The Cyber Defense Infrastructure Support Specialist course focuses on hands-on learning, emphasizing practical tasks to bridge theoretical knowledge with real-world cybersecurity challenges.

In this course, participants will begin their journey by learning to secure Windows and Linux servers and computers, utilizing both manual techniques and automated tools such as scripts and playbooks. They will delve into the nuances of system security, adopting security best practices to build a solid foundational knowledge. This comprehensive approach ensures a robust understanding of system hardening and security maintenance, preparing learners for advanced cybersecurity tasks.

Furthermore, participants will be trained to identify and map devices across the network, establishing a clear understanding of the network's structure. They will be introduced to basic and advanced techniques for anomaly detection, employing threat hunting strategies to proactively identify and mitigate potential security risks. This segment of the training is crucial for developing the skills needed to monitor and secure network infrastructures effectively.

Some modules in the course will equip participants with the skills to safeguard cloud-based infrastructure and ensure its seamless integration with on-premises systems. They will explore protective measures specific to cloud environments while aligning these with the existing security protocols of physical infrastructures. The training will culminate in the establishment of comprehensive security standards and practices, aimed at fortifying the organizational security framework across all platforms.

Upon completion, learners will be proficient in:

• Apply advanced system hardening techniques to secure Windows environments.
• Utilize Group Policy Objects (GPOs) to enforce security settings efficiently across Windows systems.
• Execute robust server hardening strategies to minimize cyber threat exposure on Linux servers.
• Develop automation scripts with Python or PowerShell to streamline administrative tasks and enhance defenses.
• Implement comprehensive security tools on Windows for effective detection, prevention, and response to cyber incidents.
• Optimize Security Information and Event Management (SIEM) systems for enhanced security monitoring.
• Craft and implement YARA rules for proactive malware hunting and anomaly detection.

MCSI is one of the most respected and trusted names in cyber security education and training. Our certifications teach critical skills, knowledge and abilities needed to advance a career in cyber security. Our courses are comprehensive and up-to-date, and our instructors are experienced professionals who are dedicated to helping students learn. MCSI provides the real-world skills and knowledge you need to protect any organization from cyber threats.

• Lab Setup and Configuration

  Lab setup and configuration is crucial for MCDISS as it provides hands-on experience in implementing cybersecurity measures in a controlled environment.

  ELK Stack

  The ELK Stack (Elasticsearch, Logstash, Kibana) is essential for MCDISS to perform centralized log management and analysis, enabling effective detection and response to security incidents.

  Pandas

  Pandas is used in Python for sophisticated data analysis, which is critical for MCDISS in enhancing cyber threat hunting capabilities and extracting insights from security data.

  Yara

  Yara is employed by MCDISS to craft and implement rules for proactive malware hunting, enabling the identification of malicious signatures and indicators of compromise (IoCs) in the digital environment.

  Reverse Engineering

  Reverse engineering is a key skill for MCDISS, allowing them to analyze malware and understand its behavior, which is crucial for developing effective cyber defense strategies.

  AWS

  AWS (Amazon Web Services) expertise is vital for MCDISS to secure cloud-based infrastructure effectively, aligning cloud security with on-premises systems and ensuring regulatory compliance.

  Ansible

  Ansible is utilized by MCDISS to automate cybersecurity defenses across diverse environments, enabling efficient deployment of security measures and strengthening security configurations.

• System Hardening

  System hardening involves configuring computer systems to reduce vulnerabilities and enhance security. It's important in the MCDISS course because participants learn to secure Windows and Linux servers effectively, minimizing cyber threats and improving overall cybersecurity.

  Restricting Permission with Regedit

  Restricting permissions with Regedit is important for MCDISS as it helps secure Windows systems by controlling access to critical registry settings, reducing the attack surface for potential threats.

  Restricting Network Access with Firewall

  Restricting network access using firewalls is crucial for MCDISS to enforce security boundaries, allowing only authorized traffic to pass through and protecting against unauthorized access.

  Utilizing ProcMon to Monitor Processes

  Utilizing Process Monitor (ProcMon) is relevant for MCDISS as it enables real-time monitoring of system processes, aiding in the detection of suspicious activities and potential security breaches.

