RSA CUSTOMER EDUCATION CATALOG
|
|
- Cody Washington
- 8 years ago
- Views:
Transcription
1 RSA CUSTOMER EDUCATION CATALOG S e r v i c e s C a t a l o g Q
2 COURSE DESCRIPTION INDEX Identity and Access Management Governance, Risk and Compliance Security Operations Anti Fraud Cyber Defense Security Concepts and Principles RSA Access Manager Administration, Installation and Configuration... 9 RSA Identity Management and Governance Administration RSA Business Role Manager RSA Data Access Governance Basics RSA Identity Management and Governance End User Training Service...16 RSA Authentication Manager Administration...18 RSA Authentication Manager Installation and Configuration RSA SecurID Help Desk Basics RSA Authentication Manager 6.1 to 8.x Data Migration Migrating RSA Authentication Manager v6.1 to a v8.1 Hardware Appliance RSA Authentication Manager 7.1 to 8.x Data Migration Migrating RSA Authentication Manager v7.1 to a v8.1 Hardware Appliance Getting Started with Enterprise Risk Management Getting Started with Policy and Compliance Management RSA Archer Administration RSA Archer Advanced Administration RSA Archer Custom End-User Training Service RSA Data Loss Prevention Administration RSA ECAT Analysis Fundamentals RSA Security Analytics Administration RSA Security Analytics for Analysts RSA Security Analytics for Logs RSA Security Operations Management Solution Basics RSA Adaptive Authentication On-Premise Administration RSA Adaptive Authentication for ecommerce Back Office Tools RSA Adaptive Authentication 12 Migration RSA Web Threat Detection Essentials RSA Intelligence-Driven Event Analysis RSA Incident Handling and Response RSA Threat Intelligence RSA Malware Analysis RSA SOC Simulation Challenge RSA Cyber Defense Workshop RSA Security Awareness Program RSA CISSP Certification Boot Camp Learning Assessments RSA Learning Assessments RSA, The Security Division of EMC 2
3 The Value of Professional Education Investing in training and education makes good business sense and can have a profound impact on your team. It enables an organization to: Decrease operating costs and increase productivity Reduce technical infrastructure costs Increase effectiveness of your technology investment Reduce your organization s overall information risk ENABLE YOUR TEAM TODAY FOR TOMORROW S IT SECURITY CHALLENGES RSA Education Services provides practical and relevant courses that support security learning across an enterprise. Properly trained personnel are the lifeblood of any organization. As you implement new technologies, add new functionality to existing systems or orient new staff, education is a key element. Consistent and focused training helps maintain the security of your computing environment, improves the end user experience and increases productivity and job satisfaction among your staff. FLEXIBLE DELIVERY OPTIONS Instructor-Led Training (ILT) Instructor-led classes offer comprehensive training in a fullyequipped RSA Learning Center. Public classes give you the opportunity to interact with your peers, further enhancing your learning experience by sharing real-world tips and best practices. Video Instructor Led Training (Video ILT) Video ILT courses combine the best of instructor-delivered lectures and presentations with the convenience and flexibility of an ondemand learning format. Video ILT programs are delivered in streaming format and can be viewed by the student directly on their own computer with an internet connection. Online Instructor-Led Training (Online ILT) Online ILT provides real-time, interactive, virtual training where students participate online to access the instructor-led virtual classroom. Lecture, discussion, questions and answers, and lab exercises makes this a flexible training experience. How to Contact Us Online elearning Self-paced elearning provides you with training that is generally one to three hours in length giving you the convenience of learning at your own pace. trainingregistration@rsa.com Phone: International: Fax: Middlesex Turnpike Bedford, Massachusetts USA RSA, The Security Division of EMC 3
4 RSA PRODUCT TRAINING Our worldwide training services are targeted to serve professionals who are responsible for installing, supporting and administering the entire range of RSA solutions. Developed for security administration and network operations, the product courses offer a variety of teaching methods including traditional instructor-led and virtual ( on line ) instructor-led training, video-based learning, and elearning. Instructor-led courses can also be made available as on-site engagements at a customer s location. Each of these options gives you the flexibility to select a learning mode that best fits your learning style, time constraints and budget. RSA SECURITY AWARENESS PROGRAMS RSA s Security Awareness programs offer ways to test and measure vulnerability, then provide essential education to fill any gaps. Our Security Awareness training can target virtually every level of an organization raising awareness and offering concrete steps to effect change, thus helping to prevent attackers from gaining a foothold through unsuspecting targets. See individual program descriptions for further details. CYBER DEFENSE TRAINING COURSES FOR SECURITY ANALYSTS The threat landscape is becoming more complicated every day. With the advent and enhancement of technical innovations like cloud computing, social media, mobile devices and big data, organizations are finding it very difficult to keep ahead of advanced threats. Security products, while necessary, can only go so far in identifying and mitigating potential breaches. A skilled security analyst is key to the success of any Information Security strategy. The RSA Cyber Defense Training courses address these challenges by offering comprehensive training on analytic processes and techniques that are independent of a specific attack technique or security product. These courses focus on analysis skills that are directly relevant to the current security climate. The curriculum also provides a path for security analysts to advance their skills by offering an approach based on roles that are generally consistent with the roles and responsibilities of a SOC. RSA, The Security Division of EMC 4
5 Benefits of Onsite Training Substantial cost Savings Save up to 40% compared to individual public class rates Less student down time Reduce travel concerns and out-of-office time Convenient, Flexible Scheduling Your training can be scheduled at the time and location most convenient for you Benefits of Online Instructor-led Training No travel cost or travel time Live instructor with whom you can interact and ask questions Same content as the classroom version of the course with hands-on labs to reinforce concepts Modest connectivity requirements allow participation from anywhere Publicly-scheduled classes for individual participants or Private sessions for organizations that prefer virtual training for their dispersed teams ONSITE TRAINING With RSA Onsite training, you and your people aren t locked into a pre-existing schedule of public classes at a pre-existing location. RSA Education Services can work with you to schedule your training at the time and location that s most convenient for you. That means training doesn t have to conflict with your other business priorities and it can be timed precisely to support your RSA implementation. RSA Onsite training rates can save an organization up to 40% when compared to individual student rates. Additional cost savings are realized by eliminating the need for student travel. What s more, since your students are not preparing for trips or making their way back from airports after training they are likely to be more productive and accessible in the days surrounding their training experience. ONLINE INSTRUCTOR-LED TRAINING What is Online ILT? Online ILT is real-time virtual training conducted remotely by RSA instructors. It s virtual training that mirrors the classroom experience with: Live web casts. During scheduled web casts, students communicate with their RSA instructor and other students, ask questions, and experience RSA products through live demonstration. Hands-on labs. Students access a remote lab environment that enables them to interact with RSA software and practice what they ve learned. Course materials. Course materials are shipped to participants in advance of the class. Just like in a classroom, students use these materials under the guidance of the instructor. Instructor guidance. During class time, students have the benefit of the instructor s expertise to assist during the live web casts and Hands-on Labs. During lab time, the instructor can shadow students by virtually looking over the shoulder of each student to evaluate their progress and provide assistance. RSA LEARNING ASSESSMENTS As organizations increasingly depend on technology to manage their businesses, the need for employees to be knowledgeable about security is increasingly evident. Whether they are IT security professionals or general office staff, having the appropriate security knowledge and skills to perform their jobs is a critical business driver. To plan and position your security training initiatives cost-effectively, RSA Learning Assessments are tools to measure your team s knowledge of RSA products and other security-related concepts. Based on the learning assessment results, we can work with you to identify a learning program that works for you and your team. RSA Learning Assessments are useful for organizations who recognize a need for training but aren t quite sure what training their team really needs. By leveraging RSA Learning Assessments, you can better understand the learning gaps and make an informed decision about the most effective individual and group training plans for your team. Online RSA Learning Assessments are available to you at no charge. An assessment can be completed within minutes with immediate results provided to the assessment taker. For a team assessment, management reports can be provided that evaluates individual and group results. RSA, The Security Division of EMC 5
6 RSA Training Unit Details: Each Training Unit has a value of $100 US Valid for customers and partners in all regions Can be used to register one or more individuals Can be redeemed for any RSA course and any delivery mode Valid for one year (364 days) from time of issuance. Any unused days are null and void after the expiration date Payment can be made with: purchase order, credit card, or company check RSA TRAINING UNITS Training is an invaluable means of facilitating growth in your organization and increasing the skills and knowledge of your employees. With RSA Training Units (TUs) you can invest in RSA courses and use them whenever RSA training is necessary. Training units are simply RSA Education Services currency. They are deposited into a company s training account and are available for general consumption by your company s employees. Valid for one year from date of purchase, pre-paid TUs provide maximum flexibility to ensure your team s readiness. With RSA TUs you can satisfy your training requirements as they evolve throughout the year. You reduce the paperwork and approvals associated with multiple enrollments by taking care of all your training needs with a single purchase. Registration and Payment Please complete your registration at Be sure you register with the address of the student attending class, as this is the only unique identifier we have for each student. Complete details regarding payment by purchase order, credit card or check are provided on our web site. RSA CERTIFIED SECURITY PROFESSIONAL CERTIFICATION By becoming an RSA Certified Security Professional, you possess the credentials that demonstrate your knowledge and skills necessary to function as a practical expert in the rapidly growing information security industry. Job-based certifications are available for administrators for the product areas designated below. Our relationship with Pearson VUE, which operates 5,000 testing centers in 165 countries, provides convenient access to certification exams and ensures impartial testing. The RSA Certified Administrator specialization is designed for professionals who administer and maintain enterprise security systems that use RSA SecurID, RSA Archer, or RSA Security Analytics. Certification RSA Archer Certified Administrator Recommended RSA Courses RSA Archer Administration RSA Archer Advanced Administration RSA SecurID Certified Administrator RSA Security Analytics Certified Administrator RSA Authentication Manager Administration RSA Authentication Manager Installation and Configuration RSA Security Analytics Administration EMC 2, EMC, RSA, RSA Security, Archer and the RSA logo are registered trademarks of EMC Corporation in the United States and/or other countries. All other trademarks used herein are the property of their respective owners. Copyright 2014 EMC Corporation. All rights reserved. Published in the USA. EDCAT SB 0615 r1 RSA, The Security Division of EMC 6
7 SUMMARY OF OFFERINGS BY DELIVERY MODE Identity and Access Management ILT VILT e-learning Online ILT RSA Access Manager Administration, Installation and Configuration RSA Identity Management and Governance Administration RSA Business Role Manager RSA Data Access Governance Basics RSA Identity Management and Governance End-User Training Service RSA Authentication Manager Administration RSA Authentication Manager Installation and Configuration RSA SecurID Help Desk Basics RSA Authentication Manager 6.1 to 8.x Data Migration Migrating RSA Authentication Manager v6.1 to a v8.1 Hardware Appliance RSA Authentication Manager 7.1 to 8.x Data Migration Migrating RSA Authentication Manager v7.1 to a v8.1 Hardware Appliance Governance, Risk and Compliance Getting Started with Enterprise Risk Management Getting Started with Policy and Compliance Management RSA Archer Administration RSA Archer Advanced Administration RSA Archer Custom End-User Training Service RSA Security Operations Management Solution Basics Security Operations RSA Data Loss Prevention Administration RSA ECAT Analysis Fundamentals RSA Security Analytics Administration RSA Security Analytics for Analysts RSA Security Analytics for Logs RSA Security Operations Management Solution Basics 7
8 SUMMARY OF OFFERINGS BY DELIVERY MODE (CONTINUED) Anti Fraud ILT VILT e-learning Online ILT RSA Adaptive Authentication On Premise Administration RSA Adaptive Authentication for ecommerce Back Office Tools RSA Adaptive Authentication 12 Migration RSA Web Threat Detection Essentials Cyber Defense RSA Intelligence-Driven Event Analysis RSA Incident Handling and Response RSA Threat Intelligence RSA Malware Analysis RSA SOC Simulation Challenge RSA Cyber Defense Workshop Security Concepts and Principles RSA Security Awareness Program RSA Certified Information Systems Security Professional (CISSP) Boot Camp 8
9 RSA Access Manager Administration, Installation and Configuration Course Description AT-A-GLANCE This course offers theoretical and hands-on instruction in the administrative functions, operations, and installation and configuration tasks associated with the RSA Access Manager product. Overview RSA Access Manager system architecture, server structure, integration of components into an enterprise infrastructure, user organization, and the importance of various configuration parameters are discussed. Hands-on labs allow the student to work step-bystep through the phases of an RSA Access Manager implementation. Extensive hands-on labs and the use of a realistic case study reinforce the tasks involved in creating a complete Web access management solution. Audience System, security, or help desk personnel who need to install, deploy and/or maintain RSA Access Manager. Duration 4 days REGISTER FOR CLASSES: For an up-to-date schedule of Instructor-led classes and other training options, visit the RSA Training and Certification web site: CONTACT US: trainingregistration@rsa.com Phone: Int l: Fax: Middlesex Turnpike Bedford, Massachusetts COURSE PART NUMBERS: ED CLRAIN210 Onsite Class ED ACCMGR TRAIN UNIT Training Units Prerequisite Knowledge/Skills Familiarity with Web and directory server or database technologies; A functional knowledge of OS and networking fundamentals. Course Objectives Upon successful completion of this course, participants should be able to: Explain the basic architecture and integration of RSA Access Manager in an enterprise environment Describe the processes and methodology for performing a successful installation and implementation of the core servers, data adapter, Administrative Console and representative Agents Describe the management functions used for resource and end user administration Using a case study, perform typical administration functions to populate and configure users, administrators and groups in an RSA Access Manager database Explain the configuration parameters that can be used to tailor the RSA Access Manager components to accomplish specific tasks and functions Establish Entitlements and use RSA Access Manager Smart Rules to manage Web access and protect resources in a classroom Web environment Perform system troubleshooting and analysis through the use of audit logs and user reports Explore how runtime and administrative operations can be extended through the use of the API library 9
10 Course Outline RSA Access Manager Overview High level description of RSA Access Manager and its contribution to access management RSA Access Manager Architecture Description and functions of the Primary Servers; Web and Application Server Agents Data Flow for the Runtime and Administrative operations Description of how RSA Access Manager fits into a distributed security model Installation and Configuration Description of RSA Access Manager system requirements and pre-installation readiness tasks Installation procedure, options, and recommended practices Installation of Access Manager Servers, LDAP Data Adapter, Administrative Console, and Web and Application Server Agents Configuration of Web Server for Single Sign- On Managing Resources Discussion of how resources (Web sites, Applications, etc.) are protected using RSA Access Manager focusing on selectivity and granularity in various situations Registration of Web Servers and definition of Applications Discussion of Virtual Web Server Hosts Configuration of Web Server for virtual hosts Delegated Administration Discussion of the administrative structure that is possible in an RSA Access Manager installation Use of Administrative Groups and ownership hierarchy of administrators, users, and objects Examination of Administrative Roles and responsibilities Managing the Organization Policy control for user authentication and passwords Methodology of structuring users, groups, user attributes, and properties Creation of user properties and addition of users to groups Resource Protection and Authentication Discussion of Authentication Methods used to protect resources; Form-based vs. challenge/response authentication; Chaining and combining forms Discussion of how resources are defined to allow granular protection Use of RSA Access Manager Entitlements and Smart Rules to selectively manage access to resources How to manage conflicts among Smart Rules and between Smart Rules and Entitlements Configuration of Access Manager for external authentication and URL retention Troubleshooting Examination of the log files and use of special configuration parameters to control log detail Configuration of servers for centralized logging Configuration of Network Management Discussion of approaches to user and system troubleshooting Development Tools Discussion of the various Runtime, Administrative, and Web Agent Extension API tools that are available Examination and implementation of JAVA coding examples Single Sign-On Discussion of the function and objectives of creating a single sign-on environment Explanation of the differences and challenges of Intra- vs. Inter- site single sign-on Configuration of Access Manager for SSO and ISSO Distributed Authorization Discussion of achieving redundant functionality and failover Explanation of the differences in Standard Mode vs. Distributed Mode failover Test of centralized logging Copyright 2013 EMC Corporation. All rights reserved. 08/2013 EMC 2, EMC, RSA, RSA Security, Archer, NetWitness and the RSA logo are registered trademarks of EMC Corporation in the United States and/or other countries. 10
