CREST Registered Intrusion Analyst Exam Syllabus

Registered Intrusion Analyst PDF, CRIA Dumps, CRIA PDF, Registered Intrusion Analyst VCE, CRIA Questions PDF, CREST CRIA VCE, CREST Registered Intrusion Analyst Dumps, CREST Registered Intrusion Analyst PDFUse this quick start guide to collect all the information about CREST Registered Intrusion Analyst (CRIA) Certification exam. This study guide provides a list of objectives and resources that will help you prepare for items on the CRIA CREST Registered Intrusion Analyst exam. The Sample Questions will help you identify the type and difficulty level of the questions and the Practice Exams will make you familiar with the format and environment of an exam. You should refer this guide carefully before attempting your actual CREST Registered Intrusion Analyst certification exam.

The CREST Registered Intrusion Analyst certification is mainly targeted to those candidates who want to build their career in Incident Response domain. The CREST Registered Intrusion Analyst (CRIA) exam verifies that the candidate possesses the fundamental knowledge and proven skills in the area of CREST Registered Intrusion Analyst.

CREST Registered Intrusion Analyst Exam Summary:

Exam Name CREST Registered Intrusion Analyst (CRIA)
Exam Code CRIA
Exam Price $400 (USD)
Duration 150 mins
Number of Questions 150
Passing Score 60%
Schedule Exam Pearson VUE
Sample Questions CREST Registered Intrusion Analyst Sample Questions
Practice Exam CREST CRIA Certification Practice Exam

CREST CRIA Exam Syllabus Topics:

Topic Details

Soft Skills and Incident Handling
Engagement Lifecycle Management
- Benefits and utility of incident response to the client.
- Awareness of steps that can be taken to prepare for potential incidents.
- Structure of incident response engagements, including the relevant processes and procedures.
- Knowledge of appropriate actions that should be taken when investigating an incident. Understanding
that some actions should be avoided due to risk of evidence corruption.
- Know how to safely handle malware and potentially malicious files encountered during an engagement.
- Understanding limitations of system logs.
Incident Chronology
- Use of timelines to analyse event data
- Time zone issues
- System interpretation of timestamps with images
Law & Compliance
- Knowledge of pertinent UK legal issues:
- Computer Misuse Act 1990
- Human Rights Act 1998
- Data Protection Act 2018 and General Data Protection Regulation (GDPR)
- Police and Justice Act 2006
- Regulation of Investigatory Powers Act 2000
- Criminal Justice Act 2008
- Protection of Children Act 1978
- Sexual Offences Act 2008
- Digital Millennium Copyright Act and consequences for reverse engineering.
- Knowledge of evidential integrity and chain of custody.
- Awareness of sector-specific regulatory issues (e.g. FSA, PCI). Understanding of situations that require notification of thirdparties.
- Understanding of when and how to engage law enforcement
- Knowledge of CERTS and their role and jurisdiction
Record Keeping, Interim Reporting & Final Results
- Understanding reporting requirements.
- Understanding the importance of accurate and structured record keeping during the engagement.
Threat Assessment
- Understanding how a threat translates to the client and the business context of a given incident.
- High level methodologies surrounding threat assessment.
- Attribution of attacks.
- Knowledge of attacker motivation.
- Identifying key individuals likely to be selected for targeted attack.

