Description

This advanced course will allow you to measure the level of security of your information system using intrusion detection tools, vulnerability detection, auditing, etc. It will provide you with knowledge of advanced solutions to maintain and make the desired level of security evolve over time in relation to your needs. The practical work offered will allow you to acquire the skills necessary for the installation, configuration and administration of the most used applications in the security field.

Who is this training for ?

For whom ?

Manager, security architect. Systems and network technicians and administrators.

Prerequisites

Training objectives

Measure the security level of your information system Use intrusion detection, vulnerability detection and auditing tools Strengthen the security of your information system Implement an AAA (Authentication, Authorization, Accounting) architecture Implement SSL/TLS

Training program

• Reminders
  • The TCP/IP protocol.
  • Address translation.
  • Network architecture.
  • The firewall: advantages and limits.
  • Proxies, reverse-proxy: application protection.
  • Demilitarized zones (DMZ).
• Attack tools
  • Security paradigms and classification of attacks.
  • Principles of attacks: spoofing, flooding, injection, capture, etc.
  • Libraries: Libnet, Libpcap, Winpcap , Libbpf, Nasl, lua.
  • Tools: Scapy, Hping, Ettercap, Metasploit, Dsnif, Arpspoof, Smurf.
  • Practical work Protocol analysis with Wireshark.
  • Using Scapy and Arpspoof.
• Cryptography, application
  • Security services.
  • Cryptographic principles and algorithms (DES, 3DES, AES, RC4, RSA, DSA, ECC).
  • Certificates and specific profiles for the various servers and clients (X509).
  • IPSEC protocol and virtual private networks (VPN).
  • SSL/TLS and VPN-SSL protocols.
  • Data compression issues.
  • Practical work Getting started with openssl and implementing OpenPGP.
  • Generation of X509 v3 certificates.
• Architecture AAA (Authentication, Authorization, Accounting)
  • The AAA network: authentication, authorization and traceability.
  • One Time Password: OTP, HOTP, Google Authenticator, SSO (Kerberos Protocol).
  • The place of the LDAP directory in authentication solutions.
  • The PAM and SASL modules.
  • Radius architecture and protocol (Authentication, Authorization, Accounting).
  • Possible attacks.
  • How to protect yourself.
  • Practical work Attack on a AAA server.
• Detect intrusions
  • Operating principles and detection methods.
  • Market players, overview of the systems and applications concerned.
  • Network (nmap) and application scanners ( web applications).
  • IDS (Intrusion Detection System).
  • The advantages of these technologies, their limits.
  • How to place them in the architecture 'company.
  • Market overview, detailed study of SNORT.
  • Practical work Installation, configuration and implementation of SNORT, writing attack signatures.
• Verify the integrity of a system
  • The operating principles.
  • What products are available.
  • Presentation of Tripwire or AIDE (Advanced Intrusion Detection Environment).
  • Vulnerability auditing.
  • Principles and methods and organizations for managing vulnerabilities.
  • Reference site and overview of audit tools.
  • Definition of 'a security policy.
  • Study and implementation of Nessus (state, operation, evolution).
  • Practical work Audit of network and server vulnerabilities help from Nessus and Nmap.
  • Website vulnerability audit.
• Manage security events.
  • Processing of information reported by the various security equipment.
  • Consolidation and correlation.
  • Presentation of SIM (Security Information Management).
  • SNMP management and protocol: security strengths and weaknesses.
  • SNMP security solution.
  • Practical work SNMP attack setup.
• Wi-Fi network security
  • How to secure a Wi-Fi network? The intrinsic weaknesses of Wi-Fi networks.
  • SSID Broadcast, MAC Filtering, what contribution? WEP has is it still of interest? The WPA protocol, first acceptable solution.
  • WPA implementation in shared key mode, is that sufficient? WPA, Radius and AAA server, the enterprise implementation.
  • The 802 standards.
  • 11i and WPA2, which solution is the most successful today? Practical work Configuration of tools for traffic capture, network scanning and WIFI traffic analysis, traffic injection, WIFI key cracking.
  • Configuration of an AP (Access Point) and implementation of security solutions.
• IP telephony security
  • Voice over IP concepts.
  • Application presentation.
  • The architecture of a VoIP system.
  • The protocol SIP, open standard for voice over IP.
  • The weaknesses of the SIP protocol.
  • The problems of NAT.
  • Attacks on telephony over IP.
  • What are the security solutions?
• Email security
  • Email architecture and operation.
  • Messaging protocols and access (POP, IMAP, Webmail, SMTP, etc.
  • ).
  • Problems and classifications of attacks on messaging (spam, fishing, identity theft, etc.
  • ).
  • Those involved in the fight against SPAM.
  • Methods, architectures and tools to combat SPAM.
  • Tools for collecting email addresses.
  • Solutions implemented against SPAM.