PRODUCTO

Capacitación y Entrenamiento

Adva-Endpoint

Unidad de negocio Adva-Endpoint

Kaspersky Cybersecurity Training

La formación en ciberseguridad de Kaspersky cubre una amplia gama de temas, técnicas y evaluaciones de ciberseguridad, desde el nivel básico hasta el experto. Todos los cursos están disponibles como clases presenciales en las instalaciones del cliente o en su oficina local / regional de Kapsersky.

Los cursos incluyen tanto teóricos como prácticos, para lograr el máximo compromiso. Al finalizar cada curso, los estudiantes pueden completar una evaluación para validar sus conocimientos.

PROGRAMA

Choose your training course

Windows Digital Forensics: basic and advanced

Improve your in-house digital forensics and incident response teams’ expertise with courses specially designed to fill gaps in knowledge and experience. Students will develop and enhance their practical skills in searching for traces of digital cybercrime and analyzing different types of data for restoring attack timelines and sources. After they’ve completed the course, students will be able to investigate computer incidents successfully, raising the overall security level of your business

Malware Analysis and Reverse: basic and advanced

These courses are aimed at security researchers and incident response personnel, malware analysts, security engineers, network security analysts, APT hunters and IT security staff. Students will become familiar with the scope of reverse engineering applications, assembly language, corresponding tools and common techniques used by malware authors to maintain persistence, avoid detection, inject into system process memory, and more.

The advanced course covers most of the steps required to analyze a modern APT toolkit, from receiving the initial sample all the way to producing a deep technical description using IOCs.

Windows Incident Response

The Windows Incident Response course will guide your in-house team through every stage of the incident response process and equip them with the comprehensive knowledge needed to successfully verify, contain, analyze and remediate incidents.

Efficient Threat Detection with Yara

This course will teach students how to write effective Yara rules, how to test them and improve them to the point where they find threats that nobody else does.

CURSOS

Program descriptions

All-levels

Windows Digital Forensics

5 days

Through a simulated real-life targeted cyberattack, the course covers the
following topics:

Introduction to digital forensics
Live response and evidence acquisition
Post-mortem analysis of Windows machines
MS Windows registry internals
MS Windows events
MS Windows artifacts analysis
Browsers artifacts forensics
Email analysis
Forensics challenges with SSD disks
Recommendations for building a digital forensics lab
Testing the newly gained skills with a practical challenge using different Windows artifacts

How to acquire various digital evidence and deal with it in a forensically sound environment
Find traces of incident-related malicious activities froM
MS Windows artifacts
Utilize time stamps from different Windows artifacts to reconstruct an incident scenario
Find and analyze browser and email history
Be able be apply the tools and instruments of digital forensics
Understand the process of creating a digital forensics lab

Mid-level

Malware Analysis & Reverse Engineering

5 days

Basic analysis using IDA Pro
Dynamic analysis using popular virtualization solutions and debuggers
Malicious documents analysis
Unpacking
Decryption
Shellcodes analysis
Exploit analysis
Reverse tips and tricks

A grounding in OS and assembly language
Be able to conduct static and dynamic malware analysis to fully understand its behavior and functionality
Deal with malware anti-analysis tricks, self-protective techniques and protection software bypasses
Identify and reverse engineer standalone and embedded shellcodes
Analyze PDF exploits from scratch

Advanced-level

Advanced Windows Digital Forensics

5 days

Through a simulated real-life targeted cyberattack, the course covers the
following topics:

Numerical systems
FAT file system
NTFS file system
Data and file recovery from file system, shadow copies and using file carving
Forensics challenges in Cloud computing
Memory forensics
Network forensics
Timeline vs SuperTimeline analysis
Testing the newly gained skills with a practical challenge with acquired digital evidence

Conduct deep file system analysis
Identify and recover deleted files using different techniques
Analyze network traffic with different tools
Identify and track malicious activities in memory dump
Identify and dump interesting parts from memory for further analysis
Reconstruct the incident timeline using file system timestamps
Create a single timeline for all Windows OS artifacts to gain a better understanding of the incident scenario

Advanced-level

Advanced Malware Analysis & Reverse Engineering

5 days

Unpacking
Decryption
Developing own decryptors for common scenarios
Byte code decompilation
Code decomposition
Disassembly
Reconstruction of modern APT architectures
Recognizing typical code constructs
Identification of cryptographic and compression algorithms
Classification and attribution based on code and data
Class and structure reconstruction
APT plugin architectures (based on recent APT samples)

Be able to analyze a modern APT toolkit, from receiving the initial sample, all the way to producing a technical description of the attacker’s TTPs with IOCs
Produce static decryptors for real-life scenarios and then continuing with in-depth analysis of the malicious code
Analyze malicious documents that are typically used to deliver initial payloads and know how to extract them
Ensure that damage assessment and incident response efforts are accurate and effective