Core Technical Skills
IP Protocols
- IP protocols: IPv4 and IPv6, TCP, UDP and ICMP.
- Detailed knowledge of application layer protocols commonly used by Trojan malware, namely TCP, UDP, HTTP[S], SMTP, and DNS.
- In-depth understanding of how the Internet (web browser/server architecture) and email systems function.
- Fundamental knowledge of at least the following protocols; IRC, DHCP, FTP, SMB, SNMP, ICMP.
Network Architectures
- Varying networks types that could be encountered during analysis:
- CAT 5/6
- Basic understanding of common fibre technologies
- Windows Domain architectures
- Network Address Translation
- 10/100/1000baseT
- Wireless (802.11)
- Security implications of shared media, switched media and VLANs.
- IP Subnets
- IP Routing
Common Classes of Tools - Knowledge of common classes of tools used to perform intrusion analysis and reverse engineering. Basic
understanding of the capabilities of common tools.
OS Fingerprinting - Passive operating system fingerprinting techniques.
Application Fingerprinting
- Determining server types and network application versions from evidential data.
- Identification of client software versions from meta-data contained within common document types.
- Identification of client/server software versions from service banners, user-agent strings, email headers etc.
Network Access Control Analysis - Reviewing firewall rule bases and network access control lists.
Cryptography
- Differences between encryption and encoding.
- Symmetric / asymmetric encryption
- Encryption algorithms: DES, 3DES, AES, RSA, RC4.
- Hashes: SHA family and MD5
- Message Integrity codes: HMAC
Applications of Cryptography
- SSL, IPsec, SSH, PGP
- Common wireless (802.11) encryption protocols: WEP, WPA, TKIP
File System Permissions
- File permission attributes within Windows file systems and their security implications.
- Analysing registry ACLs.
Host Analysis Techniques
- Listing processes and their associated network sockets (if any).
- Assessing patch levels on a Windows host using the command prompt.
- Finding interesting files on a Windows host.
Understanding Common Data Formats
- Candidates are expected to be able to interpret email headers, commenting on the reliability of the information contained within.
- Understanding of the information contained within a PKI certificate
- Understanding of various encoding employed for transmission of data (e.g. web and email)

Background Information Gathering and Open Source
Registration Records - Information contained within IP and domain registries (WHOIS).
Domain Name Server (DNS)
- DNS queries and responses
- DNS zone transfers
- Structure, interpretation and analysis of DNS records:
  • SOA
  • MX
  • TXT
  • A
  • NS
  • PTR
  • HINFO
  • CNAME
- Awareness of dynamic DNS providers, how they function and security implications. Understand the concept of fast-flux DNS.
Open Source Investigation and Web Enumeration
- Effective use of search engines and other open source intelligence sources to gain information about a target.
- Knowledge of information that can be retrieved from common social networking sites
Extraction of Document Meta Data - Be able to extract meta-data such as author, application versions, machine names, print and operating system information from common document formats.
Community Knowledge
- Ability to interpret common anti-virus threat reports
- Ability to interpret open-source research when investigating incidents, eliminating false positives.
- Knowledge of popular open-source security resources (web sites, forums, etc.).