11 RSA Identity Management and Governance Administration Course Description AT-A-GLANCE The RSA Identity Management and Governance Administration course provides an overview of the administrative and configuration options associated with the RSA Identity Management and Governance (IMG) platform. Replaces the Following Former Courses Access Fulfillment Express, Access Request Manager, Business Role Manager and Access Certification Manager Foundations Overview This course provides an overview of the administrative responsibilities and configuration options associated with the RSA IMG platform. Students will gain a comprehensive understanding of the access review cycle, change request and provisioning capabilities of the platform. Students will enable the ACM, ARM, AFX and BRM modules. Hands-on labs are used to reinforce the tasks involved in configuring, maintaining, and utilizing the platform to perform user, account, and group structure reviews and other tasks in a simulated review cycle. Students will configure the components necessary to automate onboarding and new user registration processes and will create workflows, notifications, and change requests. Students will discuss password management functions and provisioning, attribute management, collectors, roles, rules, reporting, and dashboards to provide an end-to-end structured experience for the students. REGISTER FOR CLASSES: For an up-to-date schedule of Instructor-led classes and other training options, visit the RSA Training and Certification web site: CONTACT US: trainingregistration@rsa.com Phone: Int l: Fax: Middlesex Turnpike Bedford, Massachusetts COURSE PART NUMBERS: ED IMG ADM 210 Onsite Class ED IMG TRAIN UNIT Training Units Audience RSA IMG platform administrators, implementers and other technical users who need to configure, administer, or support the RSA IMG platform. Duration 4 days Prerequisite Knowledge/Skills Familiarity with Active Directory, LDAP, and SQL querying. Course Objectives Upon successful completion of this course, participants should be able to: Understand the components included in the RSA IMG platform Understand platform configuration options Enable the ACM, ARM, AFX and BRM modules Packaging and importing platform resource objects Perform administrative functions, including configuring identity, account, and entitlement collectors, and unifying user data to gain full visibility into enterprise user access and entitlements Configure and process business role sets, rules, notifications and workflows Configure, run, and perform user access certification reviews Configure and action change requests, user registrations, and password management options Deploy automated provisioning options for change requests and user registrations Create and publish reports to dashboards and external sources 11
12 Course Outline The RSA IMG Platform RSA IMG Platform Overview Collection Model Data Model RSA IMG Platform User Interface Interface overview Login Screen AveksaAdmin Account Header and Menu Bar Working with Tables Admin Menu Planning for Custom Attributes Collected VS. ACM Managed Attributes System Settings Admin Security Options Packaging and Importing Users and Identities Users and Identities Overview Groups Business Units Resources Identity Data Collectors Unification Process Authentication Providers Planning for Collecting Identities Accounts, Roles and Entitlements Account Attributes Account Data Collectors Orphaned Accounts Application Roles Entitlement Attributes Entitlement Data Collectors Business Descriptions Planning for Collecting Entitlements Password Management Password Management features overview User Self-service password reset Password reset change requests Password synchronization RSA Kiosk password reset Roles Roles Overview Role Set Creation Birthright provisioning Rules Rules Overview Rule Definitions Processing Rules Reviews Reviews Overview Reviews in Context Review Definitions Administering Reviews Performing Reviews Refreshing Reviews Watch closures Completing a Review and Reporting Results Workflows and Notifications Workflows Overview Workflows Configuring Workflows Notification options Notification templates Dashboards and Reports Reports Overview Creating Reports Report Queries and Parameters Formatting and Distribution Settings Dashboard Components Requests to change access with ARM Access Requests Overview Attribute configuration Request Buttons Request Forms User and Entitlement Views Change Request processing and watch closures Provisioning with AFX Access Fulfillment Express Overview Deploying Access Fulfillment Express Configuring Connectors Configuring Endpoint capabilities Capstone Structured Experience Complete end-to-end access review cycle Deploy change requests with automated provisioning Publish final reports to simulation auditors and executives Copyright 2014 EMC Corporation. All rights reserved. 09/2014 EMC 2, EMC, RSA, RSA Security, Archer, NetWitness and the RSA logo are registered trademarks of EMC Corporation in the United States and/or other countries. 12
13 RSA Business Role Management Course Description AT-A-GLANCE The RSA IMG Business Role Manager course provides instruction on the administrative responsibilities and configuration options associated with the RSA IMG Business Role Manager module. Overview The RSA IMG Business Role Manager module extends the capabilities of the IMG product to include the ability to group users and entitlements into roles. The RSA IMG BRM elearning provides an overview of BRM components. Topics include terminology, configuration, and role mining options to tailor the module to a customer s needs. Demonstrations illustrate the tasks involved in configuring, maintaining, and utilizing the Business Role Manager module. The course is comprised of lecture content as well as recorded product demonstrations to illustrate the RSA IMG BRM product in action. Audience RSA Identity and Access Management/Identity Management and Governance administrators, implementers and other technical users who need to configure, administer, or support the RSA IMG Business Role Manager module. Duration 4 hours REGISTER FOR CLASSES: For an up-to-date schedule of Instructor-led classes and other training options, visit the RSA Training and Certification web site: CONTACT US: trainingregistration@rsa.com Phone: Int l: Fax: Middlesex Turnpike Bedford, Massachusetts COURSE PART NUMBERS: ED IMG TRAIN UNIT Training Units Prerequisite Knowledge/Skills Completion of the RSA Identity Management and Governance (IMG) course (or former RSA ACM Foundations course). Course Objectives Upon successful completion of this course, participants should be able to: Enable the Roles option and Business Role Manager module Understand the functionality and capabilities of the Roles and Business Role Manager modules Understand Business Role Manager terminology Understand the differences between business, technical, and global roles Interpret role metrics are produced Create, configure and manage roles Create and configure role options Create and configure role sets Discover roles and entitlements Define role membership rules Manage organization roles for compliance to best practice principles Allow others to manage roles Copyright 2014 EMC Corporation. All rights reserved. 03/2014 EMC 2, EMC, RSA, RSA Security, Archer, NetWitness and the RSA logo are registered trademarks of EMC Corporation in the United States and/or other countries. 13
14 Course Outline Business Role Manager Overview BRM Features Definition of a Role Benefits of using Roles in Access Governance Difference between Business Roles and Technical Roles Manage Roles Role management lifecycle Common indicators of role problems Using roles in entitlement reviews Interpreting role metrics Enable and Configure BRM How to enable BRM. Role configuration options Role management options Create a Role Best practices for creating a role Definition of a birthright role How to create a role Definition of a role set How to create a role set How to add members to a role Role membership rules Role metrics Discover Roles Benefit of role discovery Definition of top-down role modeling Demonstration of top-down role modeling Definition of bottom up role modeling Demonstration of bottom-up role modeling Copyright 2014 EMC Corporation. All rights reserved. 12/2014 EMC 2, EMC, RSA, RSA Security, Archer, NetWitness and the RSA logo are registered trademarks of EMC Corporation in the United States and/or other countries. 14
15 RSA Data Access Governance Basics Course Description AT-A-GLANCE The RSA IMG Data Access Governance Basics course provides instruction on the administrative responsibilities and configuration options associated with the RSA IMG Data Access Governance module. Overview This course discusses the use of the RSA IMG Data Access Governance module as a tool to collect and manage user access to data resources. Topics include collection configuration, access reviews, user access requests, and data resource ownership. Recorded demonstrations reinforce the tasks involved in configuring, maintaining, and utilizing the Data Access Governance module. Audience RSA Identity and Access Management/Identity Management and Governance administrators, implementers and other technical users who need to configure, administer, or support the RSA IMG Business Role Manager module. Duration 2 hours REGISTER FOR CLASSES: For an up-to-date schedule of Instructor-led classes and other training options, visit the RSA Training and Certification web site: CONTACT US: trainingregistration@rsa.com Phone: Int l: Fax: Middlesex Turnpike Bedford, Massachusetts COURSE PART NUMBERS: ED IMG TRAIN UNIT Training Units Prerequisite Knowledge/Skills Completion of the RSA Identity Management and Governance (IMG) Administration course (or former RSA ACM Foundations course). Course Objectives Upon successful completion of this course, participants should be able to: Enable the Data Access Governance (DAG) module Understand how RSA DAG and StealthBits StealthAUDIT work together to collect data resource information Manage reviews of resource owners and user access Configure rules to support an organization s user access policies Configure and manage end user data access requests Course Outline Purpose and function of RSA Data Access Governance Use and benefits of RSA DAG Permission types DAG operations RSA DAG Architecture Components and functions Data flows Process and Workflows Data acquisition Review workflow Rules and rule processing End user data access requests Copyright 2014 EMC Corporation. All rights reserved. 03/2014 EMC 2, EMC, RSA, RSA Security, Archer, NetWitness and the RSA logo are registered trademarks of EMC Corporation in the United States and/or other countries. 15
16 RSA Identity Management and Governance Custom End-User Training Service Solution Description Executive Overview AT-A-GLANCE This offering provides training to your end users and is customized to your organization s specific RSA Identity Management and Governance application. The RSA Identity Management and Governance (IMG) platform helps organizations efficiently meet their security, regulatory and business access needs through a collaborative set of business processes. By automating manual tasks, providing evidence of compliance, reducing access-related business risk, and efficiently delivering business access, enterprises can confidently manage, control and enforce access to applications and data across the enterprise and the cloud. But no matter how good a solution is, your organization will never be able to optimize ROI without your end users understanding your organization s best practices and procedures and how to use the IMG solution in your environment. RSA Education Services offers the RSA Identify Management and Governance Custom End-User Training Service to help ensure your organization s success: Compliance Through training, your End Users learn how to make access decisions while ensuring compliance with controls defined by your organization. REGISTER FOR CLASSES: For an up-to-date schedule of Instructor-led classes and other training options, visit the RSA Training and Certification web site: CONTACT US: trainingregistration@rsa.com Phone: Int l: Fax: Middlesex Turnpike Bedford, Massachusetts COURSE PART NUMBERS: ED IMG EUTTT 210 Train-thetrainer option ED IMG EUELN 210 E-Learning option ED IMG EUILT 210 Instructor Led Delivery by RSA Access Governance Trained End Users are able to enforce control over use access and therefore minimize risk to business operations. Rapid-time-to-Value Trained End Users are better equipped to meet your enterprise s specific IMG requirements. An RSA Education Services Consultant will work with you and/or Professional Services when configuration of your RSA IMG system is complete. A needs analysis will be performed to define the training s scope and deliverables to meet your requirements and a project plan and timetable will be designed in collaboration with you. Concepts and Principles Tailored to your RSA IMG use case and unique requirements, the audience for this offering are your business end users whose training needs may include but are not limited to the following: Logging in and navigating the system Performing a Job Change Request Entering a New Hire Access Request Terminating an Access Request Complete other processes as defined per project Note: This offering is not intended to address the complex tasks associated with implementing, configuring and administering IMG. The RSA IMG Administration course is appropriate for those individuals. 16
17 Deliverables Based on a single use case, this education service provides: A scripted PowerPoint slide deck that includes content customized to your environment: o o o Content branded with the organization s logo and standard.ppt template Unlimited use by the organization for its end users Access to an editable version of the content One of three delivery options: o Live, Virtual TTT -10 days of custom development, followed by one half-day of instructor-led Train-the-Trainer delivered virtually to your training team. Participants can interact via a web session with instructors. Part Number: ED IMG EUTTT 210 o E-Learning 15 days of custom development that includes a selfpaced, SCORM-compliant e-learning module (with audio) with unlimited distribution via your own training site and the convenience of learning at your own pace. Part Number: ED IMG EUELN 210 o Instructor-Led 10 days of custom development followed by 3 consecutive days of instructor-led training delivered onsite at your location. Part Number: ED IMG EUILT 210 ABOUT RSA RSA is the premier provider of security, risk and compliance management solutions for business acceleration. RSA helps the world's leading organizations succeed by solving their most complex and sensitive security challenges. These challenges include managing organizational risk, safeguarding mobile access and collaboration, proving compliance, and securing virtual and cloud environments. Combining business-critical controls in identity assurance, encryption & key management, SIEM, Data Loss Prevention and Fraud Protection with industry leading egrc capabilities and robust consulting services, RSA brings visibility and trust to millions of user identities, the transactions that they perform and the data that is generated. Copyright 2014 EMC Corporation. All rights reserved. 12/2014 EMC 2, EMC, RSA, RSA Security, Archer, NetWitness and the RSA logo are registered trademarks of EMC Corporation in the United States and/or other countries. 17
18 RSA Authentication Manager Administration Course Description AT-A-GLANCE This course provides an overview of the administrative responsibilities associated with an RSA SecurID system. Overview The working principles behind RSA Authentication Manager and RSA SecurID authenticators are discussed, including product architecture, time synchronization, managing external Identity Sources and exploring all aspects of an administrative structure. Extensive hands-on labs reinforce the administrative tasks involved in managing a user population and token assignment. The subject matter in this course prepares students with the classroom component recommended for the RSA Authentication Manager Certified Administrator certification. Audience System, security, or help desk administrators who need to administer and support RSA SecurID products. REGISTER FOR CLASSES: For an up-to-date schedule of Instructor-led classes and other training options, visit the RSA Training and Certification web site: CONTACT US: trainingregistration@rsa.com Phone: Int l: Fax: Middlesex Turnpike Bedford, Massachusetts Duration 2 days Prerequisite Knowledge/Skills Familiarity with Microsoft Windows or UNIX/Linux system administration. Course Objectives Upon successful completion of this course, participants should be able to: Understand the basic architecture and theory of operation of the RSA SecurID product suite Perform configurations required for RSA Authentication Manager system operations Perform user administration functions to populate and manage users Perform reporting and user troubleshooting Understand ongoing maintenance requirements Understand the setup and use of software authenticators Understand the configuration and use of self-service functionality COURSE PART NUMBERS: ED AMADM210 Onsite Class ED AM TRAIN UNIT Training Units 18
19 Course Outline Product and Technology Overview High level description of RSA Authentication Manager and its contribution to user authentication Authentication as a foundation of security, trust and confidence in digital identities RSA Authentication Manager system components and communication RSA SecurID Authentication RSA SecurID authentication options Concepts of strong user authentication Token technology time synchronization, authenticator types Risk-Based Authentication Configuration and management of Riskbased authentication Device fingerprinting and behavior data collection and analysis Selecting assurance levels Deployment and Administrative Structure Deployment planning and establishing an administrative structure System Administration Establishing and maintaining organizational and administrative structures: - LDAP Identity Sources - Security Domains - User and User Group structures - Administrative roles and delegation - Authentication Agents Authenticator Management Managing RSA SecurID hardware tokens Software token deployment and installation Managing Risk-Based Authentication Managing On-Demand Authentication Auditing, Reports and Troubleshooting RSA Authentication Manager report functions Report customization Troubleshooting procedures Self-Service Management and Support Configurations for user self-service functions User account and authenticator management and provisioning Policy Management Defining and applying policies to the system and Security Domains - Password and Token policies - Lockout and self-service policies - Risk-based and Offline authentication policies Copyright 2014 EMC Corporation. All rights reserved. 12/2014 EMC 2, EMC, RSA, RSA Security, Archer, NetWitness and the RSA logo are registered trademarks of EMC Corporation in the United States and/or other countries. 19
