Course Description

Historically, digital extortion has been carried out with malicious emails, compromised websites, or malvertisements, which infect victims' computers with ransomware. But as multiple recent cases have shown, cybercriminals are beginning to leverage targeted attack techniques in digital extortion. They compromise corporate systems from the outside and gain access to the systems and sensitive data. Then, they navigate across corporate networks with lateral movement techniques while encrypting files on critical servers along the way using legitimate tools to prevent the security teams from effectively investigate their attacks.

Faced with increasingly rampant cybercrime, how can security teams actively look for signs of attacks and discover how their systems are breached, while at the same time helping their companies build an investigative defense mechanism and promote security awareness?

This workshop will show you:

• Why hackers can easily break into outward facing servers
• The common techniques that hackers use to gain privileged system access and move laterally within corporate networks, plus the counter measures from system administrators' perspective

How IT security or network administration teams can investigate into such activities in order to deploy defenses and set up security alerts

Course Outline

• Demonstration of intrusion techniques
• Privilege escalation and lateral movement techniques
• Root cause analysis
• Timely response mechanisms

Suggested equipment specifications for Attendee

• All equipment is prepared by the co-organizers "Trend Micro".

Attendee Prerequisite Skills for the Course

• IT security administrators with experience in Windows administration and command-line operations (MS-DOS prompt)

Course Description

Did you feel lost and doesn’t know where to start when dealing cyber-attacks? This course is designed for personnel who is new to Information Security and covers the fundamental techniques and tools to digital forensics, includes information analysis to locate malicious connections and malwares. Practices involve with memory blocks extraction of malicious process for potential C&C(Command & Control) server and furthermore, the attacker’s tactics and techniques.

Course Outline

• Initiative of investigation
• Investigation to malicious connections
• Investigation to malwares
• Memory blocks extraction of malicious process

Suggested equipment specifications for Attendee

• Notebook / VM
• 2GB of RAM
• Vmware Workstation for Windows (Trial)
• Cellular phone for Wifi Hotspot (other wireless or wired connection is prohibited)

Attendee Prerequisite Skills for the Course

• Familiar to common Operation Systems, knowledge to Information Security is recommended

Course Description

Historically, digital extortion has been carried out with malicious emails, compromised websites, or malvertisements, which infect victims' computers with ransomware. But as multiple recent cases have shown, cybercriminals are beginning to leverage targeted attack techniques in digital extortion. They compromise corporate systems from the outside and gain access to the systems and sensitive data. Then, they navigate across corporate networks with lateral movement techniques while encrypting files on critical servers along the way using legitimate tools to prevent the security teams from effectively investigate their attacks.

Faced with increasingly rampant cybercrime, how can security teams actively look for signs of attacks and discover how their systems are breached, while at the same time helping their companies build an investigative defense mechanism and promote security awareness?

This workshop will show you:

• Why hackers can easily break into outward facing servers
• The common techniques that hackers use to gain privileged system access and move laterally within corporate networks, plus the counter measures from system administrators' perspective

How IT security or network administration teams can investigate into such activities in order to deploy defenses and set up security alerts

Course Outline

• Demonstration of intrusion techniques
• Privilege escalation and lateral movement techniques
• Root cause analysis
• Timely response mechanisms

Suggested equipment specifications for Attendee

• All equipment is prepared by the co-organizers "Trend Micro".

Attendee Prerequisite Skills for the Course

• IT security administrators with experience in Windows administration and command-line operations (MS-DOS prompt)

Course Description

From time to time we need to provide evidence after attacks but wonder where to look. This course is designed for personnel involved in incident investigation, to locate attacker’s traces and entry points for corresponding records as well as attacker’s tactics and techniques.

Course Outline

• Windows Security Logs Analysis
• Web Logs Analysis
• Hacker’s Trace Analysis

Suggested equipment specifications for Attendee

• Notebook / VM
• 2GB of RAM
• Vmware Workstation for Windows (Trial)
• Cellular phone for Wifi Hotspot (other wireless or wired connection is prohibited)

Attendee Prerequisite Skills for the Course

• Familiar to common Operation Systems, knowledge to Information Security is recommended

Course Description

Historically, digital extortion has been carried out with malicious emails, compromised websites, or malvertisements, which infect victims' computers with ransomware. But as multiple recent cases have shown, cybercriminals are beginning to leverage targeted attack techniques in digital extortion. They compromise corporate systems from the outside and gain access to the systems and sensitive data. Then, they navigate across corporate networks with lateral movement techniques while encrypting files on critical servers along the way using legitimate tools to prevent the security teams from effectively investigate their attacks.

Faced with increasingly rampant cybercrime, how can security teams actively look for signs of attacks and discover how their systems are breached, while at the same time helping their companies build an investigative defense mechanism and promote security awareness?

This workshop will show you:

• Why hackers can easily break into outward facing servers
• The common techniques that hackers use to gain privileged system access and move laterally within corporate networks, plus the counter measures from system administrators' perspective

How IT security or network administration teams can investigate into such activities in order to deploy defenses and set up security alerts

Course Outline

• Demonstration of intrusion techniques
• Privilege escalation and lateral movement techniques
• Root cause analysis
• Timely response mechanisms

Suggested equipment specifications for Attendee

• All equipment is prepared by the co-organizers "Trend Micro".

