SCOR

Certification Path Link

New Cert Track CCNP Feb 2020 Link
New Cert Track CCNA Feb 2020 Link
New Re-certification Policy Link

Useful Files

pix_to_ftd.pptx
File Size:	371 kb
File Type:	pptx

Download File

clustering_role___flow_selection.pptx
File Size:	699 kb
File Type:	pptx

Download File

ftd_packet_processing_interactive_april_2020.pptx
File Size:	10040 kb
File Type:	pptx

Download File

ssl_decryption_explained.pptx
File Size:	210 kb
File Type:	pptx

Download File

ios_flexvpn.ppt
File Size:	160 kb
File Type:	ppt

Download File

White Board Files

scor_jan_2021.pdf
File Size:	22496 kb
File Type:	pdf

Download File

scor_16_nov_2020.pdf
File Size:	20404 kb
File Type:	pdf

Download File

scor_oct_2020.pdf
File Size:	20436 kb
File Type:	pdf

Download File

scor_sept_2020.pdf
File Size:	20569 kb
File Type:	pdf

Download File

scor_june_2020.pdf
File Size:	20737 kb
File Type:	pdf

Download File

ASA Flow Pre 8.3

Security Threats

Hacktivist, Anonymous Link

The Deep Web and Dark Web Link

Public Web Site for Hacking Link
Bluejacking/Bluesnarfing/Bluebugging Link

Evil Twin Attack using Starbuks WiFi and Raspberry Pie Link
WEP IV Attack Video Link
WPA Attacks Video Link , WPA Explained Video Link
TKIP and CCMP Video Link
Wi-Fi Protected Setup (WPS) Video Link
RFID Vs NFC Link

Fukushima Nuclear Plant Documentary Link

Attacking Tools

Best Hacking Tools Link
Wordlist Password File Link
Obtaining Windows Password Link
hping3 Kali Linux Link (ICMP/SYN?etc)
Online HASH generator NT/NTLM etc Link
DNSChef Kali Link
DNS Tunneling Kali Link
Buffer Overflow Attack DVWA Link
Pass The Hash Kali Link
Firewalk Kali Linux Link Link2
Mimikatz Link
List of useful tools Link

General Tools

Playbooks Link
Free Online Sandboxing/ Anti Malware Link
Public Web Site for Hacking Link
CVSS 3.0 Online Scoring Calculator Link
Windows sysinternal tool download link
URL Encoder/Decoder Link
Swiss Knife of on-line conversion tool Link
Epoch time converter Link

!!! Some Great Attacks !!!!

Bronze Soldier attack Estonia,
Human rights attacks and China,
HM Revenue & Customs lost accounts.
Mafia Boy DOS attack Feb/2000.
Anonymous attack against the Home Office.
Stuxnet attacks against atomic plants in IRAN.
Turkish Web site Hacking.
Spamming 350 million and the result = 28
E,T, A are the most common English letters in order of frequency
What is Phishing, redirection to malicious website, via email.
Vishing is as Phishing except via Phone.
Smishing is Phishing via SMS
What is Pharming, redirection to malicious website unknown (DNS/HOSTs)
Nimda Code Red 1999-2004,
Conficker worm 2008,
Stuxnet 2010,
NHS Attack May 2017 WannaCry Link

Admin/Tech/Physical Link
Common Vulnerabilities & Exposures CVE
EU-US Agreement re data transfer (Safe Harbour)
DNS DDOS attack. it almost broke the Internet 3/2013 (New Amplification)
NTP Attack Feb 2014 (Amplification)
Morris Worm first Internet -based worm 1988
Hacking Tools, sectools.org, Kali Linux, Metasploit
Basic Security Requirements CIA
Salted Password Hashing
MD5 Avalanche effect Hello World hash will be totally different to Hello World1, and MD5 Collision Demo
Simon Singh Web Site

Information Security Policies RUSECURE

Course Content

The SCOR course is an 8 day course with a combination of Instructor-Led Training (ILT) and Self Study.