20 RSA Authentication Manager Installation and Configuration Course Description AT-A-GLANCE This course offers hands-on training on the installation and configuration of RSA Authentication Manager, Authentication Agents, Web Tier, and other RSA SecurID system components.. Overview This course assumes that the student has attended the RSA Authentication Manager Administration course or has equivalent operation and administrative experience with RSA Authentication Manager administrative tasks are not covered as part of this course. Audience Technical personnel who install, service and support RSA Authentication Manager and RSA SecurID deployments. Duration 2 days REGISTER FOR CLASSES: For an up-to-date schedule of Instructor-led classes and other training options, visit the RSA Training and Certification web site: CONTACT US: trainingregistration@rsa.com Phone: Int l: Fax: Middlesex Turnpike Bedford, Massachusetts COURSE PART NUMBERS: ED AMINS210 Onsite Class Prerequisite Knowledge/Skills Microsoft Windows or UNIX/Linux system administration; attendance in RSA Authentication Manager Administration course, or equivalent v7.1 or v8 administration experience; Familiarity with virtual machine deployment on VMware. Course Objectives Upon successful completion of this course, participants should be able to: Plan and perform the pre-installation, installation, and configuration tasks to accomplish an RSA Authentication Manager virtual appliance installation in a VMware environment Configure RSA Authentication Manager system parameters Configure and connect to external LDAP Identity Sources Create redundant/failover RSA Authentication Manager replica servers and understand the role and management of replica server instances Install and configure RSA Authentication Agents for local workstation and web access protection Perform an RSA Authentication Manager Web Tier installation to support user self-service and risk-based authentication ED AM TRAIN UNIT Training Units 20
21 Course Outline RSA Authentication Manager System Architecture Primary and Replica instances Authentication Agents and communication paths Identity Sources Firewall configurations Web Tier component RADIUS communication Deployment Scenarios and Planning Deployment and Installation planning Using the right Authentication Agent Planning administrative support Using CT-KIP for software token deployment RSA Authentication Manager Deployment Pre-Installation requirements and considerations Supported VMware environments and features V8.1 Hardware Appliance deployment Deployment process and steps Post-deployment tasks System Configurations Settings and configurations - System-wide configurations - Instance settings - Console and dashboard personalization Authentication Agent Configurations Functions and features of representative Authentication Agent installations for Microsoft Windows and Linux operating systems Configuring Agent software for local, network and web access protection Handling node secret and sdconf.rec files Replica Instances Strategies for dealing with primary instance failures and replica promotion Creating replica packages Establishing preferred and failover servers in Agent hosts Web Tier Installation Requirements and installation process for the Web Tier component Customizing the end user interface System Utilities Using the Command-line Utility package Installing and configuring the Windows MMC snap-in Managing Realm trusts Credential Manager Configuration Setting up the Credential Manager for provisioning RADIUS Server Configuration RADIUS functions and capabilities Primary and Replica RADIUS servers Managing RADIUS users RSA Authentication Manager Migration Overview Optional overview of the migration process from version 6.1 to version 8 and/or version 7.1 to version 8 This module is delivered if students are planning to perform a migration in their production system and are interested in the general planning and steps involved in a migration Copyright 2013 EMC Corporation. All rights reserved. 08/2013 EMC 2, EMC, RSA, RSA Security, Archer, NetWitness and the RSA logo are registered trademarks of EMC Corporation in the United States and/or other countries. 21
22 RSA SecurID Help Desk Basics Course Description AT-A-GLANCE This course provides the fundamental information about an RSA SecurID system deployment to assist Help Desk representatives respond to end users. Overview An overview of RSA Authentication Manager and RSA SecurID authenticators and authentication methods are presented, as well as how functions and controls are accessed in the administrative interface. Instructor demonstrations of important operations relating to typical end user cases reinforce the steps that Help Desk representatives can take for troubleshooting and assisting their user population. This course is useful for new representatives supporting RSA SecurID users as well as a refresher course for representatives who infrequently work with RSA SecurID support issues. Audience Help Desk representatives who need to assist and support RSA SecurID users Duration 1 day REGISTER FOR CLASSES: For an up-to-date schedule of Instructor-led classes and other training options, visit the RSA Training and Certification web site: CONTACT US: trainingregistration@rsa.com Phone: Prerequisite Knowledge/Skills General familiarity with system administration functions Course Objectives Upon successful completion of this course, participants should be able to: Understand the high-level architecture and theory of operation of the RSA SecurID product suite Identify common authentication problem areas Perform common user assistance tasks Understand the use of the user Self-service capabilities Int l: Fax: Middlesex Turnpike Bedford, Massachusetts COURSE PART NUMBERS: ED AM TRAIN UNIT Training Units 22
23 Course Outline The following modules are designed to support the course objectives: RSA SecurID System Overview High level description of RSA SecurID and RSA Authentication Manager system components RSA authentication methods: o o o Hardware and Software authenticators On-Demand Authentication Risk-Based Authentication Authentication process and data flow Monitors and Reports Using the Authentication Monitor Generating reports to track and user activity User Troubleshooting Troubleshooting procedures Security considerations Self-service Console User self-service functions Self-Service provisioning flow Troubleshooting user self-service problems Authentication Problem Areas Identifying and isolating user problems Common user errors Differentiating User vs Agent vs Server problems System Configurations Organizational structures users, groups, Security Domains and Identity Sources Authentication options and policies Authenticator Operations Hardware tokens Software tokens On-demand codes Emergency and temporary codes Copyright 2013 EMC Corporation. All rights reserved. 08/2013 EMC 2, EMC, RSA, RSA Security, Archer, NetWitness and the RSA logo are registered trademarks of EMC Corporation in the United States and/or other countries. 23
24 RSA Authentication Manager 6.1 to 8.x Migration Course Descriptions AT-A-GLANCE This elearning course guides the participant through the steps to accomplish a standard migration from RSA Authentication Manager version 6.1 to version 8.x. Overview Product functionality that is pertinent to the migration of v6.1 is discussed as well as the process and considerations for migrating to a v8.x environment. Note that this course discusses migration of out-of-box deployments and does not address migration of customized APIs running under v6.1. Audience Technologists who are responsible for an RSA SecurID system and intend on migrating from RSA Authentication Manager v6.1 to v8. Prerequisite Knowledge/Skills Familiarity with RSA SecurID technology and RSA Authentication Manager v6.1. REGISTER FOR CLASSES: For an up-to-date schedule of Instructor-led classes and other training options, visit the RSA Training and Certification web site: RSA Authentication Manager 6.1 to 8.0 Data Migration This course describes the features and functions that are new to RSA Authentication Manager v8.x as well as how database objects and structures map from v6.1 to v8.x. It details several deployment and migration scenarios and the steps required to migrate v6.1 data to a v8.x installation. Duration Approximately 1 hour CONTACT US: trainingregistration@rsa.com Phone: Int l: Fax: Middlesex Turnpike Migrating RSA Authentication Manager v6.1 to a v8.1 Hardware Appliance This course augments the data migration course (described above) and focuses on the process and considerations for migrating to a version 8.1 hardware appliance from v6.1. Duration Approximately 15 minutes Bedford, Massachusetts This elearning course is available to customers at no charge. If you are accessing RSA elearning for the first time, please visit to establish an account. If you already have an account through EMC Powerlink, go directly to to access this course. 24
25 RSA Authentication Manager 6.1 to 8.0 Data Migration Migrating RSA Authentication Manager v6.1 to a v8.1 Hardware Appliance Course Objectives Upon successful completion of this course, participants should be able to: Provide an overview of the fundamental differences between RSA Authentication Manager v6.1 and v8.x features and functions Describe the specific database objects that are migrated between product versions and how they are handled by the migration Describe the pre-migration steps to prepare a v6.1 database for migration Describe the post-migration structures that can be created in v8.x to contain and manage migrated objects Course Outline Comparison of v6.1/v8.x Architecture and Administrative Structures Describes the general architecture and compares differences/parallels between product versions Describes the major areas of importance in the v8.x data structures and how they map to a v6.1 environment Describes terminology used in v8.x Overview of the Migration Process High-level description of the methodology for approaching a migration Describes in detail how database objects are mapped from version to version Course Objectives Upon successful completion of this course, participants should be able to: Understand a deployment architecture that includes one or more v8.1 hardware appliances as primary and/or Replica instances Describe the migration process of migrating from a v6.1 software or hardware appliance platform to a v8.1 hardware appliance Course Outline Overview of v8.1 Architecture Describes the architecture and deployments options that include a v8.1 hardware appliance Overview of the Migration Process Describes migration tasks involved with migrating to a hardware appliance that are over and above the tasks involved with data migration alone Using the v6.1 Migration Assessment Tool Migration Steps Describes the initial connections and setup of a v8.1 hardware appliance Describes the steps involved with migration from exporting v6.1 data to importing it into a v8.1 hardware appliance. Pre-Migration Preparation Describes the considerations and best practices involved in preparing a v6.1 environment for migration database cleaning, creating/dismantling structures, etc. and preparing a v8.x environment to receive migrated information what decisions and elements should be made before migration Post-Migration Considerations Description of tasks that can be performed after the completion of the migration process Migration of an RSA SecurID Appliance Describes the general process for migrating data from a v6.1 RSA SecurID Appliance to a v8 environment Copyright 2013 EMC Corporation. All rights reserved. 08/2013 EMC 2, EMC, RSA, RSA Security, Archer, NetWitness and the RSA logo are registered trademarks of EMC Corporation in the United States and/or other countries. 25
26 RSA Authentication Manager 7.1 to 8.x Migration Course Descriptions AT-A-GLANCE This elearning course guides the participant through the steps to accomplish a standard migration from RSA Authentication Manager version 7.1 to version 8.x. Overview Product functionality that is pertinent to the migration is discussed as well as virtual and hardware appliance deployment, Web Tier, and Risk-Based Authentication options that are new in v8.x. Note that these courses discuss migration of out-of-box deployments and do not address migration of customized environments or APIs running under v7.1. Audience Technologists who are responsible for an RSA SecurID system and intend on migrating from RSA Authentication Manager v7.1 to v8. Prerequisite Knowledge/Skills Familiarity with RSA SecurID technology and RSA Authentication Manager v7.1. REGISTER FOR CLASSES: For an up-to-date schedule of Instructor-led classes and other training options, visit the RSA Training and Certification web site: RSA Authentication Manager 7.1 to 8.0 Data Migration This course describes the features and functions that are new to RSA Authentication Manager v8.x. It details several deployment and migration scenarios and the steps required to migrate v7.1 data to a v8.x installation. Duration Approximately 1 hour CONTACT US: trainingregistration@rsa.com Phone: Int l: Fax: Middlesex Turnpike Bedford, Massachusetts Migrating RSA Authentication Manager v7.1 to a v8.1 Hardware Appliance This course augments the data migration course (described above) and focuses on the process and considerations for migrating to a version 8.1 hardware appliance from v7.1. The information in this course is appropriate for v7.1 deployments that currently use hardware appliances as well as for migrations to v8.1 that will begin using a hardware appliance for the first time. Duration Approximately 15 minutes This elearning course is available to customers at no charge. If you are accessing RSA elearning for the first time, please visit to establish an account. If you already have an account through EMC Powerlink, go directly to to access this course. 26
27 RSA Authentication Manager 7.1 to 8.0 Data Migration Migrating RSA Authentication Manager v7.1 to a v8.1 Hardware Appliance Course Objectives Upon successful completion of this course, participants should be able to: Provide an overview of the fundamental differences between RSA Authentication Manager v7.1 and v8 features and functions Describe the migration process Describe the pre-migration steps to prepare for v7.1 data export Describe the post-migration tasks in a v8 environment Course Objectives Upon successful completion of this course, participants should be able to: Understand a deployment architecture that includes one or more hardware appliances as primary and/or Replica instances Describe the migration process of migrating from a software or hardware appliance platform to a v8.1 hardware appliance Understand how to upgrade an existing supported hardware appliance to be v8.x-capable Course Outline Comparison of v7.1/v8 Architecture Describes the general architecture and system components that are similar to v7.1 and those that are new to v8 Overview of the Migration Process High-level description of the options and methodology involved with migration Discusses approaches to minimize downtime during migration Migration Steps Discusses pre-migration preparations Describes the v8 deployment Describes installation of the RSA Authentication Manager Migration Export Utility Describes Basic and Advanced migration options Considerations for RADIUS migration Course Outline Overview of v8.1 Architecture Describes the architecture and deployments options that include a v8.1 hardware appliance Overview of the Migration Process Describes migration tasks involved with migrating to a hardware appliance that are over and above the tasks involved with data migration alone Upgrading and Re-imaging an RSA SecurID Appliance Describes the process to upgrade supported RSA SecurID Appliance 3.0 equipment to enable it to host a v8.x instance Migration Steps Describes the steps involved with migration from exporting v7.1 data to importing it into a v8.1 hardware appliance. Post-Migration Tasks Describes tasks to be performed after the completion of the migration process Discusses rolling back a migration Migration Assistance Describes troubleshooting information and how to obtain further assistance from RSA resources Copyright 2013 EMC Corporation. All rights reserved. 08/2013 EMC 2, EMC, RSA, RSA Security, Archer, NetWitness and the RSA logo are registered trademarks of EMC Corporation in the United States and/or other countries. 27
28 Getting Started with Enterprise Risk Management Course Description AT-A-GLANCE This course provides an overview of the concepts, processes, and procedures necessary to successfully begin implementation of an Enterprise Risk Management (ERM) system. Overview Students will gain knowledge of the key RSA Archer ERM components through presentations and hands-on exercises. Audience Risk management team members who will be using the RSA Archer Risk Management solution to define, support, and maintain a risk management initiative. This may include managers, team leads, and anyone involved in scoping a risk project. Duration 2 days REGISTER FOR CLASSES: For an up-to-date schedule of Instructor-led classes and other training options, visit the RSA Training and Certification web site: CONTACT US: trainingregistration@rsa.com Prerequisite Knowledge/Skills Familiarity with RSA Archer egrc framework and a general familiarity with organizational Risk concepts. Course Objectives Upon successful completion of this course, participants should be able to: Explain basic Risk Management terminology and methodologies Illustrate the structure of the RSA Archer Risk Management Solution Define business requirements related to Risk Management Begin the implementation process of an Enterprise Risk Management program Phone: Int l: Fax: Middlesex Turnpike Bedford, Massachusetts COURSE PART NUMBERS: ED ARCERM210 Onsite Class ED ARC TRAIN UNIT Training Units 28
29 Course Outline Introduction to Risk Management What is Risk? General Enterprise Risk Management Approach Overview Types of Risk Digging Deeper Common Frameworks Overview Developing a Common Risk Taxonomy Elements of Risk Management Phases of Growth: Risk Identification Assessment Decision Treatment Monitoring RSA Archer Risk Management Solution RSA Archer ERM Structure Components ERM Processes and Key Integrations with Other Solutions How RSA Archer Maps to Common Risk Frameworks Top-Down Risk Assessment Discussion: Common Issues for Specific Industries/Business Types Exercise: Risk Identification Exercise: Risk Assessment Exercise: Risk Decision Exercise: Risk Treatment Exercise: Metrics Monitoring Exercise: Loss Monitoring Exercise: Overall Monitoring Bottom-Up Risk Assessment Exercise: Create a new Risk Project Exercise: Complete Risk Assessments Exercise: Create reports based on new data Exercise: Bring in sample model data via Data Import Exercise: Create dashboard that incorporates model data s impact on business Copyright 2013 EMC Corporation. All rights reserved. 08/2013 EMC 2, EMC, RSA, RSA Security, Archer, NetWitness and the RSA logo are registered trademarks of EMC Corporation in the United States and/or other countries. 29
30 Getting Started with Policy and Compliance Management Course Description AT-A-GLANCE This course provides an overview of the concepts, processes, and procedures necessary to successfully begin implementation of a Policy and Compliance Management system. Overview Students will gain knowledge of the key RSA Archer Policy and Compliance Management components through presentations and hands-on exercises. Audience Policy and Compliance management team members who will be using the RSA Archer Policy and Compliance Management solution to define, implement, and maintain a policy and compliance management initiative. This may include managers, team leads, and anyone involved in consolidating policies and ensuring compliance with authoritative sources. Duration 2 days REGISTER FOR CLASSES: For an up-to-date schedule of Instructor-led classes and other training options, visit the RSA Training and Certification web site: CONTACT US: trainingregistration@rsa.com Phone: Int l: Fax: Middlesex Turnpike Bedford, Massachusetts COURSE PART NUMBERS: ED ARCPCM210 Onsite class ED ARC TRAIN UNIT Training Units Prerequisite Knowledge/Skills Familiarity with the RSA Archer egrc framework and a general familiarity with policy and compliance concepts. Course Objectives Upon successful completion of this course, participants should be able to: Explain basic Policy and Compliance Management issues and processes Illustrate the structure of the RSA Archer Policy and Compliance Management Solution Begin the implementation process of a Policy and Compliance Management program 30
