CREST Practitioner Security Analyst

CREST Practitioner Security Analyst

About this Course
Tech Type
Premium
Code
QACPIA
Duration
5 Days
The CPSA course leads to the CREST Practitioner Security Analyst (CPSA) examination, which is an entry level qualification that tests a candidate’s knowledge in assessing operating systems and common network services at a basic level below that; of the main CRT and CCT qualifications.

The CPSA examination (booked directly with CREST) also includes an intermediate level of web application security testing and methods to identify common web application security vulnerabilities. The examination covers a common set of core skills and knowledge that assess the candidate’s technical knowledge. The candidate must demonstrate that they are able to perform basic infrastructure and web application testing and interpret the results to locate security vulnerabilities. Success will confer the CREST Practitioner status to the individual. This qualification is a pre-requisite for the CREST Registered Penetration Tester (CRT) examination and comprises a multiple-choice examination. CRT is available as a separate course.

Target Audience

• Aspiring information security personnel who wish to be part of a PenTest team
• System administrators who are responding to attacks
• Incident handlers who wish to expand their knowledge into Penetration Testing and Digital Forensics
• Corporations and Government departments who wish to raise and baseline skills across all security teams
• Law enforcement officers or detectives who want to expand their investigative skills
• Information security managers who would like to brush up on the latest techniques and processes inorder to understand information security implications
• Anyone who is considering a career in Penetration Testing

Prerequisites
A good appreciation of the technical aspects of ICT. QAFCCS and or CISMP is recommmended.

Structure

The course consists of six modules:

• Module 1 – Soft Skills and Incident Handling
• Module 2 – Core Technical Skills
• Module 3 – Background Information Gathering & Open Source
• Module 4 – Network Intrusion Analysis
• Module 5 – Analysing Host Intrusions
• Module 6 – Reverse Engineering Malware
• Module 7 – CPIA exam preparation, CPIA mock exam

Assessment
Continual assessment, with topic quizzes and module tests ensure that you understand the knowledge and learn the skills delivered in each module.

Course Outline

MODULE 1 - Soft Skills and Incident Handling

• Engagement Lifecycle Management
• Incident Chronology
• Law & Compliance
• Record Keeping, Interim Reporting & Final Results
• Threat Assessment

MODULE 2 - Core Technical Skills

• IP Protocols
• Network Architectures
• Common Classes of Tools
• OS Fingerprinting
• Application Fingerprinting
• Network Access Control Analysis
• Cryptography
• Applications of Cryptography
• File System Permissions
• Host Analysis Techniques
• Understanding Common Data Formats

MODULE 3 - Background Information Gathering & Open Source

• Registration Records
• Domain Name Server (DNS)
• Open Source Investigation and Web Enumeration
• Extraction of Document Meta Data
• Community Knowledge

MODULE 4 - Network Intrusion Analysis

• Network Traffic Capture
• Data Sources and Network Log Sources
• Network Configuration Security Issues
• Unusual Protocol Behaviour
• Beaconing
• Encryption
• Command and Control Channels
• Exfiltration of Data
• Incoming Attacks
• Reconnaissance
• Internal Spread and Privilege Escalation
• False Positive Acknowledgement

MODULE 5 - Analysing Host Intrusions

• Host-Based Data Acquisition
• Live Analysis Laboratory Set-up
• Windows File System Essentials
• Windows File Structures
• Application File Structures
• Windows Registry Essentials
• Identifying Suspect Files
• Storage Media
• Memory Analysis
• Infection Vectors
• Malware Behaviours and Anti-Forensics
• Rootkit Identification
• Live Malware Analysis

MODULE 6 - Reverse Engineering Malware

• Windows Anti-Reverse Engineering
• Functionality Identification
• Windows NT Architecture
• Windows API Development
• Binary code structure
• Cryptographic Techniques
• Processor Architectures
• Windows Executable File Formats
• Hiding Techniques
• Malware Reporting
• Binary Obfuscation
• Behavioural Analysis

MODULE 7 - CPIA Exam Preparation & Mock Exam

• CPIA- Examination Guidance
• CPIA- Mock Examination

EXAM - Booked directly via CREST

The CREST Practitioner Intrusion Analyst (CPIA) examination is an entry level qualification that tests a candidate’s knowledge in all three subject areas of network intrusion, host intrusion and malware reverse engineering at a basic level below that of the main

Registered and Certified qualifications.

Success will confer the CREST Practitioner status to the individual. This qualification is a prerequisite for the CREST Registered Intrusion Analyst (CRIA) examination and comprises a multiple choice written only examination.

CREST Accredited Training

CREST has assessed and accredited this training course confirming alignment with 100% of the CREST CPIA exam syllabus.