Network Intrusion Analysis
Network Traffic Capture
- Methods of data collection and types of data to be collected.
- Designing a collection system to ensure sufficient data is collected without overwhelming capture devices.
- Impact assessment of any changes to network.
- Knowledge of SPAN ports, traditional network TAPs and aggregating TAPs.
- Ability to estimate capture requirements during scoping.
- Consideration of appropriate capture device deployment location.
- Constraints and limitations of capture and analysis toolsets. Knowledge of different capture options (e.g. NetFlow, limited capture, full packet capture etc.)
- The ability to assure integrity and security of network after introduction of a capture device
- Provide arguments and evidence that supports the integrity of any data captured.
Data Sources and Network Log Sources
- Types of data to be collected and existing data sources which should be considered to provide a complete picture of activity.
- Candidates should be familiar with the type of information provided in at least the following:
  • Proxy logs
  • syslogs
  • Email logs
  • Firewall logs
  • DHCP logs
  • VPN logs
  • Web server logs
  • Antivirus logs
  • DNS logs
  • Domain logs
  • Windows event logs
  • Internet history
  • Database logs
- Correlation of information contained within any number of different log formats.
Network configuration security issues
- Observation/detection of common network misconfiguration issues such as:
  • IP Routing issues
  • DNS information leakage
  • Unexpected traffic routes
  • Email routing issues
  • Firewalls/rules not working
- Detection of deliberate attempts to bypass firewall/proxy rules.
Unusual Protocol Behaviour
- Observation/detection of common protocols exhibiting non-standard behaviour.
- Verification of various protocols regardless of TCP/UDP port in use.
- Identification of illegal protocol usage for purposes of vulnerability exploitation or cache poisoning etc.
Beaconing - Ability to recognise and detect both covert and open malware beacons from statistical analysis, signatures, and manual review of traffic and logs. Traffic may include a variety of IP protocols.
Encryption
- Understanding of channel fingerprinting.
- Analysis of traffic flows (volume, directions, QoS, timing, custom or standard encryption).
- Identification of weak obfuscation using XOR, ROL or codebooks and approaches to deobfuscation.
Command and Control Channels - Ability to recognise and detect both covert and open C&C from statistical analysis, signatures, and manual review of traffic and logs. Traffic may include a variety of IP protocols.
Exfiltration of Data - Ability to recognise and detect both covert and open exfiltration of data from statistical analysis, signatures, and manual review of traffic and logs. Traffic may include a variety of IP protocols.
Incoming attacks - Detect successful incoming attacks against public facing services, including email, from statistical analysis, signatures, and manual review of traffic and logs. Traffic may include a variety of IP protocols.
Reconnaissance - Detect internal and external reconnaissance activities from statistical analysis, signatures, and manual review of traffic and logs. Traffic may include a variety of IP protocols.
Internal spread and privilege escalation - Detect the spread of malware within a network and indicators of privilege escalation from statistical analysis and manual review of traffic that may include a variety of different IP protocols and logs.
Web based attacks
- Ability to identify potentially malicious elements within HTML and other common web file types
- Ability to decode obfuscated JavaScript code and determine whether or not the code is malicious in nature.
False Positive Acknowledgement
- Determine whether or not a given IDS alert is a true hit or false positive.
- Suggest improvements to common IDS signatures to reduce false positive rates.

Analysing Host Intrusions
Host-based Data Acquisition
- Fundamental acquisition concepts, techniques and methodologies, including static and dynamic evidence gathering and image formats.
- Local and remote acquisition scenarios.
Live Analysis Laboratory Setup
- Basic infrastructure configurations
- Host hardening and sandbox environments Booting an image
- Issues relating to dynamic analysis of executables
Windows File System Essentials
- Disk partitioning
- FAT – File Allocation Table, directory entries
- NTFS – $MFT, $Bitmap
- ACLs & SIDs
- Unallocated space
- File carving
- EFS & BitLocker
Windows File Structures
- Prefetch
- Volume Shadow Copy
- System Restore Points
- User profiles
- Temporary files
- Network configuration (hosts file)
- Pagefile & hibernation file
- Shimcache
- Registry hives
- Recycle bin
- Event logs (Binary XML e.g. evtx)
- NTDS (Active Directory)
- WMI (OBJECTS.DATA)
Application File Structures
- Archive formats (Zip, RAR, etc)
- Browser artefacts
- PE files
- Office documents (OLE and Office Open XML), including knowledge of DDE and Macro exploits
- PDF
- Email file structures (Exchange, PST)
- AV artefacts (quarantines and logs)
- Thick-client files (Java, Flash, .NET)
- Log files
Windows Registry Essentials
- Registry structures (hive format)
- USB/removable storage artefacts
- Autorun/startup locations
- ACLs
- Protected storage
- Shimcache
- User accounts
Identifying Suspect Files
- Use of hash tables to find common malware
- Strings
- File permissions
- Packed executables
- Fuzzy hashing
- Signature analysis
Storage Media
- Hard Disks – Interface types (PATA/SATA, SCSI, SAS), HPA, DCO, Password protection
- Solid State Devices – Hard Disks, Pen Drives, Media Cards, wear levelling issues, how this media type varies from magnetic
- Full Disk Encryption
- RAID – levels of RAID type and error correction
- NAS
Memory Analysis
- Analysis – running processes, parent/child process identification, DLLs, sockets
- Process acquisition
- Clipboard contents
- Correlating memory artefacts with on-disk applications
- Network connections
- Command prompt history
- Browser history
- Use of common memory analysis frameworks (e.g. Volatility)
Infection Vectors
- Infected Executables/DLL, Documents (Macros, DDE), JavaScript
- Drive-by downloads
- USB/external media/shared drive vectors
- Passive exploitation
- Email-based attacks
Malware Behaviours and Anti-Forensics
- Encryption
- Steganography
- Password Protection
- Obfuscation
- Covert storage techniques
- Covert communication techniques (command and control, recon, and exfiltration)
- Data Erasure Applications
- Filing System – NTFS ADS
Rootkit Identification
- How to identify rootkits
- Hooking techniques
Live Malware Analysis
- Identification of open files/registry keys/network sockets
- Process monitoring tools
Linux OS File Structures
- utmp
- btmp
- wtmp