31 Course Outline Introduction to Policy and Compliance Management Top Policy and Compliance Management Issues Policy and Compliance Processes in a Nutshell Policy and Compliance Key Components RSA Archer Policy Management Solution RSA Archer Interface RSA Archer Policy Structure Components Phased Implementation Approach Post-Implementation Processes Policy Management Exercises Exercise: Analyze Existing Policy Exercise: Define Scope Extraction & Mapping Exercise: Policy Extraction Exercise: Control Standard Extraction & Mapping Exercise: Format/Import Content Exercise: Perform a Gap Analysis Exercise: Import Provided Content Exercise: Approve a Policy Change Exercise: Policy Awareness Campaign RSA Archer Compliance Management Solution Sarbanes-Oxley Act Concerns RSA Archer Compliance Structure Components How Compliance is Rated Exception Requests Workflow Compliance Management Exercises Exercise: Review Control Procedure Mapping Exercise: Assess a Process Control Exercise: Assess a Technical Control Exercise: Address Findings Remediation Plan Exercise: Address Findings Exception Request Compliance Strategies Control-Based Compliance Asset-Based Compliance Compliance Testing Cycle Round Table Discussion Additional Resources Copyright 2013 EMC Corporation. All rights reserved. 08/2013 EMC 2, EMC, RSA, RSA Security, Archer, NetWitness and the RSA logo are registered trademarks of EMC Corporation in the United States and/or other countries. 31
32 RSA Archer Administration Course Description AT-A-GLANCE This course provides an overview to the concepts, processes, and procedures necessary to successfully design and administer the RSA Archer platform. Overview Students will gain knowledge of the key RSA Archer platform components such as applications, security management, and communication tools through presentations and hands-on exercises. After taking this course, students will be able to plan, configure, and manage the RSA Archer environment. The subject matter in this course prepares students with the classroom component recommended for the RSA Archer Certified Administrator certification. Audience Archer administrators who are responsible for building and managing the RSA Archer egrc product. Duration 4 days REGISTER FOR CLASSES: For an up-to-date schedule of Instructor-led classes and other training options, visit the RSA Training and Certification web site: CONTACT US: trainingregistration@rsa.com Phone: Int l: Fax: Middlesex Turnpike Bedford, Massachusetts COURSE PART NUMBERS: ED ARCADMIN210 Onsite Class Prerequisite Knowledge/Skills None Course Objectives Upon successful completion of this course, participants should be able to: Navigate within the RSA Archer system Configure the look and feel of the RSA Archer interface Create or edit an application Import data Set up notifications Create data-driven events and calculated fields Manage user access Automate work streams Complete a questionnaire Perform a data feed Search and report on data Set up a dashboard Migrate changes between environments Identify additional support resources ED ARC TRAIN UNIT Training Units 32
33 Course Outline Introduction to RSA Archer RSA Archer Overview Introduction to the case study General Navigation Interface components Managing content records Configure the Appearance Managing Themes Managing the Appearance Centralize and Organize Data Data structure Application Builder overview Inside Manage Applications General Application Properties Field Management Page Layout Navigation Menu Import Data Using the Data Import Manager Alert Users to Data Changes Creating Letterheads Managing Subscription Notifications Troubleshooting Tips Optimize the User Experience Data-Driven Events Calculated Fields Troubleshooting Tips Manage User Access Access Control Basics User Accounts Access Roles Groups Record Permissions Private Fields Troubleshooting Tips Automate Work Streams Configure a two-stage workflow Questionnaires Question Library Overview Questionnaire Creation Process Completing a Questionnaire Integration Options Data Feed Manager Search and Report on Data Quick Search Advanced Search Statistics Search and Chart Options Reporting Communicate Information to Stakeholders iviews Dashboards Workspaces Additional Configuration Options Packaging for Production Creating Packages Installing Packages Advanced Package Mapper Design Best Practices Field Design Tips Application Layout Tips Data-Driven Event Tips Application Creation Case Study Hands-on exercise in which participants are challenged to build a best-in-class application with minimal assistance Course Summary Customer Support Options Certification Exam Information Copyright 2014 EMC Corporation. All rights reserved. 09/2014 EMC 2, EMC, RSA, RSA Security, Archer, NetWitness and the RSA logo are registered trademarks of EMC Corporation in the United States and/or other countries. 33
34 RSA Archer Advanced Administration Course Description AT-A-GLANCE This course provides handson training on the administration, configuration and bestpractice deployment of the RSA Archer Platform. Overview Throughout the course, students will be presented with a diverse collection of realworld governance, risk, and compliance problems and be shown and guided through the recommended steps involved in solving these pain points by using the features available in the RSA Archer egrc Suite. Extensive hands-on labs reinforce the tasks involved in designing and automating GRC processes and extending the value of the RSA Archer egrc Suite throughout the organization. After completing this class, students will be prepared to use the RSA Archer egrc Suite to solve an extensive array of GRC problems and meet the business requirements of various enterprise stakeholders. REGISTER FOR CLASSES: For an up-to-date schedule of Instructor-led classes and other training options, visit the RSA Training and Certification web site: CONTACT US: trainingregistration@rsa.com Phone: Int l: Fax: Middlesex Turnpike Bedford, Massachusetts COURSE PART NUMBERS: ED ARCADVADM210 Onsite Class ED ARC TRAIN UNIT Training Units Audience Governance, risk, and/or compliance professionals, business owners, or IT personnel who need to automate and streamline existing processes, integrate the RSA Archer platform with third-party systems, or deliver assessments across the enterprise. Duration 4 days Prerequisite Knowledge/Skills Previous experience creating applications within the RSA Archer product or successful participation in the standard RSA Archer Administration course. Course Objectives Upon successful completion of this course, participants should be able to: Create a custom, multi-stage workflow process that automates a manual process Import existing information from a legacy system into RSA Archer applications and questionnaires Integrate the RSA Archer product with third-party systems and data sources to consolidate enterprise information Design best-practice assessment campaigns to measure compliance across the organization Construct complex search criteria to locate key information and identify data trends Visually showcase compliance with industry regulations through reports and dashboards Alert organization stakeholders through scheduled report distributions Export RSA Archer data into pre-formatted, professional-looking report templates 34
35 Course Outline Streamlining GRC Processes Day One Replicating a multi-stage workflow to transfer a manual, paper-based process to an automated, online tool Constructing a scalable access control framework for enabling end users to participate in GRC processes Automating and manipulating data through calculations to support enhanced data analytics and reduce data entry time Integrating External Data Day Two Transferring leveled, document-centric policies into a data-centric format in the RSA Archer Platform Using a data feed targeting database sources to quickly transfer legacy data to a centralized system Creating a data feed to access an RSS source and retrieve the information into an RSA Archer application Transferring data between RSA Archer applications to support data trending and reduce manual effort Demonstrating Compliance Day Three Importing compliance questions into RSA Archer s global question library Creating an assessment campaign to demonstrate compliance with internal and external regulations Managing question scoring and findings generation to better understand the risk impact to the organization Referencing existing assessment responses in future assessments Communicating GRC Data Day Four, Part I Generating real-time reports across distant data relationships to provide greater insights into GRC processes Designing a user-friendly dashboard and interface to clearly communicate the posture of various business units Delivering snapshot reports on a set schedule to inform key stakeholders of the current status Exporting RSA Archer data to and Word templates to generate professional-looking, document-based reports for senior management Publishing RSA Archer data to external databases Maintaining the System Day Four, Part II Discussing resources for the most current installation and sizing recommendations Configuring instance settings via the Archer Control Panel Accessing and reading log files Troubleshooting common RSA Archer issues to ensure effective system operations Copyright 2014 EMC Corporation. All rights reserved. 09/2014 EMC 2, EMC, RSA, RSA Security, Archer, NetWitness and the RSA logo are registered trademarks of EMC Corporation in the United States and/or other countries. 35
36 RSA Archer Custom End-User Training Data Sheet AT-A-GLANCE It was an absolutely fantastic course due to the instructor s energy, enthusiasm, and excitement about the product and interest in our success. The coaching and support throughout the process had a huge impact on our team. VP Educational Services Major Financial Institution REGISTER FOR CLASSES: For an up-to-date schedule of Instructor-led classes and other training options, visit the RSA Training and Certification web site: Overview RSA Archer supports business-level management of enterprise governance, risk and compliance. With RSA Archer you have the ability to adapt a solution to your requirements without touching a single line of code. The most demanding Fortune 500 companies have seized the power of RSA Archer to automate business process, streamline workflow, control user access, and tailor a user interface and report in real time. To ensure that your RSA Archer solution is being leveraged to its maximum potential, RSA Education Services offers the RSA Archer Custom End-User Training Service to guide you through the process of training your organization s end user population. Offering Details With practical experience using Archer solutions, business process and risk management expertise, and instructional design and training delivery skills, an RSA Training Consultant will work closely with you to understand your specific RSA Archer use case and identify learning objectives. You ll have the opportunity to review the training content along the way to ensure that you receive deliverables that will successfully meet your training objectives. While every customer s use case is unique, training may include topics like the following: RSA Archer Overview General Navigation Working with records Searching and Reporting Custom topics (defined with the customer) CONTACT US: trainingregistration@rsa.com Phone: This education service is based on a single use case and includes the following: A needs assessment to understand the customer s use case and training requirements Int l: Fax: Middlesex Turnpike Bedford, Massachusetts COURSE PART NUMBERS: A scripted PowerPoint slide deck that includes content customized to your environment Content branded with the organization s logo and standard.ppt template Unlimited use of materials for its end users Access to an editable version of the content ED ARC EUTTT 210 Train-thetrainer option ED ARC EUELN 210 E-Learning option ED ARC EUILT 210 Instructor Led Delivery by RSA It was an absolutely fantastic course due to the instructor s energy, enthusiasm, and excitement about the product and interest in our success. The coaching and support throughout the process had a huge impact on our team. VP Educational Services Large Financial Institution 36
37 ABOUT RSA RSA, The Security Division of EMC, is the premier provider of security, risk and compliance management solutions for business acceleration. RSA helps the world's leading organizations succeed by solving their most complex and sensitive security challenges. These challenges include managing organizational risk, safeguarding mobile access and collaboration, proving compliance, and securing virtual and cloud environments. Combining business-critical controls in identity assurance, encryption & key management, SIEM, Data Loss Prevention and Fraud Protection with industry leading egrc capabilities and robust consulting services, RSA brings visibility and trust to millions of user identities, the transactions that they perform and the data that is generated. For more information, please visit and or Copyright 2014 EMC Corporation. All rights reserved. 09/2014 EMC 2, EMC, RSA, RSA Security, Archer, NetWitness and the RSA logo are registered trademarks of EMC Corporation in the United States and/or other countries. 37
38 RSA Data Loss Prevention Administration Course Description AT-A-GLANCE This course provides comprehensive instruction in the administration and configuration of the RSA Data Loss Prevention (DLP) Suite. Overview Theory and product basics such as the RSA DLP Suite architecture, integration of RSA DLP components, and the importance of various configuration parameters are discussed. Students participate in hands-on exercises that build on the basic concepts and allow practical experience in building an RSA DLP system. Audience System, security, or help desk personnel who need to install, deploy and/or maintain an RSA Data Loss Prevention system. Duration 4 days REGISTER FOR CLASSES: For an up-to-date schedule of Instructor-led classes and other training options, visit the RSA Training and Certification web site: CONTACT US: trainingregistration@rsa.com Phone: Int l: Fax: Middlesex Turnpike Bedford, Massachusetts COURSE PART NUMBERS: ED DLPADM210 Onsite Class Prerequisite Knowledge/Skills Familiarity with user and system administration, networking fundamentals, and general information security concepts. Familiarity with Web, Application and directory server (LDAP) and/or Relational Database (RDBMS) technologies as well as basic programming and scripting concepts is also beneficial. Course Objectives Upon successful completion of this course, participants should be able to: List the features and benefits of the RSA Data Loss Prevention Suite of products including DLP Network, DLP Datacenter, and DLP Endpoint Administer the RSA Data Loss Prevention Enterprise Manager Create and manage RSA Data Loss Prevention policies Create and manage RSA Data Loss Prevention content blades Deploy RSA Data Loss Prevention agents and grid scan groups Review what remediation actions are available and what the benefit of each is Generate RSA Data Loss Prevention incident and event reports Perform basic operational tasks including upgrading software, importing and exporting configuration files, reviewing high availability and load balancing, applying patches, and viewing alerts ED DLP TRAIN UNIT Training Units 38
39 Course Outline Introduction to Data Loss Prevention List the key features of the RSA DLP Suite Identify the key components of the RSA DLP Suite Describe the role of RSA DLP Enterprise Manager Explain the differences between RSA DLP Network, Datacenter, and Endpoint Define how policy violations are handled by RSA DLP Endpoint Enforce Enterprise Manager Administration Login to the Enterprise Manager for the first time List the key features of Enterprise Manager Access and license the Enterprise Manager List new dashboard features Review the Enterprise Manager tabs Enter LDAP configuration settings Perform user and group administration Configure an server and notifications Delete incidents and events Display device status Network Appliance Configuration Identify the main components of RSA DLP Network Re-install an RSA DLP Network appliance Login to an RSA DLP Network appliance Perform an initial configuration of an appliance Perform basic configuration for a RSA DLP Network Interceptor Describe the Self Release feature Evaluate sensor capacity needs Diagram the ICAP server event flow Perform a basic configuration of an ICAP server Introduction to Policies Explain the function of the RSA DLP Content Classification and Analysis system Describe the use and purpose of policies in the DLP Suite Explain how content blades are used in policies to detect sensitive information Create policies using a supplied template Configure DLP Network policies in a virtual network environment DLP Datacenter List key features and components of DLP Datacenter Install the Enterprise Coordinator Configure the Enterprise Coordinator Describe the scan types available in DLP Datacenter Install and configure a site coordinator Create a grid scan group View scan status and history Creating Content Blades Compare fingerprinting and describing content List the detection accuracy methods available Discuss the importance of weight, score and count Discuss the importance of accuracy and precision Explain how a risk score determines severity Manage and create content blades Working with Fingerprinted Content Describe fingerprinting and hashes Define fingerprinting terminology Configure a file crawler Configure a database crawler Agent and Repository Scans Analyze agent scan status Configure an agent scan group Schedule an agent scan Analyze agent scan history Configure a repository database scan DLP Endpoint Explain how DLP Endpoint Enforce works List the components that comprise DLP Endpoint Configure policy settings relevant to DLP Endpoint Install DLP Endpoint Enforce agents Create a DLP Endpoint Enforce group Manually deploy a DLP Endpoint Enforce agent Workflow and Remediation Describe incident and event workflow within RSA DLP Compare DLP remediation actions Describe how manual remediation functions View policy, incident, and transmission details View incident history and notifications Reports Describe the main DLP reporting features Navigate the Enterprise Manager dashboard View and edit reports Customize a report Export report data Create DLP Asset Heat Map reports Basic Operations Export and import DLP configuration files Review backup options for DLP Discuss high availability options for DLP components Describe how to configure Enterprise Manager failover Review Patching and upgrade operations for DLP List the benefits of integrating DLP and RMS Select and associate an RMS template for use with DLP Copyright 2014 EMC Corporation. All rights reserved. 08/2014 EMC 2, EMC, RSA, RSA Security, Archer, NetWitness and the RSA logo are registered trademarks of EMC Corporation in the United States and/or other countries. 39
