测试与安全技能

Plan authorized voice phishing assessments to evaluate how employees verify callers and report suspicious calls. Organize approved scenarios, record assessment outcomes, and summarize disclosure, verification, and reporting rates to review security awareness training.

中文简介正在准备中。当前显示英语简介。

• Planning an authorized voice phishing assessment
• Evaluating caller verification and security reporting
• Reviewing the effectiveness of security awareness training

Design and configure VLANs, logical network partitions, to separate employee devices, servers, guests, and IoT equipment. Covers traffic restrictions between zones, switch security settings, and tests to verify that the intended isolation works.

中文简介正在准备中。当前显示英语简介。

• Separating guest WiFi and IoT devices from internal systems
• Planning network isolation for payment processing systems
• Restricting communication between network zones

Assess whether stolen Kerberos tickets, credentials used for network authentication, can enable access to other systems during authorized testing. Guide ticket extraction and reuse, review detection indicators, and document evidence for security reports.

中文简介正在准备中。当前显示英语简介。

• Authorized testing of access through reused tickets
• Checking detection of Kerberos ticket theft
• Collecting evidence for lateral movement reports

Set up Cisco Duo multi-factor authentication for VPN, RDP, SSH, and web applications. Configure access rules based on users and device health, introduce security keys, and establish authentication monitoring and emergency access procedures.

中文简介正在准备中。当前显示英语简介。

• Adding Duo authentication to VPN and remote server access
• Strengthening authentication for privileged accounts
• Restricting access based on device health

Configure Windows security logs for threat detection and incident investigation. Covers detailed audit policies, process command line recording, log storage sizing, and centralized forwarding so monitoring systems receive useful authentication and activity records.

中文简介正在准备中。当前显示英语简介。

• Record process launches with their command lines
• Monitor successful and failed sign-ins
• Forward Windows security events to a central monitoring system

Deploy Suricata to detect suspicious network traffic or block it inline. Configure protocol inspection, detection rules, and structured EVE JSON logs, then connect logs to analysis platforms and check packet drops and alert quality during operation.

中文简介正在准备中。当前显示英语简介。

• Deploying network intrusion monitoring
• Configuring inline blocking of malicious traffic
• Adding custom detection rules and reducing noisy alerts

Conduct authorized WiFi security assessments covering authentication, encryption, rogue access points, and network separation. Test WPA2/WPA3 configurations and client behavior, then document weaknesses, evidence, business impact, and recommended fixes.

中文简介正在准备中。当前显示英语简介。

• Assessing corporate, guest, and IoT WiFi security
• Evaluating WPA3 migration and transition mode
• Testing rogue access point detection

Build a recurring vulnerability scanning process with Nessus, Qualys, or OpenVAS. Prioritize findings using asset importance and known exploitation, then organize remediation deadlines, monitoring dashboards, and automatic tickets for urgent issues.

中文简介正在准备中。当前显示英语简介。

• Establish recurring infrastructure vulnerability scans
• Prioritize fixes using asset importance and exploitation data
• Track remediation deadlines and overdue findings

Build dashboards that show how long vulnerabilities remain unresolved and compare remediation times with severity-based deadlines. Define response policies, automate escalation notices, and report compliance rates and other measures of remediation progress.

中文简介正在准备中。当前显示英语简介。

• Define vulnerability remediation deadlines
• Visualize overdue vulnerabilities
• Automate reminders and management escalations

Build Splunk pipelines that import threat intelligence and match security events against indicators such as malicious IP addresses, domains, and file hashes. Add source, confidence, and severity details so analysts have context when investigating matches.

中文简介正在准备中。当前显示英语简介。

• Importing external threat feeds into Splunk
• Matching network and endpoint logs against threat indicators
• Adding threat and asset context to alerts

Build a central vulnerability dashboard with DefectDojo to combine scanner findings, remove duplicates, and track remediation. Includes Docker deployment, automated scan imports from CI/CD pipelines, Jira ticket integration, and API queries for reporting metrics.

中文简介正在准备中。当前显示英语简介。

• Combining findings from multiple security scanners
• Importing scan results automatically from CI/CD pipelines
• Connecting vulnerability findings to Jira tickets

Collect evidence from a compromised computer before shutdown or remediation erases it. Preserve memory, network connections, processes, and system state, then record integrity hashes and handling history to support incident investigation and evidence tracking.