Reverse Engineering Malware
Windows AntiReverse Engineering
- Common techniques to prevent debugging or virtualisation of the malware code and ways of circumventing them.
- Known anti-reverse engineering techniques including high profile bugs in common debuggers and disassemblers.
Functionality Identification
- Identifying common cryptographic algorithms in binaries through, for example, use of standard constants and common instructions.
- Identifying network send/receive loops
- Infection vectors and persistence mechanisms
Windows NT Architecture
- Core architecture of NT kernel and user mode, including process model and security mechanisms (Windows XP and newer)
- NT Native APIs, Driver interfaces
- Differences between 64 bit and 32 bit platforms
Windows API Development - Common API calls, e.g. file, network.
Binary code structure
- Function calling conventions
- Compiler generated constructs, e.g. binary implementation of C++ objects (Virtual Function Table etc.)
Cryptographic Techniques
- Encryption Key material identification and extraction
- Identifying implementation weaknesses
Processor Architectures
- Intel x86/x64 instruction set
- Virtual Memory Implementation
- Virtualisation Technology
Windows Executable File Formats
- Standard windows executable formats (e.g. PE, EXE, COM)
- Extracting important information in executable files
Hiding Techniques
- Common techniques for process injection
- Rootkit techniques for hiding files and other system resources including:
  • SSDT patching
  • Filter drivers
  • Process list manipulation
Malware Reporting
- Signature identification
- Cleanup of malware
- Infection vectors
- Footprint
Binary Obfuscation
- Packers and Executable Encryption
- Techniques to restore packed executables
- Rebuilding executable content from memory
- Virtual machine instruction sets (e.g. PCode)
Behavioural Analysis
- Use of common tools to identify patterns of behaviour
- Aspects of command and control
- Infection vectors and persistence mechanisms