40 RSA ECAT Analysis Fundamentals Preliminary Course Description AT-A-GLANCE This e-learning course provides an overview of endpoint threat detection and analysis using the RSA ECAT product through a combination of lecture and demonstrations. Overview This e-learning course discusses the importance and challenge of endpoint threat detection and how RSA ECAT can be used to solve those challenges. An introduction to RSA ECAT is provided covering benefits and features, the RSA ECAT workflow, detecting malware, integrating with RSA Security Analytics, and potential remediation steps for malware. The course is comprised of lecture content as well as recorded product demonstrations to illustrate RSA ECAT in action. Audience Customers who may perform any of the following roles related to an RSA ECAT system: security analyst, computer forensic investigator, incident handler / responder, or malware analyst. Duration 90 minutes REGISTER FOR CLASSES: For an up-to-date schedule of Instructor-led classes and other training options, visit the RSA Training and Certification web site: CONTACT US: trainingregistration@rsa.com Phone: Int l: Fax: Middlesex Turnpike Bedford, Massachusetts COURSE PART NUMBERS: ED SA TRAIN UNIT Training Units Prerequisite Knowledge/Skills Students should have the following prerequisite knowledge: RSA ECAT administration Basic networking concepts Familiarity with user and system administration A basic understanding of malware Familiarity with the attack kill chain Course Objectives Upon successful completion of this course, participants should be able to: Describe the importance of endpoint threat detection Describe the architecture, components, benefits, and features of RSA ECAT Describe the RSA ECAT workflow Scan and access results from RSA ECAT Detect malware and abnormal files using RSA ECAT Configure and manage reporting and alerting within RSA ECAT Explain the basics of how RSA ECAT integrates with RSA Security Analytics 40
41 Course Outline Importance and Challenges of Advanced Threats at the Endpoint Overview of advanced threats at the endpoint Challenges in detecting and analyzing advanced threats at the endpoint Business needs related to advanced threats at the endpoint Introduction to RSA ECAT What is RSA ECAT High-level architecture overview RSA ECAT user interface components Benefits of using RSA ECAT Key features of RSA ECAT Endpoint Threat Detection and Analysis using RSA ECAT RSA ECAT Workflow Baseline ECAT solution Instant IOCs (Indicators of Compromise)and Suspect score Behavior Tracking system Detecting Known Threats Detecting Unknown Threats Finding other infected endpoints Alerts Endpoint Forensics Remediation Demonstrations: Detecting Zeus variant Detecting abnormal files in the environment ECAT Behavior Tracking System & Alerts Instant IOCs, Yara, Bit9, OPSWAT Endpoint Forensics downloading MFT, data Copyright 2014 EMC Corporation. All rights reserved. 09/2014 EMC 2, EMC, RSA, RSA Security, Archer, NetWitness and the RSA logo are registered trademarks of EMC Corporation in the United States and/or other countries. 41
42 RSA Security Analytics Administration Course Description AT-A-GLANCE This course focuses on administration of the RSA Security Analytics product. Overview The course provides an overview of RSA Security Analytics, hands-on configuration of components, managing users, and creating filters and rules. Additionally, the course covers integration with RSA envision and monitoring capabilities. Audience RSA Security Analytics Administrators Duration 3 days Prerequisite Knowledge/Skills Familiarity with networking fundamentals and general information security concepts. Familiarity with Linux. REGISTER FOR CLASSES: For an up-to-date schedule of Instructor-led classes and other training options, visit the RSA Training and Certification web site: CONTACT US: trainingregistration@rsa.com Phone: Int l: Fax: Middlesex Turnpike Bedford, Massachusetts COURSE PART NUMBERS: ED SA ADMIN Onsite class ED SA TRAIN UNIT Training Units Course Objectives Upon successful completion of this course, participants should be able to: Describe the Security Analytics architecture Describe the Security Analytics Warehouse Describe the licensing process Describe the Security Analytics User Interface Customize the interface Configure and license devices Create device groups Add users and groups Set permissions for users and groups Configure external authentication to Active Directory Set up integration with RSA envision or event sources Configure data capture including log collection Configure Live Manager Deploy feeds to the Decoder Configure the Reporting Engine Create filters and rules on the Decoder Use the REST API for basic tasks Configure SNMP Monitor the environment Identify and resolve issues Describe the RSA envision to Security Analytics migration process 42
43 Course Outline RSA Security Analytics Overview What is RSA Security Analytics RSA Security Analytics architecture Licensing RSA Security Analytics Data flow Data sources Deployment scenarios The Virtual Environment RSA Security Analytics user interface Customizing the interface Configuring RSA Security Analytics Configuring devices Configuring Live Custom feeds Configuration files Configuring the Reporting Engine Configuring Context Menu Actions Configuring the Warehouse Configuring the Warehouse Connector Configuring the Archiver Configuring Event Stream Analysis (ESA) Configuring Malware Analysis Setting Up Data Collection Setting up capture for packets and log data Configuring log collection Setting up collection for: File Reader Windows ODBC Check Point VMware SDEE SNMP Syslog Testing data capture Managing Users User administration overview Managing device users Managing RSA Security Analytics users Configuring external authentication (Active Directory) Creating Rules, Reports and Alerts Rules overview Rules data flow BPF Network rules Application rules Correlation rules Navigating data Creating Reports Creating Charts Creating Alerts Role Based Access Control Monitoring the environment Viewing statistics Monitoring devices Monitoring query performance Monitoring Concentrator aggregation Tuning the Index Resetting the databases Viewing logs REST API Troubleshooting log collection Crash Reporter Migrating from RSA envision to RSA Security Analytics Migration overview The Z-Connector Configuring the IPDB Extractor Service Migrating envision data Copyright 2014 EMC Corporation. All rights reserved. 09/2014 EMC 2, EMC, RSA, RSA Security, Archer, NetWitness and the RSA logo are registered trademarks of EMC Corporation in the United States and/or other countries. 43
44 RSA Security Analytics for Analysts Course Description AT-A-GLANCE This course provides a methodical view of the tasks involved in performing event and incident analysis, including communication and automation using the RSA Security Analytics platform. Overview This course provides a roadmap for using RSA Security Analytics for intelligence-driven analysis. The course guides the analyst through the process, providing hands-on practice with analysis techniques, such as deploying external sources, creating custom feeds, creating rules to filter data, and reporting and alerting. Malware analysis and parsers are also covered as well as methodologies and best practices for optimal results. The course provides practice with packets and logs. Audience Security analysts with less than 6 months of industry experience, who are new to RSA Security Analytics and are responsible for incident identification and response. Security analysts who need a basic understanding of the methodologies associated with malware investigations and are utilizing RSA Security Analytics to support them in executing their role. REGISTER FOR CLASSES: For an up-to-date schedule of Instructor-led classes and other training options, visit the RSA Training and Certification web site: CONTACT US: trainingregistration@rsa.com Phone: Int l: Fax: Middlesex Turnpike Bedford, Massachusetts COURSE PART NUMBERS: ED SA AN Onsite Class ED SA TRAIN UNIT Training Units Duration 5 days Prerequisite Knowledge/Skills Students should be familiar with basic computer architecture, data networking fundamentals and general information security concepts. A background in Enterprise data networking and communications is required. Programming language experience is helpful. Basic knowledge of the TCP/IP protocol stack is useful. Course Objectives Upon successful completion of this course, participants should be able to: Describe the Security Analytics architecture Describe the Security Analytics User Interface Articulate the intelligence-driven process Describe the features and functions of the Investigation Module Access source data through the Live Module Create and deploy custom feeds Filter data for investigation using rules and custom drills Communicate results using reports Automate investigations using alerts Identify and obtain sources for malware analysis Create flex parsers for malware analysis Create a parser Analyze malware using the Investigation module Investigate potential security issues based on specific use cases 44
45 Course Outline RSA Security Analytics Overview Enterprise security evolution Intelligence-Driven roadmap Security Analytics Architecture RSA Security Analytics components Packets, logs, sessions, and contents RSA Security Analytics data flow Data sources Security Analytics interface Customizing the interface Investigation Basics Best practices for data analysis Common Use Cases Investigation techniques Using the Investigation module for analysis Building Sources Enriching the Data Defining and refining sources Accessing and deploying source data using the Live Module Creating custom feeds Configuration index files Creating new metadata Creating tasks Communicating Results and Introducing Automation Using reports for communication, validation and investigation Creating reports for Compliance Creating reports to monitor the environment Creating alerts for automated analysis Generating new intelligence Writing Parsers for Analysis Introduction to parsers Creating content using parsers Parser structure and syntax Converting to flex Log parsers Analyzing Malware Stages of the network forensics process Malware analysis techniques What is network forensics? Tuning malware filters Automating malware detection Malware analysis tools and tips Malware analysis use cases Filtering and Analyzing the Data Filtering methodology Security Analytics filtering tools Performing analysis using filtering tools and techniques Filtering best practices and tips Copyright 2014 EMC Corporation. All rights reserved. 09/2014 EMC 2, EMC, RSA, RSA Security, Archer, NetWitness and the RSA logo are registered trademarks of EMC Corporation in the United States and/or other countries. 45
46 RSA Security Analytics for Logs Course Description AT-A-GLANCE This course focuses on administration of the RSA Security Analytics product when the input data is logs. Overview The course provides an overview of RSA Security Analytics, hands-on configuration of components for log collection, setting up Security Analytics event sources troubleshooting log collection, and creating reports. Additionally, the course covers writing parsers for logs. Audience RSA Security Analytics Administrators Compliance Officers Content Developers Duration 4 days REGISTER FOR CLASSES: For an up-to-date schedule of Instructor-led classes and other training options, visit the RSA Training and Certification web site: CONTACT US: trainingregistration@rsa.com Phone: Int l: Fax: Middlesex Turnpike Bedford, Massachusetts COURSE PART NUMBERS: ED SA LOGS Onsite class ED SA TRAIN UNIT Training Units Prerequisite Knowledge/Skills Familiarity with networking fundamentals and general information security concepts. Familiarity with Linux. Course Objectives Upon successful completion of this course, participants should be able to: Describe the Security Analytics architecture Identify log deployments Add and configure Security Analytics devices Configure Security Analytics for log collection Configure log collection services Configure IPDB Install the Z Connector Configuring the Security Analytics Warehouse Describe the Security Analytics Investigation Module Apply basic analysis techniques using the Investigation Module Use application rules to create alerts for compliance Create compliance reports Deploy compliance reports from Live Create device parsers Create reports using the IPDB Perform basic troubleshooting for Security Analytics log collection Perform basic troubleshooting for Security Analytics event sources 46
47 Course Outline RSA Security Analytics Overview What is RSA Security Analytics RSA Security Analytics architecture Licensing RSA Security Analytics Data flow Log Deployment Data sources Deployment scenarios Log Collection Service RSA Security Analytics user interface Customizing the interface Configuring RSA Security Analytics Administration Module Overview Configuring devices Configuring Live Custom feeds Configuration files Configuring the Reporting Engine Configuring Context Menu Actions Configuring the Security Analytics Warehouse Configuring the Security Analytics Warehouse Connector Configuring the Archiver Configuring Event Stream Analysis (ESA) Configuring the Z Connector Setting Up Data Collection Setting up capture for packets and log data Configuring log collection Data collection for syslog Setting up collection for: File Reader Windows ODBC Check Point VMware SDEE SNMP Testing data capture Event source monitoring Investigation Basics Investigation module navigation options Navigating metadata Investigating events Viewing data Creating a custom view Query construction and usage Creating an application rule Creating alerts with application rules Creating Reports and Alerts Reporting module overview Creating compliance reports Deploy compliance reports from Live Charts Creating alerts using ESA Creating Log Parsers Introduction to parsers Creating content using parsers Log parser structure Deploy and create log parsers Event Source Integrator (ESI) Basic Troubleshooting for Logs Identify and resolve common issues with Security Analytics log collection Apply troubleshooting techniques to the RSA Security Analytics log collection process Outline a troubleshooting approach for various RSA Security Analytics event sources Review techniques to monitor and troubleshoot the RSA Archiver and Security Analytics Warehouse Copyright 2014 EMC Corporation. All rights reserved. 09/2014 EMC 2, EMC, RSA, RSA Security, Archer, NetWitness and the RSA logo are registered trademarks of EMC Corporation in the United States and/or other countries. 47
48 RSA Security Operations Management Solution Basics Course Description AT-A-GLANCE This course provides an overview of the concepts, processes, and procedures to effectively use RSA Security Operations Management Solution in a Security Operations Center. Overview Students will gain knowledge of the structure and operations of the RSA Security Operations Management Solution through presentations and hands-on exercises. This course addresses the tasks and responsibilities of several typical roles and personas that are part of an organization s Security Operations Center. Audience Customers who perform the following jobs can benefit from this course: Security Operations Center (SOC) manager Breach coordinator Incident coordinator Incident handler IT Helpdesk analyst Duration 2 days REGISTER FOR CLASSES: For an up-to-date schedule of Instructor-led classes and other training options, visit the RSA Training and Certification web site: CONTACT US: trainingregistration@rsa.com Phone: Int l: Fax: Middlesex Turnpike Bedford, Massachusetts COURSE PART NUMBERS: ED SECOPS210 Onsite Class ED ARC TRAIN UNIT Training Units Prerequisite Knowledge/Skills To receive the most benefit from this training, we recommend that students have: Basic understanding of the use and management of RSA Archer and RSA Archer Enterprise Management Solution Basic understanding of the use and management of RSA Security Analytics Familiarity with basic security event reporting and analysis Familiarity with basic Security Operations Center functions and tasks Course Objectives Upon successful completion of this course, participants should be able to: Understand the industry standards such as VERIS, NIST, and SANS with respect to reporting and managing a security incident response process; and how RSA Security Operations Management Solution is so aligned Understand the high-level solution architecture of the RSA Security Operations Management Solution Explain the security operations management workflow supported by the RSA Security Operations Management Solution Explain and navigate the built-in dashboards of the RSA Security Operations Management Solution Identify and understand the differences between the six personas (roles) supported by the RSA Security Operations Management Solution Understand the workflows in the solution for the respective SOC personas Identify the phases and workflow relating to incident management Understand the contribution of RSA Security Operations Management Solution to SOC operations 48
49 Course Outline Security Operations Management Overview Function and purpose of a Security Operations Center (SOC) Security incident response industry standards [VERIS, NIST, and SANS] Capabilities of RSA Security Operations Management Solution Solution architecture Key personas in Security Operations Management Security Operations workflow RSA Archer Enterprise Management Solution Overview Introduction to RSA Security Operations Management Solution RSA Security Operations Management Solution dashboards and navigation RSA Security Operations Management Solution implementation lifecycle Managing SOC Readiness Managing the SOC staff and Contacts Managing SOC policies and procedures Incident Response Incident response workflow Alerts and incidents; aggregating alerts Incident types Incident Declaration, Creation, Assignment, Review, and Closure Incident response tasks Incident escalation Incident investigation, forensic and impact analysis Handling shift handovers Data Breach Response Data Breach response workflow Breach risk assessment Declaring a breach Creating and assigning breach tasks Executing a call tree Remediation Issue remediation workflow Findings process Resolving and reviewing findings Exception process Remediation plan Copyright 2013 EMC Corporation. All rights reserved. 08/2013 EMC 2, EMC, RSA, RSA Security, Archer, NetWitness and the RSA logo are registered trademarks of EMC Corporation in the United States and/or other countries. 49
50 RSA Adaptive Authentication On-Premise Administration Course Description AT-A-GLANCE This course offers hands-on training on the installation, integration, configuration, and administration of RSA Adaptive Authentication On- Premise. Overview The working principles behind RSA Adaptive Authentication On-Premise architecture, system components, and administrative tasks are discussed. Extensive hands-on labs reinforce the tasks involved in implementing an RSA Adaptive Authentication On-Premise system. Audience System, security, or help desk administrators who need to install, configure and/or maintain an RSA Adaptive Authentication On-Premise system. Duration 3 days REGISTER FOR CLASSES: For an up-to-date schedule of Instructor-led classes and other training options, visit the RSA Training and Certification web site: CONTACT US: trainingregistration@rsa.com Phone: Int l: Fax: Middlesex Turnpike Bedford, Massachusetts COURSE PART NUMBERS: ED AAOPADMIN210 Onsite Class Prerequisite Knowledge/Skills Familiarity with user and system administration, networking fundamentals, and general information security concepts. Course Objectives Upon successful completion of this course, participants should be able to: Explain the basic architecture and theory of operation of RSA Adaptive Authentication On-Premise Describe how RSA Adaptive Authentication On-Premise determines risk Describe the recommended workflows Perform the installation tasks involved in installing RSA Adaptive Authentication On- Premise Explain the steps required to integrate RSA Adaptive Authentication On-Premise with a web application Use the Back Office Applications to configure, manage, and administer RSA Adaptive Authentication On-Premise Perform the day to day administrative tasks to keep the RSA Adaptive Authentication On-Premise functioning properly ED AA TRAIN UNIT Training Units 50
