OBJECTIF

Today, in order to claim to have a sufficient level of protection over the whole of its infrastructure, it is necessary to carry out audits. This course aims to illustrate all methods to test systems with all known attacks. Conducting an audit imposes rules and limitations that need to be known. This training describes the different audit methodologies and their particularities. A presentation of essential tools as well as practical work to understand and know their use will be made.

In particular, the objectives of the training are as follows:

• Delineate an audit, know the existing methods
• Know the rules and commitments of an audit, and its limitations
• What are the recognized methodologies

PREREQUISITES

•Course level HSF / HSA

• Knowledge of Linux and Windows systems

GENERAL INFORMATION

• Code : AUDSI
• Duration : 3 Days
• schedule : 8h30 - 17h30
• place : training center, Center Urbain Nord, Tunis

TARGETED AUDIENCE

• • Security Consultants
• • Developers
• • Engineers / Technicians

RESOURCES

• Course materials
• 40% demonstration
• 40% of theory
• 20% practical exercises

PROGRAM OF TRAINING

• Days 1
• Introduction to intrusion tests

• Definition of the intrusion test
• The interest of the intrusion test
• The phases of an intrusion test


• Recognition
• Vulnerability analysis
• Exploitation
• Gain and maintain access
• Reports and end of testss


• Rules and commitments

Technical scope of the audit

• Responsibility of the auditor
• Frequent Constraints
• Legislation: Articles of Law
• Usual precautions


• Types of intrusion tests

• External
• Internal


• Methodology

• Usefulness of the methodology
• Audit methods
• Recognized methodologies


• Features of the audit

• classical infrastructure
• SCADA infrastructure
• web
• code


• Days 2
• Configuration audit tools(SCAP, checklists, etc.)
• Code audit tools

• Code analysis tools
• Static analysis tools
 • Dynamic analysis tools


• The tools of information taking

Taking information

• Open Sources
• Active


scanning

• Port Scan
• Vulnerability Scan


• The attack tools

• Network Tools
 • System Analysis Tools
 • Web analysis tools
 • Operating Frameworks
 • Access maintenance tools


• Days 3
• Case study

•Application of methodology and tools on a concrete case

• Deliverables

• Risk Assessment
 • Impact, potentiality and criticality of a vulnerability
  • Organize the report
 • Additional services to propose