Incident Management
Client management - Client and project management, including effective management of the people involved during volatile and highly charged situations.
Containment techniques - Containment techniques with short and medium-term actions that are properly considered and risk-assessed for each environment. This requires an awareness of business continuity arrangements and requirements for the wider business.
Project management and time management - Project management and time management are essential investigative and management skills for managing staff, costs and deliverables to meet client requirements. Contracts, NDAs, scope and authorisation all need careful proactive management during an engagement
Evidence handling - Evidence handling and control and management of the evidential chain require a qualified person to take control of the situation, keep the appropriate logs and take the necessary actions to preserve evidential integrity.
Communications
- Communications both to the client and also to third parties needs to be carefully managed and scripted to avoid misinformation spreading and messages being poorly understood. This involves working with PR and branding teams to ensure all media contact is appropriately managed.
- This may require use of an existing crisis management plan.
Recovery and remediation - Recovery and remediation options are necessarily very client and project specific. Appropriate guidance is needed based on multiple requirements such as time, cost and on-going threat.
On-going technical prevention - Once an environment has been cleared of malware it essential to ensure that measures are in place for on-going technical prevention. These may be changes to business practices, user environments or architectural changes to security at a wider organisational level.
Judgement making and critical reasoning - When working in volatile situations it is essential that the ongoing drip feed of information is used to update the understanding of the situation in near real time. This requires critical reasoning and judgement making skills and the willingness to completely change a position as new information comes to light.
Written skills - Written comprehension is a key part of taking information from the numerous reports and data sources available.
Third Parties - Dealing with external third parties in a knowledgeable way is becoming an ever more important part of incident response as more services are being offloaded to SaaS, IaaS and other cloud offerings.
Reporting Agencies - Dealing with external reporting bodies often falls within the remit of an incident manager, even if this is only a case of explaining to a client who needs to be contacted. Awareness of relevant CERTs, government agencies and public bodies (eg FSA) is essential.
Threat intelligence, Contextualisation Attribution and Motivation. - Keeping up to date with threat intelligence and situational awareness is essential. This can include open source information, company specific research and also classified sources. Identifying likely actors and their motivation.
Industry Best Practice
- Awareness of industry best practice and open/industry standards (SANS, ENISA, NIST and ISO standards)
- GPG13 and Forensic readiness planning (SPF)
Risk Analysis
- Business Impact Assessments
- Awareness of the relevance and importance of Risk
- Assessments and Business Impact Assessments to the role of an incident manager in providing
appropriate guidance to a client organisation.
Attack & compromise lifecycle.
- Attack / compromise lifecycles (kill chain). Anatomy of an attack and the key components and stages of an incident.
- Compromise, Disruption, Extraction of data, etc.
Legal and Jurisdictional Issues - Complexities of remote and international working, including legal and jurisdictional issues and also the added complexity of remote capture over variable quality WAN links.
Ethics - An awareness of the strong ethical requirements needed when working in incident response. This includes a detailed understanding of the CREST Code of Conduct and the responsibilities it places on individuals and companies.
Technical vulnerability root cause identification - Technical vulnerability root cause identification requires seeing further than the technical issues and identifying business level strategic failures that allowed a problem to occur in the first place. Missing patches may be accidental or endemic and may reoccur if the root cause is not identified and treated.
Physical threats - An awareness of potential physical threats that provide may provide network access is required. Many attacks may be a blend of logical and physical attacks, such as those originating from public access locations or wireless networks.
Insider attacks - An awareness of potential insider attacks and attacks that start with exploiting human targets. This includes lost hardware such as media sticks, laptops, phones and other portable devices.