  Enforcing Password Policies to Linux Servers

  Enforcing password policies on Linux servers is critical for MCDISS to strengthen authentication mechanisms and prevent unauthorized access to sensitive information and resources.

  Finding Weak Passwords in Linux Servers

  Identifying weak passwords on Linux servers is essential for MCDISS to address security vulnerabilities and ensure robust authentication practices, minimizing the risk of unauthorized access.

  Configuring a Squid Proxy

  Configuring a Squid proxy is relevant for MCDISS to control and monitor internet access, filter content, and enhance security by intercepting and inspecting network traffic.

  Reviewing Unused Services

  Reviewing and disabling unused services is important for MCDISS to reduce the attack surface and minimize security risks associated with unnecessary system components.

  Creating Linux Hardening Checklist

  Creating a Linux hardening checklist is crucial for MCDISS to systematically apply security measures and configurations, ensuring Linux systems are resilient against cyber threats.

• Group Policy and Automation

  Group Policy and automation are relevant and important for MCDISS because they enable efficient management and enforcement of security configurations across Windows environments, ensuring consistent adherence to security policies and reducing manual errors in system administration.

  Automation through Group Policy Objects (GPOs) streamlines security measures, enhances scalability, and enables rapid response to emerging threats, contributing to effective cybersecurity defense strategies within organizations.

  Deploying Group Policy Objects (GPOs) to Enforce Networking Policies

  Deploying GPOs to enforce networking policies is vital for MCDISS as it ensures consistent and centralized control over network security settings, enhancing overall security posture across Windows environments.

  Deploying Group Policy Objects (GPOs) to Enforce Password Policies

  Deploying GPOs to enforce password policies is essential for MCDISS to enhance authentication security and enforce strong password practices across Windows environments, reducing the risk of unauthorized access.

  Deploying Group Policy Objects (GPOs) to Harden Windows Security Settings

  Deploying GPOs to harden Windows security settings is critical for MCDISS to implement consistent security configurations and mitigate vulnerabilities, ensuring a robust defense against cyber threats.

  Writing PowerShell Scripts to Protect Vulnerable Windows Services

  Writing PowerShell scripts to protect vulnerable Windows services is important for MCDISS to automate security measures and mitigate risks associated with vulnerable services, improving overall system security.

  Writing PowerShell Scripts to Manipulate Windows Protection Settings

  Writing PowerShell scripts to manipulate Windows protection settings is essential for MCDISS to automate security tasks and enforce specific security configurations, enhancing the resilience of Windows environments against cyber threats.

  Writing Multiple Ansible Playbooks for Different Circumstances

  Writing multiple Ansible playbooks for different circumstances is crucial for MCDISS to automate security operations, deploy consistent security measures, and maintain scalability in managing diverse cybersecurity challenges.

• Security Tools and Monitoring

  Security tools and monitoring are critical for MCDISS to proactively detect, respond to, and mitigate security threats across network infrastructures and systems. These tools enable continuous monitoring of network activities, identification of suspicious behavior, and timely response to potential cyber incidents, bolstering overall cybersecurity defenses.

  Utilizing TCPView to Identify Open Ports and Services

  Utilizing TCPView is essential for MCDISS to identify and monitor open ports and services, facilitating network analysis and security optimization.

  Using Process Hacker to Investigate Processes

  Using Process Hacker allows MCDISS to investigate running processes and identify potential security threats or anomalous behavior within the system.

  Monitoring Network Traffic with PFsense and Suricata

  Monitoring network traffic with PFsense and Suricata is crucial for MCDISS to detect and respond to network-based threats and anomalies in real-time.

  Configuring Port Forwarding

  Configuring port forwarding is an important skill for MCDISS to manage network traffic effectively and enable secure access to internal resources.

  Creating an Assurance Checklist

  Creating an assurance checklist helps MCDISS ensure that all necessary security measures and configurations are in place to protect network infrastructure.

  Creating Secure Network Links Using OpenVPN

  Creating secure network links with OpenVPN enables MCDISS to establish encrypted connections, enhancing privacy and security when accessing networks remotely.