Legend Green = ILT Red = Self Study

Describing Information Security Concepts

Inland Revenue lose 25 million records in post 2007 Link

CVSS 3.0 Online Scoring Calculator Link
Difference between MAC/DAC/RBAC Link

CVE Mitre org Link
CVE Details top 50 Link
Open-source intelligence (OSINT) Link Link2

OpenSOC Link

Personal Data with regard to GDPR Link

Safe Harbour to GDPR Link
COBIT & ITIL Link
DMCA Digital Millennium Copyright Act Link

Describing Common TCP/IP Attacks

ICMP Redirects and Routing tables (Scapy) Link
Scapy
ICMP Tunneling Link
ICMPTX Explained Link
ICMP OS Fingerprinting Link

Smurf (ICMP)/Fraggle (UDP)/Land.C (TCP ports) Link

Teredo Tunneling Tool Link
MaxMind GeoIP Link
PII Link

SQL Injection Attack (1=1) Link
SQL Slammer UDP 2003 Link
Teardrop DOS attack (Fragmentation) Link
DDOS attack against DNS "Dyn" Link
Botnets using HTTP for CnC Link

Firewalk Kali Linux Link Link2
robots.txt Link
Reconnaissance web site Shodan Link
OSINT Great reconnaissance tool Link

DNS DDOS attack. it almost broke the Internet 3/2013 (New Amplification)
NTP Attack Feb 2014 (Amplification)
Wiper 2013 Korea Link

Top 10 Botnets Link
Zeus MITM App attack (Banking) Link
What this website reveals about you webkay.robinlinus.com
Gather information from a website robots.txt Link
DDOS Cisco Solution (Arbor) ASR9000 Link

Describing Common Network Application Attacks

Public Web Site for Hacking Link

Pass The Hash Attack Video Link
How STRONG is your password

DNS Tunneling Kali Link
DNS Changer Link
DNSSEC Link
Fast Flux/Double Flux Link

Sammy KamKar Link Youtube cros-site scripting Link

Pharming, DNS Cache Poisoning Link
DNSSEC Link
DNSSEC and RRSIG Link
Dyn DNS Link

DNSSEC Link

URI and URL difference Link
HTTP Methods Link
HTTP Status Codes Link

Secure IMAP and SMTP ports Link

NetBIOS Link1 Link2
NetBIOS over TCP/IP Youtube Link

Cross-Site Scripting XSS Video Link
Cookies, Session Hijacking, and XCRF Video Link
SQL Injection / XML Injection Video Link
Buffer Overflow Video Link
Buffer Overflow Youtube Link
Man-in-the-Browser (Pivoting) Video Link

PERL/Python and PHP(Hypertext Preprocessor ) Link
originally Personal Home Page

Describing Common Endpoint Attacks

Describing Network Security Technologies

Security Intelligence

Virtualisation.
VLANS and VxLANS
VRF's
VRF-Lite
Stateful Firewall Link
Security Intelligence Link Talos Link

Cisco Threat Intelligence Director (part of FMC) Link
Structured Threat Information Expression (STIX) Link
Trusted Automated Exchange of Intelligence Info (TAXII) Link

IPS
NGFW
ESA
WSA

CTA - Cognitive Threat Analytics (now known as CI) Link
DNS Security Link
CASB (CloudLock) Link
AAA (ISE) Link
VPN

Network Device Form Factors (Physical/Virtual)

Deploying Cisco ASA Firewall

VPN & Routing support with Contexts Rel 9.0
Cisco AnyConnect ordering Guide/License is two tier "AnyConnect Plus" & "AnyConnect Apex" Link
Remote Access VPNs rel 9.5(2)
COA Support, 16 Active Links Ether/Chan Rel 9.2
Traffic Zones Rel 9.3
Local Lan Access "Profile Editor" Link
Local Lan Access via split tunneling, Cisco Link (not the best)

