modelling
|
Process, STRIDE and DREAD model
|
Security Development Cycle
|
Phases, Secure coding Principles
|
WAF
|
Advantages, Disadvantages, Types
|
Module 5: Mobile Security
Everyone today has a mobile. Whether we agree or not, 80% of our daily work is done in the mobile itself. There is an app available for almost every small need today. Mobile Security focuses on the security level of those apps. This module includes two mobile platforms namely Android and iOS. It is these mobiles that are ruling the markets majorly today. Every other person is either having an android or an iOS smartphone. But when it comes to security, it is important to secure these apps too because it contains our own confidential data. This module first begins with basic architecture of both platforms, their important components, working etc. It is only after you understand this you can progress with P.T of it.
It includes:
Topic
|
Summary
|
Android
|
Architecture, Components, ADB, Setting up PT environment, APK, android app modification, Reversing android applications, OWASP Top 10 for mobile (M1-M10)
|
iOS
|
App basics, Architecture, ARM Processor, iOS Security mechanisms, Jailbreaking, iOS PT, Runtime analysis, exploiting iOS apps
|
For labs
In Mobile Security for android we make use of an emulator (Genymotion) or we can even make use of our own phone.
For iOS we use a jailbroken iphone.
Thus, this was about the topics that are going to be covered in this course.
Trainers
Here in IIS there are really amazing trainers who also work as Security Consultants and Security Analysts. The quality of their teaching is very professional. The best part about them is that they are very easily approachable and genuinely are concerned about the well-being of students.
Notes
For every module each student gets his/her own personal copy of notes. Notes can either be a hard copy(book)/soft copy(pdf). The notes provided by IIS are pretty vast and it covers every topic in detail.
Labs
IIS has its own labs. No student is allowed to carry their laptop/hdd to these labs. For performing practical, a student must compulsorily make use of laptops/PC of IIS. These systems are well equipped with all the necessary tools to perform the labs.
Tests
At the end of every module, each batch has to give a subjective and objective test of 50 marks in order to ensure that the particular module is well understood. Along with the written exams, each student has to appear for viva which will be taken by a faculty of a different branch.
Advanced lab
Advanced lab is a 10 day period where students perform PT on vulnerable virtual machines. Here students tend to enhance their skills by practically finding out the loophole and exploiting it to determine how vulnerable the application actually is. These 10 days teach us so much about finding out different attack vectors.
Final Exam
CISC final exam comprises of 5 papers:
Exam
|
Discription
|
CWASP (Theory)
|
Will have questions related to web app security
|
CPH (Theory+Practical)
|
Will check your overall network and web app security knowledge
|
Mobile Security(Theory +Practical)
|
Will contain questions related to both android and iOS security
|
In order to pass one needs 50% at least in each of these papers.
Please note, the theory exams contain MCQ (Multiple Choice Questions), and will completely be objective type only.
This course also provides kit for obtaining CEH certification from EC Council though you must give the CEH Exam to obtain it.
Enrolment
In order to get yourself enrolled into this course or for any other information, you can visit:
or you can mail them at: info@iisecurity.in
Contact details are mentioned in the website.
Conclusion
In the end, I would say that after looking at the syllabus and reviews, CISC (3 Months) is a great course for people who are thinking of making their career in Information Security. Not only that, the ambiance, labs and training is conducted in a very professional manner. In the end, you will not be disappointed with the results. CISC is not the end though; after acquiring such knowledge, students are now ready to dive in depth into this field.
For any queries or discussions about the course or anything related to information security, feel free to DM me on twitter @aish_9524
Comments
Post a Comment