Computer Networking Fundamentals
Wireless Networking
- Understanding the existence and use of varying networks types that could be encountered during an architecture project:
  • Wireless (802.11a)
  • Wireless (802.11b/g/n)
  • WiMax
  • Microwave Point to Point
  • Optical Point to Point
  • 2G/3G/4G (GSM, GPRS, HSDPA)
  • TETRA
Virtual Private Networks
- Understanding the existence and use of varying VPN types that could be encountered during an architecture project:
  • Point to Point
  • Roaming remote user
  • Virtual Circuits / Tagging
  • IPSEC
  • PPTP
  • L2TP
  • SSL/TLS
  • SSTP
  • DMVPN
  • MPLS
ICMP - Understanding the existence and uses of ICMP messages and how the various message types can be useful in designing and debugging a network architecture.
IPV6 - Understanding the existence and benefits of IPv6 , together with potential exposures as a result of using this protocol and issues around interoperability with existing legacy systems.
DNS
- Understanding the existence and use of DNS protocol and services both within the public Internet and also within corporate networks. This will specifically include the role of DNS within Microsoft Active
Directory.
  • DNS queries and responses
  • DNS zone transfers
  • Public DNS Hierarchy & Authorities
  • DNS Security Options & Risks
  • Reverse DNS
- Structure and interpretation of key types of DNS record entries:
  • MX
  • A
  • NS
  • PTR
  • CNAME
NTP
- Understanding the existence and use of NTP protocol and services both within the public Internet and also within corporate networks. This will specifically include the importance of NTP within logging and monitoring solutions.
  • Time sources
  • Authoritative sources
  • Time synchronisation
Bluetooth
- Understanding the existence and use of the Bluetooth protocol and services and their implications for the security of the wider corporate network architecture.
  • Potential Attack Vectors
  • Range Limits
  • File Transfer
  • Personal Area Data Networking
IPV4
- IPv4 network fundamentals including understanding of
  • IP addresses
  • Subnet Masks
  • Public / Private IP Space
  • ARP protocols
  • Network Address Translation
  • Fragmentation
  • Quality of Service
  • CIDR
TCP/UDP
- TCP/UDP network fundamentals including the implications of
  • Connection orientated links
  • Connectionless links
  • Resilience / Packet Loss
  • Applications of TCP versus UDP
Routing Protocols
- Routing fundamentals including an understanding of
  • CIDR
  • RIP
  • OSPF
  • EIGRP
  • Static Routing
  • Failover
  • HSRP
  • BGP
Data Link Layer
- Layer 2 network fundamentals including an understanding of
  • Ethernet
  • VLANS
  • DSL
  • ISDN
  • PPP
  • ARP
- To include effects of packet size limits, latency, broadcast domains and the types of segregation available within these protocols.
Physical Layer Networks
- Layer 1 physical network fundamentals including an understanding of
  • Copper Ethernet
  • Fibre Optic Ethernet
  • Satellite Links
  • Radio Links
  • ATM
  • SDH
  • MTU
- To include effects of packet size limits, latency, broadcast domains and the types of segregation available within these protocols.
SNMP
- Understanding the existence and use of SNMP protocols for systems monitoring, particularly within corporate networks. This will specifically include the importance of SNMP within logging and monitoring solutions.
  • Community Strings / Authentication
  • Encryption
  • SNMP Versions
Syslog - Understanding the existence and use of Syslog protocol for systems monitoring, particularly within corporate networks. This will specifically include the importance of Syslog within logging and monitoring solutions and inherent weaknesses within the protocol.

Virtualisation Technologies
Hardware Virtualisation
- Understanding the existence and use of hypervisor solutions to provide platform virtual machine solutions and the security implications (notably management issues and lack of physical segregation) of these technologies.
- Example – VMWare ESXi (VSphere)
Ethernet based Virtual LANs (VLANs) - Understanding the appropriate configuration and uses of VLAN technologies in system architecture design and the security implications (notably management issues and lack of physical segregation) of these technologies.
Virtualised Firewalls
- Understanding the appropriate configuration and uses of  virtualised firewall solutions and the security implications (notably management issues and lack of physical segregation) of these technologies.
- Example – Juniper Netscreen VSYS
Virtualised Operating Systems
- Understanding the appropriate configuration and uses of virtualised operating systems and the security implications (notably management issues and lack of physical segregation) of these technologies.
- Example – Solaris Containers
Virtualised Databases
- Understanding the appropriate configuration and uses of virtualised database systems and the security implications (notably management issues and lack of physical segregation) of these technologies. This will include the difference between database instances and virtual databases.
- Example - Oracle (11g) Virtual Private Database
Cloud Technologies
- Understanding the implications of Cloud solutions including Software as a Service (SaaS), Cloud hosting and Cloud Storage.
- Note this section refers to the specific concerns around the use of shared clouds as the virtualisation technologies employed are dealt with earlier in this section.

