Instructor-led training

CNFE: Certified Network Forensics Examiner

The Certified Network Forensics Examiner was originally developed for a U.S.

Request a Training Proposal View Course Outline

What you'll learn

The Certified Network Forensics Examiner was originally developed for a U.S. classified government agency. The C)NFE takes a digital and network forensic skill set to the next level by navigating through over twenty modules of network forensic topics. The CNFE provides practical experience through our lab exercises that simulate real-world scenarios which cover investigation and recovery of data in network, Physical Interception, Traffic Acquisition, Analysis, Wireless Attacks and SNORT. The course focuses on the centralizing and investigating of logging systems as well as network devices.Â

Prerequisites

2 years of networking experience 2 years of IT Security Working Knowledge of TCPIPÂ

Course Outline

Module 1 -Digital Evidence Concepts

Overview
Concepts in Digital Evidence
Section Summary
Module Summary

Module 2 -Network Evidence Challenges

Overview
Challenges Relating to Network Evidence
Section Summary
Module Summary

Module 3 – Network Forensics Investigative Methodology

Overview
OSCAR Methodology
Section Summary
Module Summary

Module 4 – Network-Based Evidence

Overview
Sources of Network-Based Evidence
Section Summary
Module Summary

Module 5 – Network Principles

Background
History
Functionality
FIGURE 5-1 The OSI Model
Functionality
Encapsulation/De-encapsulation
FIGURE 5-2 OSI Model Encapsulation
Encapsulation/De-encapsulation
FIGURE 5-3 OSI Model peer layer logical channels
Encapsulation/De-encapsulation
FIGURE 5-4 OSI Model data names
Section Summary
Module Summary

Module 6 – Internet Protocol Suite

Overview
Internet Protocol Suite
Section Summary
Module Summary

Module 7 – Physical Interception

Physical Interception
Section Summary
Module Summary

Module 8 – Traffic Acquisition Software

Agenda
Libpcap and WinPcap
LIBPCAP
WINPCAP
Section Summary
BPF Language
Section Summary
TCPDUMP
Section Summary
WIRESHARK
Section Summary
TSHARK
Section Summary
Module Summary

Module 9 – Live Acquisition

Agenda
Common Interfaces
Section Summary
Inspection Without Access
Section Summary
Strategy
Section Summary
Module Summary

Module 10 – Analysis

Agenda
Protocol Analysis
Section Summary
Section 02
Packet Analysis
Section Summary
Section 03
Flow Analysis
Protocol Analysis
Section Summary
Section 04
Higher-Layer Traffic Analysis
Section Summary
Module Summary

Module 11 – Layer 2 Protocol

Agenda
The IEEE Layer 2 Protocol Series
Section Summary
Module Summary

Module 12- Wireless Access Points

Agenda
Wireless Access Points (WAPs)
Section Summary
Module Summary

Module 13 – Wireless Capture Traffic and Analysis

Agenda
Wireless Traffic Capture and Analysis
Section Summary
Module Summary

Module 14 – Wireless Attacks

Agenda
Common Attacks
Section Summary
Module Summary

Module 15 – NIDS_Snort

Agenda
Investigating NIDS/NIPS
and Functionality
Section Summary
NIDS/NIPS Evidence Acquisition
Section Summary
Comprehensive Packet Logging
Section Summary
Snort
Section Summary
Module Summary

Module 16 – Centralized Logging and Syslog

Agenda
Sources of Logs
Section Summary
Network Log Architecture
Section Summary
Collecting and Analyzing Evidence
Section Summary
Module Summary

Module 17 – Investigating Network Devices

Agenda
Storage Media
Section Summary
Switches
Section Summary
Routers
Section Summary
Firewalls
Section Summary
Module Summary

Module 18 – Web Proxies and Encryption

Agenda
Web Proxy Functionality
Section Summary
Web Proxy Evidence
Section Summary
Web Proxy Analysis
Section Summary
Encrypted Web Traffic
Section Summary
Module Summary

Module 19 – Network Tunneling

Agenda
Tunneling for Functionality
Section Summary
Tunneling for Confidentiality
Section Summary
Covert Tunneling
Section Summary
Module Summary

Module 20 – Malware Forensics

Trends in Malware Evolution
Section Summary
Module Summary

HANDS-ON LABORATORY EXERCISES

Lab 1 – Working with captured files

Exercise 1 – HTTP.pcap
Exercise 2 – SMB.pcap
Exercise 3 – SIP_RTP.pcap>

Lab 2 – Layer 2 Attacks

Exercise 1 – Analyze the capture of macof.
Exercise 2 – Manipulating the STP root bridge election process

Lab 2 – Active Evidence Acquisition

Lab 3 – Preparing for Packet Inspection

Lab 4 – Analyzing Packet Captures

Exercise 2: Analyze TKIP and CCMP Frames starting from 4-Way Handshake process.

Lab 5 – Case Study: ABC Real Estate

Lab 6 – NIDS/NIPS

Exercise 1 – Use Snort as Packet Sniffer
Exercise 2 – Use Snort as a packet logger
Exercise 3 – Check Snort’s IDS abilities with pre-captured attack pattern files

Lab 7 – Syslog Exercise

Lab 8 – Network Device Log

LAB 9 – SSL

Exercise 1- Decrypting SSL Traffic by using a given Certificate Private Key
Exercise 2 – SSL and Friendly Man-in-the-middle

Training locations