51 Course Outline Operations Session (Day 1 and 2) RSA Adaptive Authentication On-Premise Overview Relevant terminology Features and benefits of RSA Adaptive Authentication On-Premise Risk-Based authentication Device profiling Behavioral profiling What is multi-factor authentication? How RSA Adaptive Authentication On-Premise provides for multi-factor authentication RSA Adaptive Authentication On-Premise Architecture System components overview Network Integration RSA efraudnetwork RSA Risk Engine Policy Management Back Office Applications RSA Central GeoIP Service Scheduler Adaptive Authentication utilities RSA Adaptive Authentication On-Premise Workflows and Processes Terminology used in workflows RSA Adaptive Authentication On-Premise workflows RSA Adaptive Authentication On-Premise Installation Pre-installation overview Installing RSA Adaptive Authentication On- Premise Post-installation tasks Setting up maintenance and development utilities RSA Adaptive Authentication Configuration The configuration framework Creating default configuration files Customizing configuration files RSA Adaptive Authentication On-Premise Integration Introduction to the Web services API and methods Collecting device information Message format and recommended data elements RSA Adaptive Authentication Back Office Applications Overview of the Back Office Applications Access Management Report Viewer Operations Administration Console GeoIP Update Schedule tasks Update the efraud Network agent Log files RSA Central Back Office Tools Session (Day 3) RSA Adaptive Authentication On-Premise Overview Relevant terminology Features and benefits of RSA Adaptive Authentication On-Premise Risk-Based authentication Device profiling Behavioral profiling What is multi-factor authentication? How RSA Adaptive Authentication On- Premise provides for multi-factor authentication System Components Overview RSA Adaptive Authentication On-Premise Risk Score Calculation How Adaptive Authentication determines risk Risk score calculation stages RSA Adaptive Authentication On-Premise Workflows and Processes Terminology used in workflows RSA Adaptive Authentication On-Premise workflows RSA Adaptive Authentication Back Office Applications Overview of the Back Office Applications Access Management Policy Management Case Management Customer Service Application Report Viewer Copyright 2014 EMC Corporation. All rights reserved. 06/2014 EMC 2, EMC, RSA, RSA Security, Archer, NetWitness and the RSA logo are registered trademarks of EMC Corporation in the United States and/or other countries. 51
52 RSA Adaptive Authentication for ecommerce Back Office Tools Course Description AT-A-GLANCE This course offers training on the RSA Adaptive Authentication for ecommerce Back Office Tools. Overview The working principles behind RSA Adaptive Authentication technology, architecture, and system components are discussed. Video demonstrations reinforce the tasks involved in using the RSA Adaptive Authentication Back Office Tools. Audience Team Leaders/Fraud Strategists responsible for fraud prevention planning. Customer Service Representatives who provide support for card holders requiring online transaction assistance, and Fraud Investigators/Analysts. Duration Approximately 2 hours The modules and content presented depends on the student s job role. The job role is selected from a menu presented at the beginning of the training. REGISTER FOR CLASSES: For an up-to-date schedule of Instructor-led classes and other training options, visit the RSA Training and Certification web site: CONTACT US: trainingregistration@rsa.com Phone: Int l: Fax: Middlesex Turnpike Bedford, Massachusetts COURSE PART NUMBERS: ED AA TRAIN UNIT Training Units Prerequisite Knowledge/Skills Familiarity with general information security concepts. Course Objectives Upon successful completion of this course, participants should be able to: Define RSA Adaptive Authentication for ecommerce Explain the basic system architecture and components of RSA Adaptive Authentication for ecommerce Provide an overview of the RSA Adaptive Authentication for ecommerce Back Office Tools Use the Back Office Tools including: Back Office Administration Customer Service Case Management Policy Manager Management Information Reports Generate Web Reports Describe Raw Data Reports Copyright 2014 EMC Corporation. All rights reserved. 06/2014 EMC 2, EMC, RSA, RSA Security, Archer, NetWitness and the RSA logo are registered trademarks of EMC Corporation in the United States and/or other countries. 52
53 Course Outline RSA Adaptive Authentication for ecommerce Overview History and evolution of Adaptive Authentication for ecommerce Components and processes that make up 3DSecure Transaction Monitoring The RSA Risk Engine and efraudnetwork Describe low, high, and very high risk transaction workflows Back Office Tools Overview Overview of the Back Office tools Back Office Administration Customer Service Case Management Policy Manager Management Information Reports Back Office Administration Describe the hierarchical structure of users Roles and access Manage groups Manage CSRs Case Management Application Describe a case List case management best practices Explain the importance of feedback and working cases Describe repudiation files View and update cases Policy Manager Application View and update rule definitions Add rules Activate a new test rule Edit and delete rules Reporting Describe the different types of reports available Generate web reports Describe Raw Data Reports Describe MIS reports Customer Service Application Validate a cardholder s identity Manage cardholders View activity and transaction logs Use the Personal Account Manager Work with alerts Copyright 2014 EMC Corporation. All rights reserved. 06/2014 EMC 2, EMC, RSA, RSA Security, Archer, NetWitness and the RSA logo are registered trademarks of EMC Corporation in the United States and/or other countries. 53
54 RSA Adaptive Authentication 12 Migration Course Description AT-A-GLANCE This e-learning course provides an overview modifications for the RSA Adaptive Authentication 12 product through a combination of lecture and demonstrations. Overview This e-learning course describes the back office applications of RSA Adaptive Authentication version 12, with emphasis on the changes compared to the previous version: version 11. The course is comprised of recorded product demonstrations to illustrate RSA Adaptive Authentication 12 in action. Audience Customers who may perform any of the following roles related to an RSA Adaptive Authentication deployment: administration, configuration or maintenance. Duration 60 minutes REGISTER FOR CLASSES: For an up-to-date schedule of Instructor-led classes and other training options, visit the RSA Training and Certification web site: CONTACT US: trainingregistration@rsa.com Phone: Int l: Fax: Middlesex Turnpike Prerequisite Knowledge/Skills Students should have the following prerequisite knowledge: Exposure to administration within RSA Adaptive Authentication Familiarity with RSA Adaptive Authentication 11 Back Office applications Course Objectives Upon successful completion of this course, participants should be able to work effectively with the new back office applications of RSA Adaptive Authentication 12, including: Managing administrative settings Managing access to back office applications Policy Management Case Management Customer Service Web Reports Bedford, Massachusetts COURSE PART NUMBERS: ED AA TRAIN UNIT Training Credits Copyright 2014 EMC Corporation. All rights reserved. 06/2014 EMC 2, EMC, RSA, RSA Security, Archer, NetWitness and the RSA logo are registered trademarks of EMC Corporation in the United States and/or other countries. 54
55 Course Outline Migration Preparation Phase Pre-requisites Removing Beacon and Web Redirect Upgrading API Provisioning Data Migration Migration Silent Period Changing SOAP URL and FQDN Removing STU and Proxies Re-implementing RDR, CM API, Bath Files and BO SSO Re-creating policies New Features Device Identification Module Back Coloring efn Enhancements Back Office Differences URLs Case Management Customer Service Updates Policy Management Changes Admin Console Changes Copyright 2014 EMC Corporation. All rights reserved. 06/2014 EMC 2, EMC, RSA, RSA Security, Archer, NetWitness and the RSA logo are registered trademarks of EMC Corporation in the United States and/or other countries. 55
56 RSA Web Threat Detection Essentials Course Description AT-A-GLANCE This course provides customers with the knowledge and skills they need to use the RSA Web Threat Detection Product solutions. Overview On Day One, users navigate the RSA Web Threat Detection Back Office applications such as the Dashboard, Profile Timeline and more, in their own environment and learn how to evaluate and diagnose web session trends and threats via the RSA Web Threat Detection Dashboard interface. On Day Two, users learn to write rules that result in alerts and actions that provide critical information for further analysis and reporting. All training is delivered on-site at the customer s location. During these two days, the training will include real-world examples and best practices that RSA Web Threat Detection Threat Analysts use today. Audience Security analysts and/or administrators who will be using the RSA Web Threat Detection system. REGISTER FOR CLASSES: For an up-to-date schedule of Instructor-led classes and other training options, visit the RSA Training and Certification web site: CONTACT US: trainingregistration@rsa.com Phone: Int l: Fax: Middlesex Turnpike Bedford, Massachusetts COURSE PART NUMBERS: ED WTD ES 210 Onsite Class ED WTD TRAIN UNIT Training Units Duration 2 days Prerequisite Knowledge/Skills Day One attendees will need: An understanding of web logic abuse and forensic investigation A general understanding of HTTP, and how web sites work Day Two attendees will need the Day One knowledge, plus: A general understanding of rules syntax, regular expressions, or similar technologies Course Objectives Upon successful completion of this course, participants should be able to: Navigate the RSA Web Threat Detection back office applications Perform searches and analytics based on specific data elements and timeframes Identify threats, patterns and abnormal behavior based on high risk behaviors Create Rules and Alerts Implement best practices for rules management 56
57 Course Outline Day One: Day Two: Introduction to RSA Web Threat Detection Analysis tools Overview of detection logic concepts Introduction to threat score types Overview of rules and alerts RSA Analysis User Interface utilities Dashboard Profile Timeline Risk Indicators Page Analysis User Analysis IP Analysis Score trends Recent incidents Search Search Overview Step-by-Step Process Search Examples RSA WTD User/IP Lookup Search Query Management Export of Search Results Introduction to Rules Rules Interface Structure of a Rule Forensics and Mitigation Rules Language Data Functions Threat Scores Advanced Techniques Registers External Data Sets Rules Management Alerts and Events Best Practices Appendix Example Rules Glossary Rules Overview Rules Typologies Rules Data Rule Format Rule Syntax Rule Functions Use Cases Copyright 2014 EMC Corporation. All rights reserved. 08/2014 EMC 2, EMC, RSA, RSA Security, Archer, NetWitness and the RSA logo are registered trademarks of EMC Corporation in the United States and/or other countries 57
58 RSA Intelligence-Driven Event Analysis Course Description AT-A-GLANCE The RSA Intelligence-Driven Event Analysis course discusses an intelligencedriven approach to event and incident management for a Security Analyst in a forward-thinking Security Operations Center (SOC). Overview Participants learn about intelligence-driven SOC processes, standard operating procedures (SOPs), and monitoring tools. They learn to recognize the formats associated with the various sources of information available in a network environment. The course follows the end-to-end workflow of a Security Analyst, including all appropriate steps that are needed to handle each type of identified security incident. Audience IT professionals with 2 to 3 years of experience in a troubleshooting role, such as a systems/network engineer, a system administrator, network operations analyst, or a newly-hired security analyst. Knowledge of security fundamentals is required. Duration 2 days REGISTER FOR CLASSES: For an up-to-date schedule of Instructor-led classes and other training options, visit the RSA Training and Certification web site: CONTACT US: trainingregistration@rsa.com Phone: Int l: Fax: Middlesex Turnpike Bedford, Massachusetts COURSE PART NUMBERS: ED ACD IDEA 210 Onsite Class ED ACD TRAIN UNIT Training Units Prerequisite Knowledge/Skills Proven capabilities with networking fundamentals, operating systems, and security concepts such as confidentiality, integrity, availability, authentication, and identity. Course Objectives Upon successful completion of this course, participants should be able to: Identify the roles and responsibilities in a SOC. Interpret sources of information in a SOC. Describe how Security Analysts interact with information and data in the SOC environment. Monitor incoming event queues for potential security events and/or incidents using various security tools per operational procedures. Perform initial investigation and triage of potential incidents. Investigate/analyze an incident. Escalate an incident for further analysis aligned to SOPs. Document and communicate investigative results aligned to escalation and/or handoff SOPs. Walk through an incident from alert to escalation to closure. Apply concepts that are learned in the classroom setting to their specific working environment. Industry tools used in this course include: PsTools Sysinternals Suite Nmap/ZenMap RSA Archer Wireshark RSA Security Analytics Process Explorer 58
59 Course Outline Roles and Responsibilities in a Security Operations Center Describe the purpose of a Security Operations Center (SOC) and its basic structure. Define an event and an incident and describe the difference between the two terms. Identify the roles and responsibilities in a SOC. Name some of the tools that are commonly used to monitor events in the SOC. Outline some of the key components in the incident processing workflow Interpreting Sources of Information Diagram the components and tools of technical environment you are working in Categorize sources of information available to a security analyst Recognize information formats Establish the context of the observed information/data Assimilate external threat data and threat intelligence Apply internal and external sources of intelligence to an incident Interacting with Information (Identifying Events) Become the eyes on glass Analyze logs from distributed system and network security devices Monitor all alerting systems Inspect network packet data View information using a console Correlating Events Define event correlation Use several correlation engines Assist in the identification of potential computer and communications security issues Correlate events and incidents with knowledge base of historical events and incidents Triaging Events Follow the triage process Prioritize incidents Apply standard operating procedures Analyzing incidents using sources of information Explain the incident is your system infected? Demonstrate fundamental understanding of all standard information sources Determine whether an incident occurred and handle appropriately Escalation and Handoff Escalate an event for further analysis to the incident handler Follow the SLA to resolution or escalation Standard operating procedures and analysis Documenting and Communicating Issues Update the internal knowledge base and wiki Perform maintenance activities on security related databases Assimilate external threat data and threat intelligence Copyright 2015 EMC Corporation. All rights reserved. 01/2015 EMC 2, EMC, RSA, RSA Security, Archer, NetWitness and the RSA logo are registered trademarks of EMC Corporation in the United States and/or other countries. 59
60 RSA Incident Handling and Response Course Description AT-A-GLANCE The RSA Incident Handling and Response course prepares a security analyst to take on incident handling responsibilities in a forward-thinking Security Operations Center (SOC). Overview The course provides a thorough overview of tasks, processes, procedures, escalation workflows and tools used by a Security Analyst/Incident Handler. Through use cases, examples, and hands-on exercises, participants investigate a variety of critical incident response scenarios. The instructional material emphasizes decision-making and prioritization with the goal of teaching the students how to make an assessment in a short amount of time using security monitoring instrumentation, contextual analysis and correlation to indicators of network exploitation. Students develop a broader understanding of the role the SOC fulfills in the larger organization, including exposing them to the legal and regulatory compliance issues associated with incident response and assessing organizational risk. Audience Security Analysts with 6-12 months of experience working in a Security Operations Center, Network Operation Center (NOC), Critical Incident Response Team (CIRT) or similar function. REGISTER FOR CLASSES: For an up-to-date schedule of Instructor-led classes and other training options, visit the RSA Training and Certification web site: CONTACT US: trainingregistration@rsa.com Phone: Int l: Fax: Middlesex Turnpike Bedford, Massachusetts COURSE PART NUMBERS: ED ACD IHR 210 Onsite Class ED ACD TRAIN UNIT Training Units Duration 3 days Prerequisite Knowledge/Skills Students who have taken the RSA Intelligence-Driven Event Analysis training course and have 6-12 months of experience as a security analyst. Course Objectives Upon successful completion of this course, participants should be able to: Outline sustainable and repeatable tasks, process, procedures, escalation points and workflows of the Security Analyst/Incident Handler. Ingest daily intelligence reports and previous shift logs. Recognize the legal, corporate investigative responsibilities and compliance issues associated with incident response. Participate in risk analysis for central and distributed networks to include the impact of cloud based infrastructures as part of the SOC. Outline sustainable and repeatable tasks, process, procedures, escalation points and workflows of the Security Analyst/Incident Handler. Monitor security events using all SOC data sources. Investigate all incidents aligned to proper process, procedure and escalation points. Prioritize incident response relative to threat severity, business context and activity volume. Recommend, develop, and implement remediation procedures. Create an incident report with appropriate handoffs and closure. Coordinate, de-conflict and align event and incident communication. Support root cause analysis. Prepare communication for executives and enterprise stakeholders. 60
61 Course Outline The Tools and Tasks of an Incident Handler List the tasks, processes, procedures and escalation points of a level two security analyst Identify the tools used by the Incident Handler Provide examples of the types of incidents handled by the Level Two security analyst Ingest daily intelligence reports and previous shift logs for efficient operations handoffs, escalations and transitions Participating in Regulatory Compliance Define security compliance Describe the types of compliance standards Outline the steps to become compliant with a standard Distinguish a security program from a compliance program Outline what happens during a compliance audit Identify the responsibilities of a security analyst for a security audit Contributing to Risk Assessment and Mitigation Define organizational risk. Identify organizational assets and their business function. Categorize the impact of a loss of an asset or business function. Monitor security controls to mitigate the risk to your organization. Contribute to risk analysis for central and distributed networks. Assess the vulnerabilities of the organizational assets protected by the SOC. Outline an approach to risk management. Investigating an Incident Outline the steps to take when investigating a security incident. Develop a set of questions when presented with an incident. Gather data important to describing and documenting the incident. Document all collected data. Analyze the collected data in order to put the pieces together to tell a story. Make recommendations for next steps for the incident investigation. Prioritizing Incident Response Evaluate threat severity, business context and activity volume when prioritizing incident response. Identify escalation points for incident response. List steps in shift handoff. Outline the structure of a shift log entry. List best practices for the shift log. Recommending Remediation Recommend remediation to operations Make recommendations to appropriate department for each incident Addressing After-Action Items Create an incident report Derive and incorporate threat intelligence from incident Participate in root cause analysis Preparing Executive-level Communications Summarize the outcome of a security incident. Identify the various audiences for a security incident report. Identify appropriate content for each audience. Develop the outline of a report for internal and external audience. Industry tools used in this course include: RSA Security Analytics RSA Archer Copyright 2015 EMC Corporation. All rights reserved. 01/2015 EMC 2, EMC, RSA, RSA Security, Archer, NetWitness and the RSA logo are registered trademarks of EMC Corporation in the United States and/or other countries. 61