  Threat Hunting with Yara

  Threat hunting with Yara allows MCDISS to proactively search for and identify specific patterns or indicators of compromise within network traffic or systems.

  Threat Hunting with Pandas

  Threat hunting with Pandas involves leveraging data analysis techniques to identify and investigate potential security threats or abnormalities in large datasets.

  Writing Queries with ELK SIEM

  Writing queries with ELK SIEM allows MCDISS to perform advanced log analysis and correlation, aiding in the detection and investigation of security incidents.

• Network Analysis and Defence

  Network analysis and defense are critical for MCDISS as they enable the identification and mitigation of network-based threats, ensuring the integrity and security of organizational networks. By conducting network analysis, MCDISS can proactively monitor and respond to suspicious activities, ultimately fortifying the network infrastructure against cyber threats.

  Creating a Request for Information (RFI) Document

  Developing an RFI document is essential for MCDISS to gather detailed requirements and specifications from vendors or partners, ensuring a clear understanding of cybersecurity needs and capabilities.

  Mapping Networks with GrassMarlin

  Using GrassMarlin is crucial for MCDISS to visualize and understand network topologies, enabling effective network monitoring, threat detection, and response.

  Configuring AWS Security Token Service

  Configuring the AWS Security Token Service is important for MCDISS to manage and control access to AWS resources securely, enhancing cloud security and compliance.

  Migrating VMware Machines to AWS Instances

  Developing a migration strategy for VMware machines to AWS instances is essential for MCDISS to optimize infrastructure, leverage cloud benefits, and enhance scalability and flexibility.

  Developing a Migration Strategy

  Creating a comprehensive migration strategy is crucial for MCDISS to ensure a smooth and successful transition of IT infrastructure to new platforms like AWS, minimizing disruption and maximizing security.

• Documentation and Procedures

  Documentation and procedures are crucial in the MCDISS course to ensure consistency and clarity in implementing cybersecurity measures. Detailed documentation supports knowledge transfer, enables effective troubleshooting, and ensures compliance with security standards and protocols.

  Developing a Risk Scoring Formula and Matrix

  Developing a risk scoring formula and matrix is essential for MCDISS to assess and prioritize cybersecurity risks based on impact and likelihood, aiding in effective risk management and decision-making.

  Developing a Change Request Template

  Creating a change request template is important for MCDISS to standardize and streamline the change management process, ensuring proper documentation, approval, and implementation of changes within the infrastructure.

  Network Security Audit Checklist

  Crafting a network security audit checklist is crucial for MCDISS to systematically evaluate and verify the security posture of network infrastructure, identifying vulnerabilities and areas for improvement.

  IT Asset Inventory Spreadsheet

  Maintaining an IT asset inventory spreadsheet is vital for MCDISS to track and manage all digital assets, facilitating better resource allocation, risk assessment, and compliance management.

  Security Maturity Survey

  Conducting a security maturity survey enables MCDISS to assess the organization's cybersecurity maturity level, identify gaps, and prioritize initiatives to enhance overall security posture.

This course teaches the specific Knowledge, Skills, Abilities, and Tasks (KSATs) aligned with the DoD Cyber Workforce Framework (DCWF) as outlined in DoD 8140. By focusing on these critical competencies, the course ensures that you develop the essential capabilities required for various cybersecurity roles within the Department of Defense. This alignment not only guarantees that the training is relevant and comprehensive but also that it prepares you to meet the specific operational needs and standards of the DoD cyber workforce.