Platform Security
Operating Systems
- Awareness of common server and desktop operating systems and their fundamental security characteristics. To include
  • Microsoft Windows (all)
  • Sun Solaris
  • HP UX
  • AIX
  • Linux (all) & BSD (all)
  • Mac OS X
Hardware Thin Client systems
- Awareness of common thin client hardware platforms, their base operating systems and their fundamental security characteristics. To include
  • Wyse ThinOS
  • Windows XP Embedded
Mobile Devices
- Awareness of common mobile hardware platforms, their base operating systems and their fundamental security characteristics. To include
  • Apple IOS (IPhone, IPad)
  • Android (tablets and phones)
  • Windows Mobile
  • Blackberry
Desktops
- Awareness of common desktop platforms, their base operating systems and their fundamental security characteristics. To include
  • Laptops
  • Netbooks
  • Desktops
  • Windows (all)
  • Linux & BSD
  • Apple (all)
  • Lockdown policies (including GAP)
Embedded Systems
- Awareness of common embedded systems and their fundamental security strengths and weaknesses
  • NAS Devices
  • IP Cameras / CCTV
  • NTP time sources
  • Logging & Monitoring solutions
  • Network Diagnostic equipment
  • Building Management Systems
  • HVAC Systems
  • Physical Security/Alarm Systems
SAN and NAS systems
- Awareness of common SAN and NAS technologies and their fundamental security strengths and weaknesses (including management issues)
  • Fibre Channel
  • ISCSI
  • LUNs
  • Partitioning / Separation
  • NFS
  • SMBFS/CIFS
Multi-Function Devices
- Awareness of common network enabled Multi-Function Devices and their fundamental security strengths and weaknesses.
- Example - Combination printer/scanner/copier/fax devices offer rich variety of functionality to users but are often not configured appropriately for use in secure environments.
Trusted Computing
- Awareness of Trusted Platform Module concepts and common hardware and software components and their implementations.
- Specifically how the TPM can be used to increase platform integrity and to provide more secure disk encryption and password protection solutions.
Resilience - Awareness of the need for and requirements of typical resilience solutions. Including resilience concepts such as hot standby, dual routing and implementations such as RAID, clustering (including databases), fault tolerant clouds, HSRP and VRRP.
Databases
- Awareness of common databases and their fundamental security strengths, weaknesses and architectural features.
  • Microsoft SQL
  • Oracle
  • MySQL
Desktop Virtualisation
- Awareness of common thin client technologies and the implications they have for security when connected to a corporate network.
  • Microsoft Terminal Services
  • Citrix (CAG etc)
  • VMWare View (VDI)
  • VNC
Personal devices
- Awareness of the security implications of devices not owned and managed by a corporate entity being connected to a corporate network or used to process its data.
  • Laptops
  • Mobile Phones
  • PDAs
  • Tablets
  • Home Computers
Platform and Application Logging
- Understanding the existence and use of Operating System and Application level logging and auditing functions. This includes the Windows Event sub-system for monitoring, particularly within corporate networks. This will specifically include the importance of data level logging of event such as
  • File Access audit logs
  • Database Access audit logs
  • Web Server Logs
  • Middleware Application Logs

Identification and Access Management
Directories and Identity Management
- Awareness of the common directory technologies used in large scale network architectures.
  • Microsoft Active Directory
  • LDAP
  • Microsoft Federated Identity Manager
  • Novell Netware (Open Enterprise Server)
  • Lotus Notes
- Understanding of the principles of identity and how these differ from access and authentication controls.
Role Based Access Controls (RBAC) - An understanding of the design concepts required to implement an effective RBAC solution, notably Subject, Roles and Permissions.
Authentication - Awareness of the common single and multifactor authentication schemes available including passwords, tokens, certificates, single sign on and biometric solutions.
Smart Cards - Awareness of the uses and commercially available implementations of Smart Card authentication systems for use in enterprise class IT systems.
RFID & NFC - Awareness of the uses and commercially available implementations of RFID & NFC authentication systems for use in enterprise class IT systems. An awareness of the wider use of RFID technologies is also required.
Biometrics - Awareness of the uses and commercially available implementations of biometric authentication systems and their limitations in large scale practical solutions.

