[RECAP] - "Penetration Testing, Incident Response and Forensics" - IBM on Coursera. - PART 0 - Syllabus

This post is a recap of my learning from the course: Penetration Testing, Incident Response and Forensics - IBM - Coursera

Syllabus of this course: 

WEEK 1: PENETRATION TESTING

Penetration testing is a critical component of any organization's cybersecurity strategy. In this module, I learned the importance and fundamentals of penetration testing, including its various phases, common approaches, and industry-leading tools. The module also covered critical aspects like the planning, vulnerability analysis, and discovery phases. I gained insights into different pentesting methodologies, such as open-box, closed-box, and gray-box approaches, and explored commonly exploited vulnerabilities.

Learning Objectives

________________________________________

• Discuss the components of a penetration test report’s executive summary and technical review

• Describe commonly exploited vulnerabilities

• Summarize what happens in each step of the attack phase of pentesting

• Describe methods for the discovery phase of pentesting

• Define vulnerability analysis and explain its role in pentesting

• Contrast open box, closed box, and gray box approaches pentesting

• List directives that pentesters and clients should document in the planning phase of pentesting

• Describe each component of the planning phase of pentesting

• Summarize common approaches to pentesting

• Define pentesting and explain its importance

• Describe industry-leading tools used for pentesting

WEEK 2: INCIDENT RESPONSE

Incident response is an essential part of an organization's overall cybersecurity plan, and this module provided a deep dive into the topic. I learned about the various phases of incident response, the importance of documentation, and the components of an incident response policy. This module covered the use of modern cybersecurity tools like QRadar, McAfee ePolicy Orchestrator (ePO), and next-generation firewalls. I also learned about common attack vectors, essential components of an incident response policy, and the models for incident response teams.

Learning Objectives

________________________________________

• Modify QRadar’s network hierarchy settings

• Generate a QRadar report

• Investigate QRadar offenses using QRadar SIEM

• Summarize how to manage a QRadar SIEM incident response queue

• Describe three modern cybersecurity tools: QRadar, McAfee ePolicy Orchestrator (ePO), and next-generation firewalls

• List common cybersecurity threats

• Describe “lessons learned” meetings and other activities that may be appropriate for post-incident analysis

• Recall questions from the Sysadmin, Audit, Network, and Security (SANS) Institute’s checklist for incident response

• Describe the goals of the eradication and recovery phases of incident response

• Explain why forensics is an essential part of incident containment

• Summarize considerations for selecting an incident containment strategy

• List parties that may require notification of a detected incident

• Discuss standard topics and impact categories to include in incident analysis documentation

• Describe the types of monitoring systems used for incident detection

• Distinguish between precursors and indicators and list their common sources

• Summarize recommended practices for securing networks, systems, and applications

• Describe the three types of resources needed for effective incident response

• Recall essential components of an incident response policy

• List common attack vectors for cybersecurity incidents

• Discuss the departments within an organization with which the incident response team should establish a working relationship

• Contrast the three models for incident response teams

WEEK 3: DIGITAL FORENSICS

Digital forensics is a vital aspect of cybersecurity, and this module provided a thorough understanding of the subject. I learned about the objectives of digital forensics, standard data sources, and the challenges faced in data collection. The module also covered the National Institute for Standards and Technology's (NIST) three steps for data collection and the role of the chain of custody in data collection. I gained valuable insights into the analysis step in digital forensics, the components of a forensic report, and best practices for writing them.

Learning Objectives

________________________________________

• Discuss methods for using network data to identify a cyberattacker

• Summarize the various sources of network data and the value of data obtainable from each

• Describe the four layers of the TCP/IP model and their relevance for digital forensics

• Explain how different application components and types provide meaningful forensic data

• Summarize recommended forensic methods for collecting log information from Windows, macOS, and Linux systems

• Contrast volatile and non-volatile data and explain best practices for collecting each data type

• Describe essential methods, tools, and considerations for collecting, preserving, and analyzing data files

• Summarize the components of a forensic report and the best practices for writing them

• Describe the analysis step in digital forensics

• Summarize the obstacles inherent in forensic examination

• Explain the role that the chain of custody plays in data collection

• Describe the National Institute for Standards and Technology’s (NIST’s) three steps for data collection

• Discuss the challenges that various data collection methods present

• Summarize the objectives of digital forensics

• List standard data sources for digital forensics

• Define digital forensics

WEEK 4: INTRODUCTION TO SCRIPTING

Scripting is a powerful tool for cybersecurity analysts, and this module introduced me to the basics of Python scripting. I learned about Python's syntax, data structures, conditions, functions, methods, and libraries. The module also provided an overview of other scripting languages like JavaScript, Bash, Perl, PowerShell, binary, and hexadecimal. I learned basic scripting concepts, including script, variable, argument, parameter, if statement, and loop.

Learning Objectives

________________________________________

• Explain what a Python library is and describe examples

• Discuss what Python functions and methods are

• Explain the basic syntax of conditions in Python branching

• Describe Python data structures

• Recall Python rules for syntax, data types, and strings

• Summarize the benefits of using Python

• Describe the purpose and features of JavaScript, Bash, Perl, PowerShell, binary, and hexadecimal scripting languages

• Explain basic scripting concepts, including script, variable, argument, parameter, if statement, and loop

• Summarize the history of scripting languages and their common uses today

IBM's "Penetration Testing, Incident Response, and Forensics" course on Coursera provided me with a solid foundation in cybersecurity. The course's comprehensive content, hands-on approach, and industry-leading tools prepared me to face the challenges of the cybersecurity field as a Cybersecurity Analyst. I highly recommend this course to anyone looking to understand cybersecurity or seeking to work in the field.

PART 0 - Syllabus

PART 1 - Penetration Testing

PART 2 - Incident Response

PART 3 - Digital Forensics

PART 4 - Scripting