62 RSA Threat Intelligence Course Description AT-A-GLANCE The RSA Threat Intelligence course provides Security Analysts with comprehensive instruction on the global threat ecosystem and strategies that organizations can take to protect their assets. Overview In the context of the current threat environment, students learn ways to detect and correlate data for better threat analysis; reduce breach exposure time and break the cyber kill chain; and manage current and future threats. As participants progress through the course, their perceptions of threats will evolve, and they will receive instruction on the role of threat intelligence in security systems that are evolving along with the threat environment. Students participate in hands-on and table-top exercises to practice strategies for analyzing attacks and mitigating their effects, and for applying intelligence-driven security practices in their own organizations. REGISTER FOR CLASSES: For an up-to-date schedule of Instructor-led classes and other training options, visit the RSA Training and Certification web site: CONTACT US: Phone: Int l: Fax: Middlesex Turnpike Bedford, Massachusetts COURSE PART NUMBERS: ED ACD TI 210 Onsite Class ED ACD TRAIN UNIT Training Units Audience Security analysts who investigate, analyze, and resolve or escalate incidents and issues; monitor external security information sources; or feed actionable intelligence back into systems SOC managers who want to implement a Threat Intelligence capability Novice security analysts who meet prerequisites and want to advance their skills Duration 2 days Prerequisite Knowledge/Skills Students who have taken the RSA intelligence-drive Event Analysis course. Familiarity with computer architecture principles; networking concepts, and information security theory. Course Objectives Upon successful completion of this course, participants should be able to: Describe the current global threat ecosystem Illustrate the logical components of an advanced security program List best practices for planning advanced defenses Describe the cyber kill chain Provide examples of cyber kill chain intervention Compare traditional threats and Advanced Persistent Threats Find and use sources of threat intelligence Perform threat modeling of high-value assets and high-value adversaries Gather and analyze threat intelligence Manage the threat lifecycle 62
63 Course Outline Threat Overview Current Threat Ecosystem Ecosystem Overview Communities of Attackers Targets Vulnerabilities Avenues of Attack Tactics, Techniques, and Procedures Advanced Persistent Threats Threat Intelligence in an Advanced Security Program Shortcomings of Traditional Security Measures Advanced Approaches to Information Security Advanced Security Operations Center Model Planning Advanced Defenses Guiding Principles for Defending the Enterprise Defining a Cyber Footprint Quantifying Risk Applying Security Best Practices Promoting User Education Types of Threats Crimeware Advanced Persistent Threats (APTs) Cyber Kill Chain Attack Progression Anatomy of an Attack Cyber Kill Chain Model Kill Chain Interventions Detecting Attacks Indicators of Compromise Network-based Indicators Host-based Indicators Intelligence Sources Government Industry Associations & Networks Commercial Sources Open Source Extended Enterprise Internal Organization Sources Threat Modeling Threat Modeling Perspective Profiling Targets APT Targets Reconnoitering Targets, Web Presence, Industries, Social Media, High-Value Assets Threat Actor Attribution Actor Identification Target Identification Actor Behaviors Communication Strategy Threat Modeling Resources Developing Threat Intelligence Command and Control Protocol Decoding Passive DNS Monitoring Operations Threat Infrastructure Enumeration Command and Control Domain Correlation Intrusion Set Attribution Public-Facing Web Infrastructure Threat Management Detecting Threats Threat Mitigation Strategy Predicting Threats Copyright 2015 EMC Corporation. All rights reserved. 01/2015 EMC 2, EMC, RSA, RSA Security, Archer, NetWitness and the RSA logo are registered trademarks of EMC Corporation in the United States and/or other countries. 63
64 RSA Malware Analysis Course Description AT-A-GLANCE The RSA Malware Analysis course provides security analysts with tools and techniques for analyzing malware and extracting indicators of compromise. Overview The RSA Malware Analysis course provides students with the knowledge and skills to identify and act on actionable intelligence gathered through the process of malware analysis. Students are introduced to the threat landscape and common malware vectors. They learn to select and apply the tools and techniques required to reverse, monitor, and detect a malware threat. Students develop a workflow to gather intelligence and apply it to their security environment. Audience Security analysts, computer forensic investigators, incident responders who have basic knowledge of malware analysis and want to know more about the tools and techniques associated with gathering and responding to actionable intelligence. Duration 4 days REGISTER FOR CLASSES: For an up-to-date schedule of Instructor-led classes and other training options, visit the RSA Training and Certification web site: CONTACT US: trainingregistration@rsa.com Phone: Int l: Fax: Middlesex Turnpike Bedford, Massachusetts COURSE PART NUMBERS: ED ACD MA 210 Onsite Class ED ACD TRAIN UNIT Training Units Prerequisite Knowledge/Skills Students who have taken the Intelligence-Driven Event Analysis, Incident Handling & Response, and Threat Intelligence courses or have commensurate experience. Familiarity with computer architecture principles, operating system theory, networking principles (including protocols and communication channels), and fundamental principles of computer security. Experience with programming and scripting concepts is also required. (Python is used during the course.) Course Objectives Upon successful completion of this course, participants should be able to: Describe the RSA Cyber Defense recommended workflow for reverse engineering current malware threats. Assess the presence of malware on system. Examine behavior of malware and its interaction with its environment using dynamic analysis tools and techniques. Analyze command and control (C2) communication methods to establish the intention and functionality of the malware. Deduce the program instructions of a malware executable through the use static analysis tools. Combine static and dynamic analysis methods to investigate more complex features of malware using disassembly and debugging tools. Collect and report actionable intelligence gained from reverse engineering malware. Recommend changes to a security program based upon actionable intelligence. Industry tools used in this course include: Process Monitor Process Explorer Process Hacker Regshot Wireshark HBGary Flypaper CFF Explorer IDA PRO (free version) Immunity Debugger Volatility Yara Malzilla JSBeautifier JD-GUI Peepdf 64
65 Course Outline Introduction to Malware Analysis Define the components of malware and how they work together to compromise a system Identify common malware vectors Describe the phases of the intrusion kill chain Outline the tasks involved in malware analysis Create a safe environment for investigating malware code and behavior. Assessing the Existence and Persistence of Malware Establish Indicators of Compromise Identify host-based artifacts. Identify network-based artifacts. Locate indicators of compromise. Determine malware s method of persistence. Outline the procedure for assessing the presence of malware on a system. Dynamic Analysis of Malware Outline process of dynamic analysis Apply dynamic analysis techniques in order to investigate malware s behavior in a virtual environment. Examine malware execution using a debugger. Identify anti-analysis techniques. Defend against anti-analysis techniques. Analyze commonly exploited file formats. Investigating Command and Control Communications Define command and control communication as used by malware. List the types of activities an attacker engages in using C2. Describe C2 techniques. Outline the procedure to capture and analyze C2 traffic. Describe how to set up an environment to investigate C2. Identify the tools critical to C2 investigation. Intercept SSL. Address the issue of C2 Not Responding. Static Analysis of Malware Explain the process of static analysis. List the outcomes of the static analysis process. Classify sources of data viable for analysis. Identify packing and obfuscation methods used by malware. Describe how compressed files are able to avoid detection. Disassemble malware executable code using IDAPro. Organize information and data gained from static analysis Advanced Malware Techniques Multiple layers of obfuscation Botnets Backdoors Debugging using Ollydbg Analyze memory for the presence of rootkits using Volatility Making Recommendations Based upon Actionable Intelligence Collecting Actionable Intelligence Gained from Malware Analysis Identify trends and problems to solve Communicate Actionable Intelligence Formulate recommendations Develop Yara rules to classify malware Copyright 2015 EMC Corporation. All rights reserved. 01/2015 EMC 2, EMC, RSA, RSA Security, Archer, NetWitness and the RSA logo are registered trademarks of EMC Corporation in the United States and/or other countries. 65
66 RSA SOC Simulation Challenge ( SOCSim ) Offering Description AT-A-GLANCE Experience the challenge of competition while responding to questions based on a real-world breach scenario. Overview RSA SOCSim, a forensic analysis experience, exposes participants to network and forensic analysis within a real-world breach scenario using simulated SOC dynamics. Participants are presented with a use case that requires them to analyze data flowing over the network. They are guided through the analysis by challenge questions using a Jeopardy! style interface based on the Cyber Kill Chain methodology. Answers are derived through data exploration and investigation of sophisticated "puzzles within puzzles" such as protocol and application analysis, steganography, reverse engineering, encryption/decryption, open source intelligence and much more... Industry tools used in this course include: RSA Security Analytics Other open source tools At the end of the challenge, the RSA facilitator will provide an overview of the breach scenario, including key analytical discoveries for each phase of the Cyber Kill Chain and respond to outstanding questions that participants may have. Audience Security analysts, computer forensic investigators, incident responders who have had exposure to network, log and host forensic analysis, and want to challenge themselves with simulated breach scenarios. REGISTER: For an up-to-date schedule of Instructor-led classes and other training options, visit the RSA Training and Certification web site: CONTACT US: trainingregistration@rsa.com Phone: Int l: Fax: Middlesex Turnpike Bedford, Massachusetts COURSE PART NUMBER: Public: ED ACD TRAIN UNIT (9 units) Onsite: ED ACD SOCSIM 210 Duration Approximately 6 hours. Prerequisite Knowledge/Skills Exposure to network and host forensic analysis is beneficial. Some security operations experience would be helpful. Working knowledge of RSA Security Analytics is required. Course Objectives At the end of the challenge, participants will walk away with hands on experience and exposure to: Network forensics through network protocol and application analysis Malware forensics through static and dynamic analysis Use of open source threat intelligence Common breach scenarios/tactics Cyber Kill Chain methodology Common tools used by network analysts/incident handlers Experience of RSA s Experts RSA and EMC have a 30-year legacy of working with clients worldwide to deliver security solutions. RSA has leveraged its relationships with industry leaders to give you deep insight into the most current threats and the intelligence-driven techniques and tools to mitigate the risk of disclosure of information. 66
67 RSA Cyber Defense Workshop Course Description AT-A-GLANCE The RSA Cyber Defense Workshop is designed to give participants practical experience as security analysts who work in a Security Operations Center (SOC), Critical Incident Response Center (CIRC) or other critical incident response capacity. Overview In this advanced workshop, participants are immersed in a simulated CIRC environment where they assume different roles and manage the security events that take place over the course of a three-day scenario. Day-to-day security incidents will occur alongside potentially catastrophic activity related to the advanced tactics of determined and persistent adversaries. Each member of the CIRC Team will have to utilize skills and tools in order to detect, contain and eradicate the threat as well as document the incidents for executive review. There is virtually no lecture associated with this workshop; participants learn by doing. This is the perfect opportunity for members of security teams to sharpen their skills related to the newest attacks in a controlled environment assisted by experts. The Workshop provides valuable insights for determining the specific skillsets and tools that an organization needs in order to mitigate these most advanced types of attacks against corporate assets. REGISTER FOR CLASSES: For an up-to-date schedule of Instructor-led classes and other training options, visit the RSA Training and Certification web site: CONTACT US: trainingregistration@rsa.com Phone: Int l: Fax: Middlesex Turnpike Bedford, Massachusetts COURSE PART NUMBERS: ED ACD CDW 210 Onsite Class ED ACD TRAIN UNIT Training Units Audience Security analysts, computer forensic investigators, incident responders who have had exposure to malware analysis and want to know more about the tools and techniques associated with gathering and responding to actionable intelligence while acting as a member of a critical incident response team. Duration 3 days Prerequisite Knowledge/Skills Participation in the RSA Incident Handling & Response course or commensurate experience. Some exposure to malware analysis, incident response, and risk/compliance are beneficial. Participants should have some security operations experience. Some experience with RSA Security Analytics would be helpful. Experience of RSA s Experts RSA and EMC have a 30-year legacy of working with clients worldwide to deliver security solutions. RSA has leveraged its relationships with industry leaders to give you deep insight into the most current threats and the techniques and tools to mitigate the risk of disclosure of information. This course will empower attendees with that knowledge and give them the opportunity to prove their current skill set and add to it in a meaningful way. Industry tools used in this course include: RSA Security Analytics RSA Security Operations Management (RSA SecOps) Other open source tools 67 67
68 Topics covered in the Workshop Scenario Because this workshop will be completely scenario based, a formal course outline is not applicable. Throughout this workshop, participants will engage in: Malware Analysis Network Analysis Network Forensics Threat Intelligence Incident Triage Executive Presentation Security Operations Team Management Legal, Regulations, & Investigations Open Source and Commercial Tools I found the training to be very good. The teamwork, mandatory executive interaction and related reporting were excellent. The training simulated a fast paced real world scenario where we had to work cohesively as a team on a tight analysis schedule. Incident Response Analyst, Leading Technology Vendor 68 Copyright 2015 EMC Corporation. All rights reserved. 01/2015 EMC 2, EMC, RSA, RSA Security, Archer, NetWitness and the RSA logo are registered trademarks of EMC Corporation in the United States and/or other countries. 68
69 RSA Security Awareness Program Solution Description Overview AT-A-GLANCE 70% of respondents to a 2013 Deloitte survey rated lack of employee security awareness as an average or high vulnerability. Deloitte TMT Global Security Study February 2013 Deloitte Media Release In 2013 there were nearly 450,000 phishing attacks and record estimated losses of over USD $5.9 billion. Phishing remains an ominous threat to consumers and businesses around the world A Year in Review January 2014 RSA Fraud Report TO REGISTER: Visit the RSA Training and Certification web site: CONTACT US: trainingregistration@rsa.com Phone: Int l: Fax: Middlesex Turnpike Bedford, Massachusetts Information Security for any organization requires a holistic approach that involves and affects every part of the organization. One open door is all that is required for an attacker to be successful. It doesn t matter if that open door belongs to the CEO or the mail room clerk. All are potentially vulnerable and all are equally important to include in protection tactics. Effective protection involves not only products, processes and services it involves awareness of potential threats and everyday actions that can be taken by every organization member to protect valuable resources and information. RSA s Security Awareness program offers ways to test and measure vulnerability, then provide essential education to fill any gaps. Our Security Awareness training can target virtually every level of an organization raising awareness and offering concrete steps to effect change, thus helping to prevent attackers from gaining a foothold through unsuspecting targets. Service Highlights Risk Assessment One of the key components of RSA s offerings is the ability to assess the risk that an organization s members pose through lack of knowledge or by unwarily opening an attachment or browsing to a web site. RSA s services can assess users knowledge, target specific users or groups, and simulate attacks to appraise and measure response. With such powerful information, appropriate training can be identified and disseminated to users, which helps close the gap between ignorance and intelligence in the realm of information security. Reporting and Metrics RSA Security Awareness services allow Security Management to benchmark, track, and trend user compliance, assessment, training activity, and ultimately, improvement. Reports help show who has been assessed, who has participated in training, score reports - where appropriate, and overall metrics for the organization. Reports can be compiled in a number of ways to show trends by organization segment, geographic region, subject area, and more. In the case where scoring is used such as in quizzes or surveys information can be linked through SCORMcompliant data to an organization s own learning management system. Delivery Options Much of the training delivered to end users is in the form of elearning, which allows a high degree of flexibility and acceptance by participants. Some technical subjects may also be delivered as instructor-led sessions. Hosting of elearning material can be arranged by RSA or can be delivered from an organization s own learning portal. 69