Attendee Prerequisite Skills for the Course

• IT security administrators with experience in Windows administration and command-line operations (MS-DOS prompt)

Course Description

The threat of business is rapidly evolving. The number of targeted threats such as malware, ransomware, data theft, and phishing is increasing, and the ability of malicious attackers to circumvent traditional security measures has intensified. Coupled with the adoption of SaaS, the cloud and the Internet of Things, the more sophisticated methods of threat delivery have triggered new challenges, control point complexity and security gaps that cannot be ignored.

With Akamai's global insights into the Internet and the Domain Name System (DNS), Enterprise Threat Protector enables security teams to proactively block and mitigate targeted threats and enforce the principles of proper use across the enterprise for security. The team is proactive in identifying, blocking, and defending against targeted threats such as malware, ransomware, phishing, data breaches, and more using the Domain Name System (DNS). Leverage real-time intelligence from Akamai Cloud Security Intelligence and Akamai's proven, recursive DNS platform around the world to deliver enterprise security, control and visibility efficiently, while easily integrating with your existing network defenses.

This hands-on course will give you an in-depth understanding of Akamai ETP's operating mechanism and hands-on experience to experience the speed, convenience, and high availability of Akamai ETP.

Course Outline

• ETP operation process
• ETP advantage
• ETP main function
• ETP background operation
• ETP report view

Suggested equipment specifications for Attendee

• Laptop

Attendee Prerequisite Skills for the Course

• Basic network knowledge

Course Description

Historically, digital extortion has been carried out with malicious emails, compromised websites, or malvertisements, which infect victims' computers with ransomware. But as multiple recent cases have shown, cybercriminals are beginning to leverage targeted attack techniques in digital extortion. They compromise corporate systems from the outside and gain access to the systems and sensitive data. Then, they navigate across corporate networks with lateral movement techniques while encrypting files on critical servers along the way using legitimate tools to prevent the security teams from effectively investigate their attacks.

Faced with increasingly rampant cybercrime, how can security teams actively look for signs of attacks and discover how their systems are breached, while at the same time helping their companies build an investigative defense mechanism and promote security awareness?

This workshop will show you:

• Why hackers can easily break into outward facing servers
• The common techniques that hackers use to gain privileged system access and move laterally within corporate networks, plus the counter measures from system administrators' perspective

How IT security or network administration teams can investigate into such activities in order to deploy defenses and set up security alerts

Course Outline

• Demonstration of intrusion techniques
• Privilege escalation and lateral movement techniques
• Root cause analysis
• Timely response mechanisms

Suggested equipment specifications for Attendee

• All equipment is prepared by the co-organizers "Trend Micro".

Attendee Prerequisite Skills for the Course

• IT security administrators with experience in Windows administration and command-line operations (MS-DOS prompt)

Course Description

Introduce recent several important security incidents, and how to investigate / control incident by log management.

Introduce importance of log management in information security

Base on some real incident , to review whole picture of incident, and introduce ALog「detect internal fraud in advance」, and「how to trace when incident occurred」

By hands on and basic operation to easily understand how to use ALog, also introduce some software management /maintenance.

• Exercise #1「Hands on! How to trace incident!」
• Exercise #2「How to Utilization and understand current situation by report!」
• Exercise #3「Create and Utilization report for monitoring/management purpose!」
• Exercise #4「Utilization to prevent unknown problem, Ultimate file of ALog!」

Course Outline

• Windows server system
• How to achieve Information security by Log management , and Audit access record to keep management.
• Install and configure ALog to collect log in Windows AD environment from ADDC / Fileserver .
• Introduce several scenario and how to analyses by ALog.

Suggested equipment specifications for Attendee

• Hardware
  • CPU: I5 or higher
  • RAM: 16G or higher
  • HDD: 500G or higher
• Software
  • Need a VMware workstation
  • With following environment:
    • Windows ADDC
    • Windows File server
    • Windows server for install ALog

Attendee Prerequisite Skills for the Course

• Must know about Windows AD architecture, knowing about Auditing on Information Security, and knowledge about Windows and other system’s log management.

Course Description

The main Purpose of this course is to deliver to our attendees of an introduction and demonstration in  how to use AlienVault to analysis event correlations and find out the real threat. Users will be experiment from evaluating a risk to generating a real alarm and steps of incident report.

Course Benefits:

1. Understand the current security monitoring is no longer only SIEM
2. Enhance the concept of security and understand how to find out the real threat of security through comprehensive event analysis
3. How to use the Alienvault platform to achieve SOC self-monitoring

Course Outline

• The introduction of LogMaster, a big data collection platform.
• The capabilities of AlienVault
• AlienVault data analysis implementation                   
• Report system implementation

Suggested equipment specifications for Attendee

• Notebook, hardware specifications CPU: CORE i5 or more, RAM: 8G

Attendee Prerequisite Skills for the Course

• Preferred with a slight cybersecurity concept and some Linux basic foundation