License Details 8.2
Product Details
DNS Resolution of ACL's names in Object groups
Configuring management access over a VPN to another interface
Exemption NAT V8.3
Reset RDP sessions
Managing feature licenses for V9.14 an below
How does Proxy ARP work on an ASA

Deploying Cisco Next-Generation Firewall

Object NAT

ICON's in ACP Link

Manual NAT

Excellent link to clarify FTD flows Link
A great link explaining the order of prefilter/ACP processing link

Excellent PDF all comms ports including 443 to the internet Link

DAQ (Data Acquisition) Troubleshooting Link
QOS Option on FTD is to Rate Limit Link
QOS 6.3 and above priority Q fudge Link
QOS FMC Guide V6.5 Link

Lina Code (ASA) before and after SNORT Process Link

Hardware by-pass fail-to-wire Link
Fail to Wire Hardware Modules Link
ACP Offloads, fastpath etc SmartNIC Link
Flow Offload (V6.3 now supports Snort) Link

ThreatGrid and Data Protection Link

FlexConfig replaced by Service Policies 6.30 onwards Link
FlexConfig still present in 6.3 to config features outside GUI ie EIGRP, however connections limits created in adv
area in ACP under "threat defense service policy"
Configuring TCP state bypass using FlexConfig Link
elephant/fat flow Link

Deploying Email Content Security

Top 10 file extensions

SMTP Codes

220-221-250-354

Notes:
1. Generally any dynamic updates are normally 5 minutes
2. If Message already in work queue changes to Antispam/Virus and Outbreak filters have no effect.
3. In Outgoing emails antispam/outbreak filters turned off be default can be enabled.
4. ESA has Data 1 initially configured (mangement enabled on this interface) Data 2 remains disconnected.
5. LDAP queries bypassed (RAT) ie employee in support@example.com
6. By pass throttling (RAT) ie postmaster@domain.com many recpts.
7. All messages that are processed by AV engine have
"X-IronPort-AV" added to messages
8. Asynchronous: service or application does not require a constant bit rate. Examples are file transfer, email and the World Wide Web.
Synchronous: service, is realtime streaming media, for example IP telephony, IP-TV and video conferencing.
9. Both SPAM engines can be enabled (IronPort/Cisco) only one used per policy,

DKIM (DomainKeys Identified Mail) & DMARC (Domain Message Authentication Reporting) Link

SIO/CIS/TOC/Talos?VRT differences Link

ESA Appliances Link
ESA Data Sheet Link
CES Cloud Email Security Link
Security updates from the cloud to the ESA Link
Updates from the cloud Link

Malicious code in PDFs Link

Cisco SMA (Security Management Appliance) Link

Average daily spam volume 307.5 billion (6/2018) Talo Link
Between 65% to 80% malicious threats via email
Talos Whitepaper Link
Three Pillars of Talos--SenderBase--Threat Operatsions--Dynamic updates

Embed URL's (as I do on this website) Link

DNS PTR Record Link
MX Records Priority Link
DNS Basic (Google) MX records with multiple priority Link
You can CLuster ESA's to make sure all ESA members of a Group recieve the same config (Important when using DNS priority.

HAT--Host Access Table and Pipeline Flow Link
RAT-Recipient Access Table Link
Advanced Network Config (Vlan's/Etherchannel) Link

SBRS--SenderBase(Sensorbase) reputation score Link
External Threat Feeds (new v12) STIX/TAXI Link
Configure Local Spam Quarantine on the ESA Link

Graymail -- Link
Polymorphic Virus -- Link

Able to parse attachment--read and process text stored inside e-mail attachments Link
=/= is --- does not equal

CASE-- Context Adaptive Scanning Engine Link
Applies over 100000 adaptive message attributes
Cisco solution replaces RSA for DLP on ESA Link‎

SIO/CIS/TOC/talos/VRT Link

Deploying Web Content Security

wsa_policy_interaction.pptx
File Size:	45 kb
File Type:	pptx

Download File

!!!Excellent Cisco Live WSA Presentation!!! Link

Notes:
Generally any dynamic updates are normally 5 minutes
Thread Grid analysis can take 15-20 minutes