Applications
Thin client - An understanding of the concepts behind thin client applications and the implications they have for system design and the placement of security barriers such as firewalls.
Thick client - An understanding of the concepts behind thick client applications and the implications they have for system design and the placement of security barriers such as firewalls.
Web client - An understanding of the concepts behind web client applications and the implications they have for system design and the placement of security barriers such as firewalls.
Email/Messaging - An understanding of the concepts behind messaging systems such as email and the implications they have for system design and the placement of security barriers such as firewalls and content filters.
VOIP - An understanding of the concepts behind VOIP applications and the implications they have for system design and the placement of security barriers such as firewalls.
Mobile applications - An understanding of the concepts behind mobile applications and the implications they have for system design and the placement of security barriers such as firewalls due to their tendency to significantly increase the size of the security perimeter.
SCADA - An understanding of the concepts behind SCADA systems and the types of networks and technology often used to support them. An awareness of the key differences in approach to security compared to “standard” computer systems is also required.

Security Methodologies
Malware Protection - Awareness of the tools and products available to provide protection against attacks from malware and viruses.
Content Filtering - Awareness of the tools and products available to identify inappropriate and potentially malicious content in data transmissions such as email and web access.
DLP - Awareness of the tools and products available to enable Data Loss Prevention.
File Integrity Monitoring - Awareness of the tools and products available to identify unauthorised changes to files and file systems that may be the result of malware or hacker attacks.
SIEM - Awareness of the tools and products available that provide Security Information and Event Management capabilities for large corporate networks and systems.
Network Firewalls - Awareness of the common network firewall products that are available on the open market and an understanding of the capabilities they offer. Specifically, an understanding of the role of network firewalls and the threats they can and cannot protect against.
XML Firewalls - Awareness of the common XML firewall products that are available on the open market and an understanding of the capabilities they offer. Specifically, an understanding of the role of XML firewalls and the threats they can and cannot protect against.
Application Firewalls - Awareness of the common application firewall products that are available on the open market and an understanding of the capabilities they offer. Specifically, an understanding of the role of application firewalls and the threats they can and cannot protect against.
IDS/IPS - Awareness of the common IDS/IPS products that are available on the open market and an understanding of the capabilities they offer.
VPN Products - Awareness of the common VPN products that are available on the open market and an understanding of the capabilities they offer. Specifically the appropriateness of various products for use on government networks and their ability to be operated in line with relevant government standards.
Data Encryption - Awareness of the commonly available products used for encrypting data in transit and data at rest. Specifically the capabilities of the products in terms of the algorithms they offer and the types of authentication schemes they support.
Diodes - Awareness of the commonly available products used for ensuring information can flow only in one direction between computer systems.
DRM - Awareness of the commonly available products used for securing and controlling the distribution of proprietary information.
HSM - Awareness of the commonly available Hardware Security Module (HSM) products.

Security Vulnerabilities and Prevention Techniques
Content Injection - Awareness of the common types of cross site scripting attacks and how they can affect web applications. The differences in risk profile between internal and Internet facing applications should be understood.
SQL Injection - Awareness of the common types of SQL injection attacks and how they can affect both web applications and traditional applications. The differences in risk profile between internal and Internet facing applications should be understood.
Command Injection - Awareness of the common types of command injection attacks and how they can affect both web applications and traditional applications. The differences in risk profile between internal and Internet facing applications should be understood.
Buffer Overflows - Awareness of the common types of buffer overflow attacks and how they can affect applications.
Script Attacks - Awareness of the common types of script language attacks and how they can affect applications. The default Windows client-side scripting languages should be understood.
File System attacks - Awareness of the common types of file system mistakes and consequent attacks and how they can affect the security of systems.
User Escalation - Awareness of the common types of desktop weakness and consequent attacks and how they can affect the security of systems.
User Account Control
- Awareness of key Microsoft technologies for securing modern operating systems and applications, including
  • User Account Control
  • Address Space Layout Randomisation
  • Data Execution Prevention

To ensure success in CREST Registered Intrusion Analyst certification exam, we recommend authorized training course, practice test and hands-on experience to prepare for CREST Registered Intrusion Analyst (CRIA) exam.

No votes yet