CYSA+ 002 Labs

[hosnypasha]

@stephen Kindly I taught CYSA+ many times,each time students face some hardness of doing labs specially for SNORT,IOC I hope that next verion of CYSA+ labs will be more related
t real life not just trial versions of security nion

 

[Steve Linthicum]

I think I've said it a number of times, but the three-year cycle we face with ANSI accredited CompTIA exams, coupled with the rapid changes in technology, has resulted in a reduction of technical textbooks and lab choices that are available. Think about it from an author or publisher's perspective. Books for ancient history classes don't have to be rewritten very often. This isn't true for the stuff we teach. I've welcomed the fact that CompTIA is now providing learning content. While we all could wish for better labs, I'm finding them much better than other resources in that they use a virtual network/virtual computer environment as opposed to simulations. I beef them up a bit by requiring students to fill out a simple lab report explaining what they did and what they learned. I plucked one of them out that was submitted this week by a student for a Security Onion lab, removed the student's name, and I'm providing it for example purposes.

Steve

 

[hosnypasha]

I think I've said it a number of times, but the three-year cycle we face with ANSI accredited CompTIA exams, coupled with the rapid changes in technology, has resulted in a reduction of technical textbooks and lab choices that are available. Think about it from an author or publisher's perspective. Books for ancient history classes don't have to be rewritten very often. This isn't true for the stuff we teach. I've welcomed the fact that CompTIA is now providing learning content. While we all could wish for better labs, I'm finding them much better than other resources in that they use a virtual network/virtual computer environment as opposed to simulations. I beef them up a bit by requiring students to fill out a simple lab report explaining what they did and what they learned. I plucked one of them out that was submitted this week by a student for a Security Onion lab, removed the student's name, and I'm providing it for example purposes.

Steve

@Steve Linithicum Kindly I disagree with you ,for successful labs in such high technolgy like cyber security it should be as the following:
1-Related to what is in real market like using solarwinds,Qradar,Nessus,....
2-Steps must be clear enough and close to what real security engineer do .
I hope next generation of CYSA+ avoids the bad design and dummy tools being tools used in the current version if Comptia is looking for getting higher share in training market.

 

[Rick Butler]

@Steve Linithicum Kindly I disagree with you ,for successful labs in such high technolgy like cyber security it should be as the following:
1-Related to what is in real market like using solarwinds,Qradar,Nessus,....
2-Steps must be clear enough and close to what real security engineer do .
I hope next generation of CYSA+ avoids the bad design and dummy tools being tools used in the current version if Comptia is looking for getting higher share in training market.

I don't think that's a fair statement to make. As a CySA+ myself, I was deluged with the cornucopia of tools and utilities in Security Onion and Kali and still am when you add in PenTest+. The tools aren't out there to train you in the use of that tool, but are representative of the concepts that tool would have. I didn't need SolarWinds, Qualys, or Nessus to get the exposure I needed. In fact, the only vulnerability scanner that I really used was OpenVAS/Greenbone, which is free, and real world. I was able to run vulnerability scans of my network and understand the derivation of CVSS scores against a particular vulnerability. And I actually like Greenbone.

I downloaded Paessler and found it more trouble than it was worth. But I got to love Zabbix. SolarWinds kept bothering me with marketing garbage when I just snagged one tool, and after their compromise, I got a little wary of them. ZenMap got dropped from the default build of Kali, in favor of just using nmap. I think ntop is one of the most underrated tools out there - and it is FREE to education. We all have the tools we "like" the ones we don't.

I wish someone would write a good solid open source free SEIM. But I'm not holding my breath.

But it's not about the tools; it's about the concepts those tools represent. Once you get the concept down, use the tool you think will do the best job for the money you are willing to pay.

I would, however, challenge you on which tools you think are "bad design and dummy tools". Elaborate that further, please.