• knowledge

  ID	Description
  22	Knowledge of computer networking concepts and protocols, and network security methodologies.
  49	Knowledge of host/network access control mechanisms (e.g., access control list).
  59A	Knowledge of Intrusion Detection System (IDS)/Intrusion Prevention System (IPS) tools and applications.
  61	Knowledge of incident response and handling methodologies.
  63	Knowledge of cybersecurity principles and organizational requirements (relevant to confidentiality, integrity, availability, authentication, non-repudiation).
  81A	Knowledge of network protocols such as TCP/IP, Dynamic Host Configuration, Domain Name System (DNS), and directory services.
  87A	Knowledge of network traffic analysis (tools, methodologies, processes).
  92B	Knowledge of how traffic flows across the network (e.g., Transmission Control Protocol (TCP), Internet Protocol (IP), Open System Interconnection Model (OSI)).
  108	Knowledge of risk management processes (e.g., methods for assessing and mitigating risk).
  148	Knowledge of Virtual Private Network (VPN) security.
  150	Knowledge of what constitutes a network attack and the relationship to both threats and vulnerabilities.
  984	Knowledge of cyber defense policies, procedures, and regulations.
  1012A	Knowledge of test procedures, principles, and methodologies (e.g., Capabilities and Maturity Model Integration (CMMI)).
  1072	Knowledge of network security architecture concepts including topology, protocols, components, and principles (e.g., application of defense-in-depth).
  1158	Knowledge of cybersecurity principles.
  1159	Knowledge of cyber threats and vulnerabilities.
  6935	Knowledge of cloud computing service models Software as a Service (SaaS), Infrastructure as a Service (IaaS), and Platform as a Service (PaaS).
  6938	Knowledge of cloud computing deployment models in private, public, and hybrid environment and the difference between on-premises and off-premises environments.
  29	Knowledge of data backup, types of backups (e.g., full, incremental), and recovery concepts and tools.
  93	Knowledge of packet-level analysis.
  900	Knowledge of web filtering technologies.
  1074A	Knowledge of transmission records (e.g., Bluetooth, Radio Frequency Identification (RFID), Infrared Networking (IR), Wireless Fidelity (Wi-Fi). paging, cellular, satellite dishes, Voice over Internet Protocol (VoIP)), and jamming techniques that enable transmission of undesirable information, or prevent installed systems from operating correctly.
  1125	Knowledge of Cloud-based knowledge management technologies and concepts related to security, governance, procurement, and administration.
  3143	Knowledge of basic system, network, and OS hardening techniques.
  6210	Knowledge of cloud service models and possible limitations for an incident response.

• skills

  ID	Description
  6700	Skill in troubleshooting and diagnosing cyber defense infrastructure anomalies and work through resolution.
  157	Skill in applying host/network access controls (e.g., access control list).
  227	Skill in tuning sensors.
  229	Skill in using incident handling methodologies.
  237	Skill in using Virtual Private Network (VPN) devices and encryption.
  893	Skill in securing network communications.
  896	Skill in protecting a network against malware.
  6670	Skill in system, network, and OS hardening techniques.
  6942	Skill in designing or implementing cloud computing deployment models.
  6945	Skill in migrating workloads to, from, and among the different cloud computing service models.

• abilities

  ID	Description
  6918	Ability to apply cybersecurity strategy to cloud computing service and deployment models, identifying proper architecture for different operating environments.
  6919	Ability to determine the best cloud deployment model for the appropriate operating environment.

• tasks

  ID	Description
  643A	Identify potential conflicts with implementation of any cyber defense tools(e.g., tool and signature testing and optimization).
  960	Assist in identifying, prioritizing, and coordinating the protection of critical cyber defense infrastructure and key resources.
  5090	Assist in assessing the impact of implementing and sustaining a dedicated cyber defense infrastructure.
  393B	Coordinate with system administrators to create cyber defense tools, test bed(s), and test and evaluate applications, hardware infrastructure, rules/signatures, access controls, and configurations of platforms managed by service provider(s).
  471	Coordinate with Cyber Defense Analysts to manage and administer the updating of rules and signatures (e.g., intrusion detection/protection systems, anti-virus, and content blacklists) for specialized cyber defense applications.
  481A	Create, edit, and manage network access control lists on specialized cyber defense systems (e.g., firewalls and intrusion prevention systems).
  654B	Implement risk assessment and authorization requirements per the Risk Management Framework (RMF) process for dedicated cyber defense systems within the enterprise, and document and maintain records for them.
  769	Perform system administration on specialized cyber defense applications and systems (e.g., anti-virus, audit and remediation) or Virtual Private Network (VPN) devices, to include installation, configuration, maintenance, backup and restoration.