中文简介正在准备中。当前显示英语简介。

• Preserving evidence before shutting down a compromised computer
• Collecting memory evidence for suspected fileless malware
• Recording active connections and processes during an intrusion

Create reusable procedures for responding to security incidents, from detection and containment to recovery. Define decision points, responsibilities, escalation rules, and workflows for security automation platforms so teams can follow a consistent response process.

中文简介正在准备中。当前显示英语简介。

• Establishing an incident response program
• Documenting phishing or ransomware response procedures
• Designing automated security response workflows

Map an organization's internet-facing assets using public information, including domains, indexed services, employee details, and leaked data. Compile findings into a reconnaissance report to support authorized security assessments and identify potential exposure.

中文简介正在准备中。当前显示英语简介。

• Gathering public information before a penetration test
• Finding unknown internet-facing assets
• Checking public sources for leaked credentials and documents

Assess authorized web applications for pages and APIs that allow access without authentication. Discover hidden URLs and exposed configuration or backup files, compare signed-in and signed-out responses, and document affected resources, impact, and recommended fixes.

中文简介正在准备中。当前显示英语简介。

• Finding administrative pages accessible without signing in
• Checking authentication requirements on APIs
• Locating exposed configuration and backup files

Build intermediary servers for authorized security exercises, separating public traffic from the command server used by the test team. It covers simple forwarding, request filtering with nginx or Apache, TLS certificates, and validation against the exercise’s traffic profile.

中文简介正在准备中。当前显示英语简介。

• Separating public infrastructure from an exercise command server
• Filtering exercise traffic against a defined profile
• Adding TLS certificates to a redirector

Build a central platform for collecting, analyzing, and sharing cyber threat information. Connect MISP, OpenCTI, TheHive, and Cortex to import feeds, add context to suspicious indicators, manage cases, and track platform activity.

中文简介正在准备中。当前显示英语简介。

• Build a central threat intelligence platform
• Automate threat feed ingestion
• Add context to suspicious IP addresses and domains

Build security detection rules in Splunk using SPL, its search language. Use examples for suspicious logins, network traffic, and PowerShell activity to develop searches, add context and severity, test historical logs, and measure false alerts.

中文简介正在准备中。当前显示英语简介。

• Creating rules to detect suspicious login activity
• Detecting large outbound transfers and access to multiple hosts
• Testing detection rules against historical logs

Build automated pipelines that collect threat indicators, such as malicious IP addresses and file hashes, from multiple feeds. Standardize formats, remove duplicates, assess confidence, and distribute indicators to security monitoring systems for matching and alerts.

中文简介正在准备中。当前显示英语简介。

• Automating threat feed ingestion
• Standardizing and deduplicating threat indicators
• Distributing indicators to multiple monitoring systems

Set up Havoc infrastructure for authorized attack simulations, including its command server, traffic listeners, Nginx relay servers, and Windows agents. The skill also covers communication profiles and operational precautions for running the infrastructure.

中文简介正在准备中。当前显示英语简介。

• Preparing Havoc infrastructure for an authorized exercise
• Reviewing server and traffic relay separation
• Configuring communication profiles for an exercise

Build a workflow that extracts and deduplicates threat indicators such as URLs and IP addresses, creates readable reports with links disabled, and prepares standardized STIX 2.1 data for sharing through MISP or TAXII.

中文简介正在准备中。当前显示英语简介。

• Preparing threat reports with links disabled
• Consolidating indicators from multiple sources
• Distributing threat indicators through MISP or TAXII

Set up MISP to collect, store, and correlate threat intelligence from multiple feeds. Use PyMISP to automate searches and imports of indicators of compromise, such as suspicious IP addresses and file hashes, and export data for security monitoring tools.

中文简介正在准备中。当前显示英语简介。

• Collecting threat indicators from multiple feeds
• Automating MISP imports and searches
• Exporting indicators for security monitoring tools

Respond to security incidents across AWS, Azure, and GCP by investigating audit logs, containing compromised identities, isolating resources, and preserving evidence. Organize recovery and follow-up security measures for credential leaks, unauthorized permission changes, and attacks spanning cloud services.

中文简介正在准备中。当前显示英语简介。

• Responding to leaked cloud credentials
• Investigating unauthorized permission or resource changes
• Preserving audit logs and disk snapshots

Map Active Directory permissions, group memberships, and user sessions with BloodHound CE. Reveal paths from ordinary accounts to administrator privileges, prioritize findings, and document evidence for authorized assessments or checks after security hardening.

中文简介正在准备中。当前显示英语简介。

• Find paths from ordinary accounts to Domain Admin
• Review access permissions and group relationships
• Verify that hardening closed known attack paths