CNO ATTACK AND DEFEND

This rigorous, hands-on course is designed to take students through a wide variety of topics relevant to operationally-focused cyber missions within the offensive and defensive arena. This
course focuses heavily on deep packet inspection, statistical flow record analysis, post-exploitation forensics, intrusion detection, network tunneling, and malware network behavior. Extensive network analysis is conducted throughout each stage of the hacker methodology to include packet capturing of scanning, service enumeration, exploitation, man-in-the-middle techniques, and
tunneling. Deep packet inspection is performed on the newest remote and client-side exploits and C&C communications. Forensic analysis using IDS logging and network signatures are used to find, preserve, and extract evidence of intrusion. Students will gain an extensive understanding of each packet transmitted on the wire from the very first scan, up to and after successful (or unsuccessful) compromise of the remote system using a variety of tools to include but not limited to Wireshark, Snort, BRO, Security Onion, and Metasploit. During the course, students will learn exploitation skills, both remote and client-side attacks, through extensive hands on exercises. A 2-day intense culmination exercise designed to replicate real-world operational challenges in both offensive and defensive space reinforces topics taught throughout the course.