Network application services are both ubiquitous and exploitable. If successfully compromised by a sophisticated threat actor they provide the means for establishing C2 channels and exfiltrating company information. In this course, Security Event Triage: Monitoring Network Application Services, you will learn foundational knowledge of the tools and techniques you can apply to detect when and how these essential services have been compromised. First, you will learn the techniques an APT agent can employ in order to exploit the different types of network application services. Next, you will discover what the security events written to the log files can reveal about the attack that’s unfolding. Finally, you will explore how to use freely available tools to analyze events from across the network to differentiate the good from the bad in terms of the malicious use of these services. When you’re finished with this course, you will have the skills and knowledge of monitoring network application services needed to protect your organization from sophisticated cyberattacks seeking to exploit these essential network protocols.
Author Name: Alan Monnox
Author Description:
Alan is the Lead Architect for the cyber security company Reveille Security. He is also the author of the book Rapid J2EE Development published by Prentice Hall. Alan’s tenure in the IT industry goes back over several decades and during that time he has been fortunate to work on many large-scale systems for a range of business-sectors and industries, including energy, finance, retail and healthcare. His core skills are in information security, solution architecture, and systems integration. Much… more

Table of Contents

• Course Overview
  2mins
• Increasing the Digital Forensic Footprint with Log Data
  24mins
• Detecting DNS Tunneling
  39mins
• Identifying Compromised Authentication Application Protocols
  29mins
• Exfiltrating Data with FTP and SMTP
  29mins
• Finding Rogue DHCP Servers and VPN Weaknesses
  27mins