CompTIA has to strike a balance. It maintains a position of vendor neutrality, so it has to be careful about the kinds of tools are represented in its exams. Just yesterday, even, Cameron Dodd make the lament that much of the functions represented in Domain 2 of Data+ were more Microsoft-heavy, rather than going into how they might be in other data analysis tools or SQL Server.

A long time ago, VMWare required education institutions to license their software like every other company. They didn't care who you were, they just wanted you to license up. Notwithstanding they had the market share for virtualization (and still do), but educational institutions could not afford it, so they were either consigned to use VirtualBox/KVM (which no one uses in a heavy production situation), or maybe HyperV. Eventually, they allowed for some usage, which I am glad to see. But there were students and instructors during that time that would fault the school because "we didn't spend enough on real world tools".

Anyway, no tool is worthless if it teaches you the concepts that you need to know - and that's the point of what we're doing here, rather than training a professional on how to use SolarWinds or Nessus.

/r

 

[admar]

Não acho que seja uma afirmação justa de se fazer. Como um CySA+, fui inundado com a abundância de ferramentas e utilitários no Security Onion e Kali e ainda estou quando você adiciona o PenTest+. As ferramentas não existem para treiná-lo no uso dessa ferramenta, mas são representativas dos conceitos que essa ferramenta teria. Não precisei de SolarWinds, Qualys ou Nessus para obter a exposição de que precisava. Na verdade, o único scanner de vulnerabilidade que eu realmente usei foi o OpenVAS/Greenbone, que é gratuito e do mundo real. Consegui executar varreduras de vulnerabilidade da minha rede e entender a derivação das pontuações do CVSS em relação a uma vulnerabilidade específica. E eu realmente gosto de Greenbone.

Baixei o Paessler e achei mais problemático do que valia a pena. Mas eu tenho que amar o Zabbix. A SolarWinds continuou me incomodando com lixo de marketing quando acabei de pegar uma ferramenta e, após o comprometimento deles, fiquei um pouco cauteloso com eles. O ZenMap foi retirado da versão padrão do Kali, em favor do uso apenas do nmap. Eu acho que o ntop é uma das ferramentas mais subestimadas que existem - e é GRATUITA para a educação. Todos nós temos as ferramentas que "gostamos" das que não gostamos.

Eu gostaria que alguém escrevesse um bom SEIM de código aberto e sólido. Mas não estou prendendo a respiração.

Mas não se trata das ferramentas; é sobre os conceitos que essas ferramentas representam. Depois de entender o conceito, use a ferramenta que você acha que fará o melhor trabalho pelo dinheiro que você está disposto a pagar.

Eu, no entanto, desafiaria você sobre quais ferramentas você acha que são "design ruim e ferramentas fictícias". Elabore mais isso, por favor.

A CompTIA precisa encontrar um equilíbrio. Mantém uma posição de neutralidade do fornecedor, por isso deve ter cuidado com os tipos de ferramentas representadas em seus exames. Ainda ontem, inclusive, Cameron Dodd lamentou que muitas das funções representadas no Domínio 2 do Data+ eram mais pesadas da Microsoft, em vez de entrar em como poderiam ser em outras ferramentas de análise de dados ou SQL Server.

Há muito tempo, a VMWare exigia que as instituições de ensino licenciassem seus softwares como qualquer outra empresa. Eles não se importavam com quem você era, só queriam que você licenciasse. Apesar de terem a participação de mercado para virtualização (e ainda têm), mas as instituições de ensino não podiam pagar, então eles foram destinados a usar VirtualBox/KVM (que ninguém usa em uma situação de produção pesada), ou talvez HyperV. Eventualmente, eles permitiram algum uso, o que estou feliz em ver. Mas havia alunos e instrutores durante esse período que culpariam a escola porque "não gastamos o suficiente em ferramentas do mundo real".

De qualquer forma, nenhuma ferramenta é inútil se ensina os conceitos que você precisa saber - e esse é o objetivo do que estamos fazendo aqui, em vez de treinar um profissional sobre como usar SolarWinds ou Nessus.

/r

I Agree with you