Online Network Forensics – Phase2 Advantage

Certified Network Forensic Analysis Manager (C-NFAM)

Instructor-Led Online Training

The Certified Network Forensic Analysis Manager certification course was originally developed for the U.S. government, and has now been made available to city, county, and state law enforcement agencies. Civilian personnel outside of the law enforcement community are also authorized to attend and will receive practical training for their business environments.

This comprehensive course brings incident response and network forensic core competencies to advanced levels by presenting students with 16 detailed learning objectives. Students will be provided with both experiential knowledge and practical skills that simulate real-world scenarios, investigations, and recovery of evidentiary data in systems and networks. Students will cover topics such as Incident Response Management, Live Data Collection, Analysis Methodology, and Malware Triage. Practical lab exercises utilize the Project Ares® Cyber Range and Wireshark network protocol analyzer software.

Course Instructor

Michael I. Kaplan is the Director of Operations for Phase2 Advantage, a cybersecurity training and publishing company based in Savannah, Georgia. He is also the Chairman of the Savannah Technical College Cybersecurity Advisory Committee and heavily involved in curriculum design initiatives.

Michael has written numerous courses and cybersecurity training programs for corporate, academic, and government personnel. He has also developed training programs for Law Enforcement and Fugitive Task Force Investigators on the topics of Criminal Topology, Forensic Document Analysis, and Investigations. Michael’s technical areas of specialization are Incident Handling and Response, Network Forensics, Digital Forensics, and Information Technology Risk Management. He also provides curriculum and program development services for government, corporate, and academic organizations both domestically and internationally.

Register Today for the Next Training Session

COURSE DATES

June 04 – July 02

TRAINING DAYS

Friday

CLASS TIMES

10:00 am – 7:00 pm

COURSE FEE

$3,000

COURSE ENROLLMENT

The Certified Network Forensic Analysis Manager course is a component of the career progression track that supports the required Categories, Specialty Areas and Work Roles as defined by the National Initiative for Cybersecurity Education (NICE) Cybersecurity Workforce Framework. It provides a common language to speak about cyber roles and jobs and can be referenced to define professional requirements in cybersecurity.

COUNTERINTELLIGENCE FORENSICS ANALYST
(IN-FOR-001)

ALL SOURCE-COLLECTION MANAGER
(CO-CLO-001)

CYBER DEFENSE INCIDENT RESPONDER
(PR-CIR-001)

CYBER CRIME INVESTIGATOR
(IN-INV-001)

CYBER DEFENSE FORENSICS ANALYST
(IN-FOR-002)

EXPLOITATION ANALYST
(AN-EXP-001)

Course Outline and Knowledge Points

Click the blue arrow to the left of the domain title to view an expanded list of key knowledge points.

Introduction to Network Forensic Investigations

Overview of Common Network Devices

Firewall Functionality and Logging
Stateful vs. Stateless Inspection
Host-, Network-, and Application-Based Firewalls
Network Switches and Routers
Intrusion Detection and Prevention Systems
Unified Threat Management

Overview of Common Network Services

Enterprise Services
Dynamic Host Configuration Protocol (DHCP)
Domain Name System (DNS)
Enterprise Management Applications
Antivirus Software
Web and Database Servers

Fundamentals of Secure Network Architecture

Security Architecture Frameworks
Reference Security Architecture
The Secure Development Life Cycle
Architectural Design Documentation (ADD)
Architectural Domains: The Four Pillars
Zero Trust Networks

Incident Response Management

Investigative Principles and Lead Development

Investigation Planning and Preparation

Forensic Analysis Methodology

Principles of Network Evidence

Initiating Network Forensic Investigations

Initial Development of Leads

Principles of Live Data Collection

Investigating Windows Systems

Investigating Applications

Static and Dynamic Malware Triage

Malware Triage Concepts
Malware Handling Procedures
Malware Distribution and Documentation
Physical and Virtual Triage Environments
Automated, Manual, Static, and Dynamic Analysis
Malware Runtime Monitoring

Forensic Strategies for Incident Remediation

Effective Incident Remediation
Assigning a Remediation Owner
Remediation Posturing Actions
Eradication Plan Development
Plan Timing and Execution
Strategic Recommendations and Lessons Learned

Course Learning Objectives

Upon successful completion of the C)NFAM training program, participants will be able to:

CLO #01: Identify the purpose of enterprise network devices such as firewalls (stateless, stateful, host, network, and application), switches, routers, access control lists, intrusion detection and prevention systems, unified threat management devices, and sources of critical logs.

CLO #02: Describe the purpose of enterprise network services such as Dynamic Host Configuration Protocol (DHCP), Domain Name System (DNS), network-level DNS logging, management applications, antivirus software, quarantine files, and network log files.

CLO #03: Demonstrate network forensic and investigation techniques using labs an industry tools such as Wireshark network protocol analyzer, Autopsy forensic software, Windows Registry Editor, file and record carving, document and photo reconstruction, and recovering deleted files.

CLO #04: Determine a malware policy based on industry best practices which addresses the identification of malicious files, initial triage, handling procedures, documentation and distribution guidelines, static and dynamic analysis methods, and the use of sandboxes for automated analysis.

CLO #05: Summarize investigative practices that include elements of proof, field investigation toolkits, incident scene management, evidence dynamics, chain of custody, investigative interview strategies, non-verbal communication, and Locard’s Principle of Exchange.

CLO #06: Evaluate critical sources of forensic evidence including Windows file systems, volatile and persistent memory, event logs, process tracking, web-based applications (browsers, email, and instant messages), malware files, and malicious websites.

Project Ares® Cyber Range Labs

Students enrolled in classroom or instructor-led online formats of this course will be using the Project Ares® Cyber Range for practical labs. Project Ares® Cyber Range labs are available to self-study students for an additional fee.

Instructor-Led & Self-Guided Wireshark Lab Exercises

Creating the Virtual Machine for Labs

Color Rules and
Packet Export

The Wireshark
User Interface

Creating Tables
and Graphs

Customizing
Wireshark Settings

File and Object
Reassembly

Applying
Capture Filters

Adding Comments
to Trace Files

Applying
Display Filters

Command-Line
Capture Tools

Course Training Materials

Exam Prep Guide

Course Workbook & Labs

Lab Images (if Applicable)

Practice Assessment Quizzes

40-Hour CPE Credit Certificate

Knowledge Assessment Examination

Knowledge Assessment Exam

Upon completion of online courses, students will be prepared to sit for the knowledge assessment exam. The online examination will consist of True/False, Multiple Choice, and Fill in the Blank questions. The exam may be taken at any time within 6 months of completing the certification course.

Students will have two hours to complete a computer-based examination consisting of 100 questions. A score of 70% or higher is required to earn the certification. Upon successful completion of the exam, students will besent a hardcopy of their certification and their CPE credit documentation via email (PDF format) within 72-hours of the exam date.

The examination is “closed book.” However, students will be allowed to use their notes on material presented during the course as well as their Course Workbooks.