SIO/CIS/TOC/Talos?VRT differences Link

WSA Data Sheet Appliances Link
What types of FTP proxy does WSA support Link

Cisco SMA (Security Management Appliance) Link

Web 2.0 (social content user generated input) Link
PAC Files (Proxy Auto-Configuration) Link
WCCP - Web Cache Communication Protocols Link
Uses Service Groups for Load Sharing
WCCP Platform Support Link
WPAD - Web Proxy Auto-Discovery Link Browser Support Link
CARP- Common Address Redundancy Protocol Link
DCA - Dynamic Content Analysis Link
(Invoked for uncategorised URL's typically <5%)
The Deep Web and Dark Web Link
DVS- Dynamic Vectoring and Streaming Link
DVS--Webroot Link

L4TM--Cisco Community Video Link
L4TM--Layer 4 Traffic Monitor inspects all ports Link
Not in-line mostly monitoring, can send TCP reset.
WSA Load balancing (DNS/PAC/AUto discovery/WCCP) Link
DNS Rotation
WPAD Web Proxy Auto-Discovery using DHCP/DNS Link
Configuring WCCP Link

Good document covering Identity Profile config Link
Authentication PDF Link

NTLMSSP--Link
Difference between NTLM and LDAP Link
Difference between NTLM and Kerberos Link

Cisco Web Security Reporting Link Linka
Cisco Web Security Monitor (Old) Link

NTLMSSP - NT Lan Manager Security Support Provider Link
HTTP Authentication (Basic/NTLM/Digest) Link
End-User Acknowledgement Page Link
HTTPS Decryption Flow and use of Monitor Link

ISE Integration SGT/IP to name supported Link

Safesearch Link

CTA - Cognitive Threat Analytics (now known as CI) Link

Deploying Cisco Umbrella

Note:
100% Uptime since 2006

EDNS Extension mechanisms for DNSLink

Explaining VPN Technologies and Cryptographic Concepts

ASA Anyconnect Double Authentication Link
Broker Applet Java/ActiveX (2018) link
IKE/IKEv2 Rekey Link
FlexVPN "Enrollment Terminal or URL" Link
FlexVPN Per-Peer Configration Link
NHRP Holdtime and Cache refresk Link
Using Hostname in IPsec Site to Site VPNs Link
Delete default ISAKMP Policies "no cry isakmp default polic"
VPN Authentication CRACK (Public keys/radius) Link
Supported Cisco VPN Platforms Link
GET PPT (2006) Link CCIE Tutorial Link
Online Diffie Hellman Calculator
DMVPN Phase 1/2/3 Link
Certificate Authority Link
"Identity Sent to Peer" Link
PFS and Y/N = N in IKE2, (Child SA created at time of Main SA)
DMVPNs Cisco Proprietary but a Draft RFC has been produced Link
The reasons for creating an empty IPsec profile (defaults) Link
"aaa authorization group cert list" explained
Using ASA Packet Trace to bring up VPN Link
Dead Peer Detection Link
Default Transform Set Link
DMVPN Explained including NHRP Timeouts Link
"ip nhrp map multicast" Link
Selecting the profile xml from the Anyconnect window Link
FlexVPN correct configuration examples for Spoke to Spoke (Shortcut)
"crypto ipsec profile" explained
Next Generation and legacy algorithms
DMVPNS with PSKs and wildcarding on the IP address HUB config
NHRP in FlexVPN and short cutting Spoke-to-Spoke
IKEV1 and IKEV2 rekeying Link
Controlling traffic within site to site VPN (ACLs and vpn-filter)
Wild carding Pre-shared keys for IPSEC
"ip flow ingress" explained
VTIs and identifying interesting traffic down the tunnel (Lab minutes)
ECDSA The digital signature of a better Internet
Elliptical Curve Cryptography ECC explained
Differences between Posture Module and standalone Host Scan Package
Deploying Posture Module and Host Scan packages
AES-GCM Explained
Galios Pronounced
IKE V2 PRF's Seperate process to generate IKEv2 key/hash material
ISAKMP Default Policy enable/disable
NHRP Explained and keepalives
FlexVPN Short Circuit configuration Link
Configuring the Tunnel Mode .The encapsulation mode for the tunnel interface defaults to generic route encapsulation (GRE),
Migration from DMVPN to FlexVPN (Phased Deployment)
IKE V2 & PRF
Excellent Cisco Live presentation on FlexVPN
FlexVPN using EAP Peer Authentication
DMVPN High Availability Sharing IPsec with Tunnel Protection
IKEv2 and Legacy Config
Filtering on Site to Site VPNs Link

