Class introduction

Hello, this is Song Dae-geun.

The AhnLab (AhnLab) CERT team was responsible for investigating various hacking incidents that occurred in private companies and public institutions. I was in charge of the SOC construction project and operation project PM at IBM Korea. If a hacking incident occurs through a class, I will tell you the know-how to analyze the cause of the attack.

When a cybersecurity incident, or hacking incident, occurs in an enterprise, an infringement incident response specialist in the corporate security team performs incident response work. Business impact must be minimized by quickly identifying the extent of damage and rectifying incidents.

Infringement incident response experts quickly rectify and normalize damage according to established incident response processes. If activities required to comply with laws or regulations required by the industry are omitted, penalties or additional implementation items may occur under relevant laws or regulations.

Explain corporate incident response procedures through classes. Also, when a hacking incident occurs, personal information is leaked. If a personal information leak occurs, we will let you know how the procedures for dealing with the infringement incident are carried out.

Companies conduct annual or quarterly training through simulated training for essential activities necessary to respond in the event of a security incident. In the training process, training is conducted to analyze the cause of the accident using various security tools. When a hacking incident actually occurs, an infringement incident response specialist uses a security solution to analyze the cause of the incident. Let's take a look at the analytical tools used by analysts like you.

Course effect

You can learn about response procedures for damage recovery in the event of a hacking incident.
You can learn how to respond to a personal information breach incident.
I would like to tell you about network intrusion detection systems (IDS).
Here are tips for analyzing network packets using Wireshark (Wireshark).
I will show you how to analyze web logs using Elasticsearch (Elasticsearch).

Recommended target

Those who are curious about the response process in the event of a hacking incident
Those who are interested in security tools required to analyze hacking incidents
If you have questions about the Snort (Snort) intrusion detection tool
If you are curious about a tool to efficiently analyze web logs

Pre-course notes

You must proceed directly with the Wireshark (Wireshark) installation used in the class.
The Elasticsearch (Elasticsearch) installation file used by the class must be downloaded and installed directly from the Elastic website.

What makes this class special

❶ Learn analytical tools and methods used by infringement response/analysis practitioners

If you don't have much experience analyzing breaches, it can be difficult to know where to start the analysis and how to perform log analysis when investigating an incident. I will tell you the response process carried out by an analyst who analyzes hacking incidents through classes.

We will share sample logs for analysis and analysis know-how through practical examples so that you can quickly find the cause of the incident and identify attack paths. You'll learn how to analyze efficiently.

Screenshot 2023-06-12 at 10.28.17 AM.png

Screenshot 2023-08-09 at 4.57.12 PM.png

❶ Method and know-how of using Wireshark for network packet analysis

The hacking path is traced through stored packet analysis. We'll show you how to apply network packet filtering to find internal systems infected with malware or to find attackers that have attempted attacks using vulnerabilities.

Protocol Hierarchy 2.png

❷ How to use Elasticsearch for mass log analysis and know-how

I will teach you the basic concepts for analyzing web logs using Elasticsearch Engine, a log analysis tool of Daeyongrang, an open source project. Sample logs for practical exercises are provided for concept learning.

ChatGPT_샘플로그활용.png

Add logs 2.png

Hacking incident response procedures and analytical tools used by experts

Hacking incident response procedures and analytical tools used by experts