In this section of the course
we're going to cover how to investigate an incident
in the real world as a cybersecurity professional.
Now, as a cybersecurity professional
our job is to gather, analyze, and interpret data
in order to uncover hidden threats
and respond effectively to security incidents.
We're going to be exploring
a comprehensive set of data sources
from dashboards and automated reports.
They're going to provide high level insights,
all the way down to more granular data
obtained through vulnerability scans,
packet captures, and various types of logs,
including firewall logs, application logs,
endpoint logs, operating system specific security logs,
intrusion prevention system,
intrusion detection system logs,
and network logs.
All of these data sources
are going to serve as our foundation for our investigations
and allow us to piece together the puzzle
of cyber incidents and make more informed decisions
to safeguard our digital assets.
So in this section of the course,
we're going to be focused solely
on domain four and objective 4.9.
Objective 4.9 states that given a scenario,
you must be able to use data sources
to support an investigation.
Now, for most of my students
this is probably the hardest objective on the exam
because you're not being asked to just memorize things.
But here you're going to be asked
to look at a given log snippet or alert
and then make a decision
based on the evidence you see in that code snippet
to determine if an incident has occurred or not.
And if one has, what kind of remediation
would you recommend performing
on that given system?
For example, consider the following snippet
of a web server log that contains six lines of code.
As you review those lines of the log,
you're going to be able to determine
what kind of attack was being attempted.
Now in this example, look at line two
and you notice that there's a query string of laptops,
that is normal and that is perfect.
But if you look down in line three,
we see the query string is updated
to include laptops, apostrophe, semi-colon,
DROP TABLE users, semi-colon, dash, dash.
Now, this line isn't just looking for the term laptops
but instead it's using that apostrophe to
attempt an SQL injection.
So if the question asks you what type of an attack this was
you would say it's an SQL injection.
Alternatively, they may also ask you
what's the best way to mitigate against this type
of attack that you looked at inside of the logs?
So looking at the logs
you determine it's an SQL injection.
Now, what's the best answer
to be able to prevent an SQL injection?
And that would be something
like a web application firewall
being placed between the database server
and the end user who's trying to access it.
Because a web application firewall can detect
and prevent SQL injections from occurring
by conducting input sanitization
and blocking out known attack patterns
like those used in an SQL injection.
Now as we begin this section of the course
we are going to start out by looking
at the different types of data
that can be used during your investigations.
Then we're going to move through 11 different examples
with some known incidents
that you can then learn how to read these logs,
alerts, and other types of data
so you can use it during your investigation.
As we move through the section,
we're going to cover things like dashboards,
automated reports, vulnerability scans,
packet captures, firewall logs, application logs,
endpoint logs, operating system security logs,
IPS and IDS logs and alerts,
network logs, and metadata.
Once we finish going through all the examples
of each of those different types of data
that you may see on the exam,
we're then going to move into a short quiz
to see what you've learned during this section of the course
and review each of those quiz questions fully
to ensure you can explain why the right answer was right.
So if you're ready,
let's start investigating our data
so we can identify if some kind of action
is malicious or not
in this section of the course