Introducing Cisco Secure Site-to-Site VPN Solutions

Deploying Cisco IOS VTI-Based Pt/Pt IPsec VPN's

Migration of IKEv1 to IKEV2 ASA 8.4
Next Generation Encryption
DMVPN Phase 3 Blog
DMVPN & GET VPN Design and Case Study
Cisco IOS DMVPN Overview
Remote Access VPNs on ASA 9.0
Packet Capture on PIX/ASA
MultiPoint GRE Blog
DMVPM Migration to FlexVPN

sysopt connection permit-vpn link

Cisco IOS (Monolithic) IOS XE separate processes Link
Cisco IOS XE (ASR and ISR routers, WLC's Switches) Link

Cisco ASA VTI's only BGP dynamic routing supported Link

Deploying Pt/Pt VPN's with NGFW

No DMVPN/GETVPN/EzVPN support

Deploying RA VPN's NGFW

NOTE:
1 .You can enable a 90 eval license for four licenses
Base/Threat/Malware and URL Filtering
You cannot deploy Remote Access VPN if the following are true:
Smart Licensing on the Firepower Management Center is running in evaluation mode.
2. FTD can apply a filter on the tunnel traffic via group policy but unlike ASA must also have the tunnel permitted in the ACP. The access list in the Group Policy is totally separate to the main ACP
3. No SSL Clientless support on the FTD,

Certificate Chains Link
FAQs Anyconnect Licensing Link
Register Anyconnect license for use with FTD Link
Support for SSL Client and IKEV2 Link
Remote Access VPN and FTD Link

SCOR V1.0.158 day course 5 day's ILT, 3 day's self study

SCOR

General Links

Useful Files

White Board Files

ASA Flow Pre 8.3

Security Threats

Attacking Tools

General Tools

​!!! Some Great Attacks !!!!

Course Content

Describing Information Security Concepts

Describing Common TCP/IP Attacks

Describing Common Network Application Attacks

Describing Common Endpoint Attacks

Describing Network Security Technologies

Deploying Cisco ASA Firewall

Deploying Cisco Next-Generation Firewall

Deploying Email Content Security

Deploying Web Content Security

Deploying Cisco Umbrella

Explaining VPN Technologies and Cryptographic Concepts

Introducing Cisco Secure Site-to-Site VPN Solutions

Deploying Cisco IOS VTI-Based Pt/Pt IPsec VPN's

Deploying Pt/Pt VPN's with NGFW

Deploying RA VPN's NGFW

Explaining Cisco Secure Networks Access solutions

Describing 802.1x Authentication

Configuring 802.1x Authentication

Describing Endpoint Security Technologies

Deploying Cisco AMP for Endpoints

Introducing Network Infrastructure Protection

Deploying Control Plane Security Controls

Deploying Layer 2 Data Plane Security Controls

Deploying Layer 3 Control Plane Security Controls

Deploying Management Plane Security Controls

Deploying Traffic Telemetry Methods

Deploying Cisco Stealthwatch Enterprise

Describing Cloud and Common Cloud Attacks

Securing the Cloud

Deploying Cisco Stealthwatch Cloud

Describing SDN

SCOR V1.0.15
8 day course 5 day's ILT, 3 day's self study

!!! Some Great Attacks !!!!