Mid-level

Windows Incident Response

5 days

In a simulated real-life environment, an incident will take place and the
course will cover the following topics on that specific scenario:

Introducing the incident response process and its workflow
Explaining the difference between normal threats and APTs
Explaining APT Cyber Kill Chain
Applying the incident response process to different incident scenarios
Applying Cyber Kill Chain on the simulated environment
Applying live analysis on victim machines for first responders
Forensically sound evidence-acquisition techniques
Introducing post-mortem analysis and digital forensics
Introducing memory forensics
Log file analysis with regular expressions and ELK
Introducing cyber threat intelligence
Creating IoCs (Indicators of Compromise), with YARA and Suricata
Introducing malware analysis and sandboxing
Introducing network traffic forensics
Discussing incident analysis reporting and recommendations on building CSIRT
Testing the newly gained skills with a practical challenge in another simulated scenario

Understand the phases of incident response
What to consider while responding to a cyber incident
Understand various attack techniques and targeted attack anatomy through the Cyber Kill Chain
Respond to different incidents with the appropriate actions
The ability to differentiate APTs from other threats
Confirm cyber incidents using live analysis tools
Understand the difference between live analysis and post-mortem – and when to apply each of them
Identify digital evidence; HDD, memory and network traffic with an introduction on their forensics analysis
Write YARA and Suricata rules to detect IOCs for the investigated attack
Log file analysis
Understand the process involved in building an IR team

All-levels

Efficient Threat Detection with Yara

2 days

Brief intro into Yara syntax
Tips & tricks to create fast and effective rules
Yara-generators
Testing Yara rules for false positives
Hunting new undetected samples on VT
Using external modules within Yara for effective hunting
Anomaly search
Lots (!) of real-life examples
Exercises for improving your Yara skills

Create effective Yara rules
Test Yara rules
Hunt for new undetected samples in your
infrastructure and in cloud platforms

Adva-Datos

Unidad de negocio Adva-Datos

SAFETICA Servicios Profesionales

Maximice sus resultados utilizando los servicios profesionales de Safetica. Te ayudaremos a conseguir la máxima calidad en seguridad y mantenimiento de los servicios. Elija el servicio adecuado para usted y comuníquese con nuestros especialistas para hacer arreglos.

¿Qué servicios ofrecemos?

Implementación

Con los Servicios de Implementación de Safetica no hay necesidad de que configuren los productos de Safetica ONE. Contamos con un equipo de ingenieros preparados para diseñar e instalar el software.

Ajustamos las soluciones para que se adapten exactamente a sus necesidades.

Health Check

Es un servicio donde nuestros ingenieros especialistas, comprueban la configuración, implementación de Safetica y recomiendan cambios u optimizaciones si es necesario en el entorno del cliente.

Horas de soporte

Utilice este servicio si:

Necesita personal de apoyo para configurar una política.
Requiere asistencia para resolver casos de soporte y acompañamiento constante.
Requiere asistencia para verificar si la tecnología de Safetica se acomoda a las necesidades organizaciones.

Análisis de comportamiento

Descubra en qué medida se utilizan los recursos de la empresa para fines laborales.
Obtenga una descripción general de las visitas a las redes sociales, portales de empleo, nuevos sitios de almacenamiento para reducir el riesgo de filtración de datos.
Analice las comunicaciones por correo electrónico entrantes y salientes.
Logre una descripción general de qué aplicaciones que utilizan y qué sitios web visitan usuarios específicos.
Logre estudios del comportamiento del Usuario basados en nuestro Sensor Discovery y amplie su visual para detectar futuros Insiders
Obtenga información detallada sobre el trabajo con archivos confidenciales, es decir, quién abrió los archivos, qué software se utilizó para trabajar con ellos, guardar la ubicación, cambiar el nombre y la eliminación, dispositivos externos, correo electrónico y almacenamiento en la nube, incluida la carpeta sincronizada en el disco.
Entrega de informe final con recomendaciones y contramedidas para evitar la fuga de datos.

Safetica Product Training

Desarrollamos una estrategia de capacitaciones que le enseñará cómo utilizar nuestra solución al máximo. Lo familiarizaremos con el producto y le brindaremos información sobre las mejores prácticas de nuestra tecnología.

Clasificación de datos

Safetica Advanced Classification Compliance les permite:

Identificar y clasificar información confidencial con la máxima precisión.
Reducir la exposición y detectar amenazas a tiempo para evitar violaciones de datos.
Dar cumplimiento a políticas y legislaciones locales.

Adva-Datos

Unidad de negocio Advan-Email & Networking

AdvanSolution, en conjunto con Barracuda Networks, ofrecemos una ronda de capacitación de los productos contratados.

Para ello, el equipo de capacitación de Barracuda recomienda comenzar con los cursos que existen en el campus ya que están diseñados para escenarios donde el cliente final tiene un deseo o políticas internas de capacitarse. También es el material más actualizado ya que legítimamente existe un equipo dedicado a estos cursos: