测试与安全技能

Plan and run authorized security tests that simulate deceptive emails, calls, text messages, and in-person approaches. Measure employee responses, compare results across test methods, and report gaps in security awareness training and access controls.

中文简介正在准备中。当前显示英语简介。

• Planning an authorized social engineering assessment
• Measuring responses to simulated phishing
• Evaluating phone and physical access checks

Set up decoy credentials, storage, and secrets across AWS, Azure, and GCP to detect suspicious access. Connect audit logs to security alerts, verify detection, and document permissions, resource inventories, and maintenance plans.

中文简介正在准备中。当前显示英语简介。

• Detecting use of leaked cloud credentials
• Monitoring suspicious access to decoy storage and secrets
• Extending on-premises deception coverage to cloud environments

Deploy decoy credentials, documents, and URLs with Canarytokens to detect suspicious access. Guides token generation, placement, alert testing, and inventory tracking, with email or webhook notifications when someone interacts with a planted token.

中文简介正在准备中。当前显示英语简介。

• Add intrusion alerts to shared folders
• Detect use of decoy cloud credentials
• Monitor decoy documents for signs of data theft

Guide a structured review after a security incident, using timelines and response data to identify root causes and process gaps. Produce review notes, response metrics, and practical improvements with named owners and deadlines.

中文简介正在准备中。当前显示英语简介。

• Reviewing response after a ransomware incident
• Turning exercise findings into process improvements
• Updating incident response playbooks

Build normal traffic profiles for industrial control networks and identify unusual connections, polling intervals, and protocol operations. Use machine learning and process records to investigate deviations and produce anomaly reports with severity levels.

中文简介正在准备中。当前显示英语简介。

• Establishing normal traffic profiles for industrial networks
• Detecting unusual connections and polling intervals
• Investigating Nozomi Guardian or Dragos alerts

Build a two-tier certificate authority with OpenSSL and Python, separating the offline root from the issuing authority. Covers server and client certificates, revocation checks, and policies that define certificate usage and trust.

中文简介正在准备中。当前显示英语简介。

• Set up an internal certificate authority
• Issue server and client certificates
• Configure certificate revocation checks

Plan authorized spearphishing simulations, personalized phishing tests aimed at specific people. Prepare scenarios and email infrastructure, track delivery and participant responses, and document findings to assess email security controls and improve security awareness.

中文简介正在准备中。当前显示英语简介。

• Designing authorized phishing simulations for specific personnel
• Preparing test email delivery infrastructure
• Measuring delivery, opens, clicks, and reporting behavior

Contain an active security breach by isolating endpoints, blocking attacker communications, and revoking compromised access. Follow procedures to limit spread between systems, preserve evidence, verify containment, and report remaining risks and business impact.

中文简介正在准备中。当前显示英语简介。

• Contain ransomware spreading between servers
• Revoke access through compromised accounts
• Isolate hosts communicating with attacker infrastructure

Add checks to LLM prompts and responses using Llama Guard 3, NeMo Guardrails, and LLM Guard. Configure content screening, conversation boundaries, and sensitive-data filtering, then measure blocking and false-positive rates with labeled test prompts.

中文简介正在准备中。当前显示英语简介。

• Adding runtime safety checks to LLM, RAG, or agent apps
• Screening prompts for injection and jailbreak attempts
• Filtering sensitive or toxic model responses

Set up host-based intrusion detection to monitor changes on Windows and Linux endpoints. Configure Wazuh agents, file integrity checks, registry monitoring, alert rules, and automated responses, with guidance on exclusions and centralized security monitoring.

中文简介正在准备中。当前显示英语简介。

• Deploying Wazuh agents on Windows and Linux
• Monitoring critical files and registry changes
• Planning change detection for compliance requirements

Unwrap layers of obfuscated PowerShell malware to recover hidden commands, additional malicious code, and server addresses. Combines script structure analysis with execution tracing and decoding tools to support incident investigation and detection work.

中文简介正在准备中。当前显示英语简介。

• Investigating an obfuscated PowerShell script
• Recovering hidden commands and additional malicious code
• Extracting suspicious URLs, IP addresses, and file paths

Plan authorized voice phishing assessments to evaluate how employees verify callers and report suspicious calls. Organize approved scenarios, record assessment outcomes, and summarize disclosure, verification, and reporting rates to review security awareness training.

中文简介正在准备中。当前显示英语简介。

• Planning an authorized voice phishing assessment
• Evaluating caller verification and security reporting
• Reviewing the effectiveness of security awareness training

Assess authorized networks through host discovery, service checks, vulnerability identification, and controlled exploitation. Follow a structured testing process to document attack paths, demonstrate business impact, clean up test artifacts, and prioritize remediation.

中文简介正在准备中。当前显示英语简介。

• Assessing internal or external network security
• Validating firewall rules and network segmentation
• Verifying whether service vulnerabilities are exploitable

Design and configure VLANs, logical network partitions, to separate employee devices, servers, guests, and IoT equipment. Covers traffic restrictions between zones, switch security settings, and tests to verify that the intended isolation works.

中文简介正在准备中。当前显示英语简介。

• Separating guest WiFi and IoT devices from internal systems
• Planning network isolation for payment processing systems
• Restricting communication between network zones

Assess iOS and Android app security using OWASP MASTG, a mobile security testing guide. Examine app files, runtime behavior, stored data, authentication, and API traffic, then document vulnerabilities, their impact, and suggested fixes.

中文简介正在准备中。当前显示英语简介。

• Assess mobile app security before release
• Check sensitive data storage and network traffic
• Test authentication and resistance to runtime manipulation

Deploy CrowdStrike Falcon sensors across Windows, macOS, and Linux endpoints. Configure threat prevention and response policies, verify installation and detection, troubleshoot sensor issues, and connect events to SIEM platforms, which collect security logs for analysis.

中文简介正在准备中。当前显示英语简介。

• Deploying Falcon sensors across enterprise endpoints
• Configuring prevention and response policies by endpoint group
• Checking sensor connectivity and test detections

Plan and measure defensive deception operations with MITRE Engage. Connect decoy systems and credentials to specific attacker techniques, define measurable objectives, and document operating boundaries, response procedures, and criteria for assessing results.

中文简介正在准备中。当前显示英语简介。

• Giving existing honeypots a coordinated strategy
• Selecting decoys for a specific threat actor
• Writing an adversary engagement operation plan

Set up Cisco Duo multi-factor authentication for VPN, RDP, SSH, and web applications. Configure access rules based on users and device health, introduce security keys, and establish authentication monitoring and emergency access procedures.

中文简介正在准备中。当前显示英语简介。

• Adding Duo authentication to VPN and remote server access
• Strengthening authentication for privileged accounts
• Restricting access based on device health

Deploy decoy accounts, service entries, and policy objects in Active Directory to detect suspicious activity. Configure monitoring rules for Windows security events and validate alerts for credential misuse, reconnaissance, and movement between systems.

中文简介正在准备中。当前显示英语简介。

• Detecting Kerberoasting with decoy service entries
• Monitoring attempts to use decoy credentials
• Placing credential traps in decoy Group Policy objects

Screen AI application inputs and historical logs for prompt injection, where malicious instructions try to redirect the model. Combine pattern matching, text structure scoring, and a DeBERTa classifier to flag suspicious content and produce JSON results.

中文简介正在准备中。当前显示英语简介。

• Screening chatbot and AI agent inputs
• Checking external text used in retrieval-based AI applications
• Auditing historical interaction logs for injection attempts

Deploy and configure Snort 3 to detect suspicious network traffic. Create custom detection rules, tune community rules to reduce false alerts, test them against captured traffic, and forward alerts to a central security monitoring platform.

中文简介正在准备中。当前显示英语简介。

• Deploy intrusion detection at network boundaries
• Write rules for organization-specific threats
• Reduce noisy or false alerts

Investigate reported phishing emails by checking sender details, links, and attachments. Identify affected recipients and exposed login credentials, guide removal of malicious messages across the organization, and secure compromised accounts with password resets and session revocation.

中文简介正在准备中。当前显示英语简介。

• Investigating a suspicious email reported by an employee
• Assessing exposure after a link click or credential entry
• Removing phishing messages across organizational mailboxes

Conduct authorized WiFi security assessments covering authentication, encryption, rogue access points, and network separation. Test WPA2/WPA3 configurations and client behavior, then document weaknesses, evidence, business impact, and recommended fixes.

中文简介正在准备中。当前显示英语简介。

• Assessing corporate, guest, and IoT WiFi security
• Evaluating WPA3 migration and transition mode
• Testing rogue access point detection

Connect security incidents across organizations by comparing attack indicators, techniques, and timelines. Build relationship graphs and campaign reports that document shared evidence, attribution confidence, and indicators useful for detection.

中文简介正在准备中。当前显示英语简介。

• Linking incidents that share attack indicators
• Analyzing attacks across partner organizations
• Preparing reports on sustained attack campaigns