Network Security Monitoring

Firewalls and antivirus are not enough to protect modern computer networks--abuses and attacks are common and cannot be completely prevented. Instead, networks are now monitored to detect security incidents, and security teams respond to them to limit the harm they cause. This class prepares students for jobs in monitoring and incident response, providing skills that are in high demand.

Hands-on projects will include basic configuration and use of Splunk, ELK, and Security Onion--popular network security monitoring solutions.

Prerequisite knowledge: Basic networking and security concepts at the Network+ and Security+ level.

Hardware requirements: Students need a host computer with VMware Player, Fusion, or Workstation installed, at least 30 GB of drive space, and an Internet connection fast enough to download 5 GB of data in a reasonable time.

Upon successful completion of this course, the student will be able to:

• Explain the importance of network security monitoring and compare it to other types of defenses, such as firewalls
• Implement and configure Splunk, ELK, and Security Onion servers
• Efficiently search network traffic to detect abuses and attacks

"The Practice of Network Security Monitoring: Understanding Incident Detection and Response" by Richard Bejtlich, No Starch Press; 1 edition (July 26, 2013), ASIN: B00E5REN34 Buy from Amazon

The class will be livestreamed using Zoom.

Join from PC, Mac, Linux, iOS or Android: https://zoom.us/j/4108472927
Meeting ID: 410-847-2927

To keep participants awake during lectures, there will be Kahoot live contests to review terms and concepts.

Chapter quizzes are available in plaintext and Canvas exports for participants who want them.

They will also be available online for those who wish to take them during the class.

To take quizzes, log in to Canvas here:

https://canvas.instructure.com/courses/1253858

Download quizzes as a Canvas export file

Surveys for Weds.