70 Why Security Awareness programs are so important Security Awareness needs to be an integral and ongoing part of an organization s operations. Minimal compliance training imparted to employees on an irregular or occasional basis are insufficient to arm a workforce with the acuity and knowledge that they need to recognize potential attacks. Successful attacks, in turn, can do expensive and sometimes irreparable harm to an organization. It is far better to thwart an attack than to remediate it after the fact. Security Awareness services help you evaluate risks through phishing, social engineering and other attack methods allowing you to manage and educate employees proactively before a breach can occur. RSA s services take a multi-tiered approach to not only inform an organization s members of effective security practices but to offer measurements and simulated attack vectors to continuously evaluate your organization s ability to recognize and repel threats. Organizations today are often faced with resource constraints that limit the amount of internal education that can be directed toward information security. RSA s services offer a near turn-key solution to help solve these constraints. RSA s services can be delivered in multiple ways, can be customized for an organization, and can be targeted to specific learning styles and languages of members throughout an organization. Learning modules range from very targeted technical topics through gamification of learning material. All are designed to help engage and capture the attention of individuals so that they can better support an organization s security posture. Training to fit all organizational segments General Staff Security Awareness training for general employee populations include a variety of elearning modules covering such subjects as Password security, Phishing and Malware awareness, and and Mobile Device security. Modules can be combined into an effective, comprehensive program for the entire organization. IT Staff Role-based Security Awareness training for IT staff targets topics of particular interest and relevance to IT professionals who can build a security mindset into their daily tasks and toils. Whether involved with networking, systems management, or database administration, RSA s training programs address the security considerations that can make a difference in these day-to-day operations. Development Staff Role-based Security Awareness training for Development Staff is designed to help build security controls and protection into development projects on a variety of platforms. Participants learn the common programming flaws and how to test projects from a security standpoint. In today s environment, applications secured at the design and development level are essential to minimize the expense and logistics of distributing security patches and to help prevent product denigration through vulnerabilities. Customized to your organization s needs In addition to the variety of subject matter available, RSA s services can be customized to include your organization s design elements such as corporate branding, can include specific information that relates to your organization s policies and procedures, and offerings are available in a number of languages. Pricing may vary based on customization so please contact your RSA Education Sales person for specific details and options. ABOUT RSA RSA, The Security Division of EMC, is the premier provider of security, risk and compliance management solutions for business acceleration. RSA helps the world s leading organizations succeed by solving their most complex and sensitive security challenges. These challenges include managing organizational risk, safeguarding mobile access and collaboration, proving compliance, and securing virtual and cloud environments. Combining business-critical controls in identity assurance, encryption & key management, SIEM, Data Loss Prevention and Fraud Protection with industry leading egrc capabilities and robust consulting services, RSA brings visibility and trust to millions of user identities, the transactions that they perform and the data that is generated. For more information, please visit and Copyright 2014 EMC Corporation. All rights reserved. 06/2014 EMC 2, EMC, RSA, RSA Security, Archer, NetWitness and the RSA logo are registered trademarks of EMC Corporation in the United States and/or other countries. 70
71 RSA Certified Information Systems Security Professional (CISSP) Certification Boot Camp Course Description AT-A-GLANCE RSA Education Services provides training worldwide on RSA products and advanced security topics. Our mission is to enable the next generation of security professionals to address the latest threats to information and infrastructure security. RSA s CISSP Boot Camp has been developed and reviewed by security practitioners, thought leaders, and contributing authors to provide the most widely recognized CISSP materials available. REGISTER FOR CLASSES: For an up-to-date schedule of Instructor-led classes and other training options, visit the RSA Training and Certification web site: CONTACT US: trainingregistration@rsa.com Phone: Int l: Fax: Middlesex Turnpike Bedford, Massachusetts COURSE PART NUMBERS: ED CISSP 210 Onsite Class ED STRS TRAIN UNIT Training Units GET PREPPED FOR THE CISSP EXAM BY RSA S SECURITY EXPERTS RSA has developed an effective program to help prepare candidates to become security practitioners and successfully pass the (ISC) 2 CISSP certification exam. This Certification Boot Camp involves intensive lectures, demonstrations, and review questions delivered by a security professional with years of experience as a practitioner. Not only will participants become prepared to take the exam but the anecdotes and real world examples from this course are invaluable insight into real world security challenges and approaches to solve them. The modules of this course follow the 10 Domains of the (ISC) 2 Common Body of Knowledge. Each module presents the concepts and vocabulary from a technical and management aspect, bridging the gap that is often present in organizations today, a holistic approach to the technical, physical and administrative controls that make up a security program. Each module is also followed by review questions, detailed explanations and exam tips related to the material and how it may be presented on the exam. RSA s CISSP Boot Camp has been updated to reflect the 2012 Domain Name and content changes. Participants will come away empowered for the exam and beyond Common Body of Knowledge Domains Access Control Telecommunications and Network Security Information Security Governance & Risk Management Software Development Security Cryptography Security Architecture and Design Security Operations Business Continuity and Disaster Recovery Legal, Regulations, Investigations and Compliance Physical (Environmental) Security Added Bonus Module: Security Insights from Senior Executives RSA has a 30-year legacy of working with clients worldwide to deliver security solutions. In this module, we explore the security issues that senior executives from global organizations face as they enable their businesses and implement their security programs. This content is unique to RSA s CISSP Curriculum and not available elsewhere. RSA Education Services is not affiliated with ISC2 or its subsidiaries. Participation in this course does not guarantee the successful completion of the ISC2 CISSP Exam. RSA Education Services has developed the course content from direct experience in the areas of the Common Body of Knowledge and has used the ISC2 CISSP Candidate Information Bulletin as a reference as to technical depth and topics on the exam. Course costs do not include exam fees or facilitate exam registration. Exam schedules are available on ISC2.org. Copyright 2014 EMC Corporation. All rights reserved. 06/2014 EMC 2, EMC, RSA, RSA Security, Archer, NetWitness and the RSA logo are registered trademarks of EMC Corporation in the United States and/or other countries. 71
72 RSA Learning Assessments Enable faster technology adoption and increase productivity OVERVIEW AT-A-GLANCE Free to individuals and organizations Easy online access Measures knowledge of RSA products and other security-related concepts. Group assessments can be administered to identify gaps across a team Customization of assessments & reports As organizations increasingly depend on technology to manage their businesses, the need for employees to be knowledgeable about security is increasingly evident. Whether they are IT security professionals or general office staff, having the appropriate security knowledge and skills to perform their jobs is a critical business driver. To plan and position your security training initiatives cost-effectively, RSA Learning Assessments are tools to measure your team s knowledge of RSA products and other security-related concepts. Based on the learning assessment results, we can work with you to identify a learning program that works for you and your team. We provide learning assessments free of charge on the following RSA products and topics: RSA Adaptive Authentication RSA Archer RSA Security Analytics RSA SecurID Security Awareness WHERE TO GO Individuals can take an online RSA Learning Assessment at: For group assessments, contact us at: learningassessments@rsa.com RSA Education Services Phone: International: Middlesex Turnpike Bedford, Massachusetts KEY BENEFITS RSA Learning Assessments are useful for organizations who recognize a need for training but aren t quite sure what training their team really needs. By leveraging RSA Learning Assessments, you can better understand the learning gaps and make an informed decision about the most effective individual and group training plans for your team. And, online RSA Learning Assessments are available to you at no charge. An assessment can be completed within minutes with immediate results provided to the assessment taker. For a team assessment, management reports can be provided that evaluates individual and group results. You ll have greater confidence that both the time and financial investment in training will more quickly enable your technology adoption and increase productivity
RSA CUSTOMER EDUCATION CATALOG
RSA CUSTOMER EDUCATION CATALOG S e r v i c e s C a t a l o g Q 4 2015 COURSE DESCRIPTION INDEX Identity and Access Management RSA Access Manager Administration, Installation and Configuration... 9 RSA
More informationRSA Archer Training. Governance, Risk and Compliance. Managing enterprise-wide governance, risk and compliance through training and education
RSA Archer Training Governance, Risk and Compliance Managing enterprise-wide governance, risk and compliance through training and education www.emc.com/rsa-training 1 RSA Archer Training Table of Contents
More informationRSA EDUCATION SERVICES CATALOG
RSA EDUCATION SERVICES CATALOG Services Catalog - April 2012 COURSE DESCRIPTION INDEX Access Management Authentication Enterprise Governance, Risk and Compliance Data Loss Prevention RSA Access Manager
More informationRSA EDUCATION SERVICES CATALOG
RSA EDUCATION SERVICES CATALOG Services Catalog Q 2 2014 COURSE DESCRIPTION INDEX Identity and Access Management Authentication Governance, Risk and Compliance Data Loss Prevention Network Monitoring and
More informationRSA SecurID Certified Administrator (RSA Authentication Manager 8.0) Certification Examination Study Guide
RSA SecurID Certified Administrator (RSA Authentication Manager 8.0) Certification Examination Study Guide Introduction The RSA SecurID Certified Administrator (CA) examination is based on the critical
More informationRSA SecurID Two-factor Authentication
RSA SecurID Two-factor Authentication Today, we live in an era where data is the lifeblood of a company. Now, security risks are more pressing as attackers have broadened their targets beyond financial
More informationRSA Authentication Manager 7.1 to 8.1 Migration Guide: Upgrading RSA SecurID Appliance 3.0 On Existing Hardware
RSA Authentication Manager 7.1 to 8.1 Migration Guide: Upgrading RSA SecurID Appliance 3.0 On Existing Hardware Contact Information Go to the RSA corporate website for regional Customer Support telephone
More informationwith Managing RSA the Lifecycle of Key Manager RSA Streamlining Security Operations Data Loss Prevention Solutions RSA Solution Brief
RSA Solution Brief Streamlining Security Operations with Managing RSA the Lifecycle of Data Loss Prevention and Encryption RSA envision Keys with Solutions RSA Key Manager RSA Solution Brief 1 Who is asking
More informationTECHNOLOGY PARTNER CERTIFICATION BENEFITS AND PROCESS
TECHNOLOGY PARTNER CERTIFICATION BENEFITS AND PROCESS BUSINESS BENEFITS Use of the Certified Partner seal and the Secured by RSA brand on product packaging and advertising Exposure in the Secured by RSA
More informationIdentity and Access Management Integration with PowerBroker. Providing Complete Visibility and Auditing of Identities
Identity and Access Management Integration with PowerBroker Providing Complete Visibility and Auditing of Identities Table of Contents Executive Summary... 3 Identity and Access Management... 4 BeyondTrust
More informationRSA Authentication Manager 7.1 Administrator s Guide
RSA Authentication Manager 7.1 Administrator s Guide Contact Information Go to the RSA corporate web site for regional Customer Support telephone and fax numbers: www.rsa.com Trademarks RSA and the RSA
More informationThe RSA Solution for. infrastructure security and compliance. A GRC foundation for VMware. Solution Brief
The RSA Solution for Cloud Security and Compliance A GRC foundation for VMware infrastructure security and compliance Solution Brief The RSA Solution for Cloud Security and Compliance enables end-user
More informationRSA Authentication Manager 8.1 Help Desk Administrator s Guide
RSA Authentication Manager 8.1 Help Desk Administrator s Guide Contact Information Go to the RSA corporate website for regional Customer Support telephone and fax numbers: www.emc.com/domains/rsa/index.htm
More informationIMPLEMENTING A SECURITY ANALYTICS ARCHITECTURE
IMPLEMENTING A SECURITY ANALYTICS ARCHITECTURE Solution Brief SUMMARY New security threats demand a new approach to security management. Security teams need a security analytics architecture that can handle
More informationRSA Solution Brief. The RSA Solution for Cloud Security and Compliance
The RSA Solution for Cloud Security and Compliance The RSA Solution for Cloud Security and Compliance enables enduser organizations and service providers to orchestrate and visualize the security of their
More informationRSA Authentication Manager 8.1 Help Desk Administrator s Guide. Revision 1
RSA Authentication Manager 8.1 Help Desk Administrator s Guide Revision 1 Contact Information Go to the RSA corporate website for regional Customer Support telephone and fax numbers: www.emc.com/domains/rsa/index.htm
More informationEMC Physical Security Enabled by RSA SecurID Two-Factor Authentication with Verint Nextiva Review and Control Center Clients
EMC Physical Security Enabled by RSA SecurID Two-Factor Authentication with Verint Nextiva Review and Control Center Clients A Detailed Review EMC Information Infrastructure Solutions Abstract This white
More informationDirX Identity V8.4. Secure and flexible Password Management. Technical Data Sheet
Technical Data Sheet DirX Identity V8.4 Secure and flexible Password Management DirX Identity provides a comprehensive password management solution for enterprises and organizations. It delivers self-service
More informationRSA Authentication Manager 6.1 to 8.1 Migration Guide. Revision 1
RSA Authentication Manager 6.1 to 8.1 Migration Guide Revision 1 Contact Information Go to the RSA corporate website for regional Customer Support telephone and fax numbers: www.emc.com/domains/rsa/index.htm
More informationCustomer Learning Catalog
Hitachi Data Systems Academy Customer Learning Catalog All Regions Release 15.7 Welcome to the HDS Academy Learning Catalog. This valuable tool guides you through your HDS learning roadmap. All learning
More informationProvide access control with innovative solutions from IBM.
Security solutions To support your IT objectives Provide access control with innovative solutions from IBM. Highlights Help protect assets and information from unauthorized access and improve business
More informationCMB 207 1I Citrix XenApp and XenDesktop Fast Track
CMB 207 1I Citrix XenApp and XenDesktop Fast Track This fast paced course provides the foundation necessary for students to effectively centralize and manage desktops and applications in the datacenter
More informationCMB-207-1I Citrix Desktop Virtualization Fast Track
CMB-207-1I Citrix Desktop Virtualization Fast Track Description This fast-paced course provides the foundation necessary for students to effectively centralize and manage desktops and applications in the
More informationCourse Agenda: Managing Active Directory with NetIQ Directory and Resource Administrator and NetIQ Exchange Administrator
Course Agenda: Managing Active Directory with NetIQ Directory and Resource Administrator and NetIQ Exchange Administrator Products Covered: Who Should Attend: NetIQ Directory And Resource Administrator
More informationRSA Authentication Manager 7.0 Planning Guide
RSA Authentication Manager 7.0 Planning Guide Contact Information See the RSA corporate web site for regional Customer Support telephone and fax numbers. RSA Security Inc. www.rsa.com Trademarks RSA and
More informationAn Overview of Samsung KNOX Active Directory and Group Policy Features
C E N T R I F Y W H I T E P A P E R. N O V E M B E R 2013 An Overview of Samsung KNOX Active Directory and Group Policy Features Abstract Samsung KNOX is a set of business-focused enhancements to the Android
More informationCNS-207 Implementing Citrix NetScaler 10.5 for App and Desktop Solutions
CNS-207 Implementing Citrix NetScaler 10.5 for App and Desktop Solutions The objective of Implementing Citrix NetScaler 10.5 for App and Desktop Solutions is to provide the foundational concepts and skills
More informationRSA Authentication Manager 7.1 Basic Exercises
RSA Authentication Manager 7.1 Basic Exercises Contact Information Go to the RSA corporate web site for regional Customer Support telephone and fax numbers: www.rsa.com Trademarks RSA and the RSA logo
More informationSafeguarding the cloud with IBM Dynamic Cloud Security
Safeguarding the cloud with IBM Dynamic Cloud Security Maintain visibility and control with proven security solutions for public, private and hybrid clouds Highlights Extend enterprise-class security from
More informationDirX Identity V8.5. Secure and flexible Password Management. Technical Data Sheet
Technical Data Sheet DirX Identity V8.5 Secure and flexible Password Management DirX Identity provides a comprehensive password management solution for enterprises and organizations. It delivers self-service
More informationRSA Authentication Manager 8.1 Virtual Appliance Getting Started
RSA Authentication Manager 8.1 Virtual Appliance Getting Started Thank you for purchasing RSA Authentication Manager 8.1, the world s leading two-factor authentication solution. This document provides
More informationMicrosoft Project Server 2010 Technical Boot Camp
Microsoft Project Server 2010 Technical Boot Camp Course M50558 5 Day(s) 30:00 Hours Introduction Course retirement date: November 30, 2012 For a complete list of courseware retirements, see: www.microsoft.com/learning/en/us/training/retired
More informationImplementing Microsoft Azure Infrastructure Solutions
Course Code: M20533 Vendor: Microsoft Course Overview Duration: 5 RRP: 2,025 Implementing Microsoft Azure Infrastructure Solutions Overview This course is aimed at experienced IT Professionals who currently
More informationRSA Authentication Manager 7.1 Administrator s Guide
RSA Authentication Manager 7.1 Administrator s Guide Contact Information Go to the RSA corporate web site for regional Customer Support telephone and fax numbers: www.rsa.com Trademarks RSA and the RSA
More informationCourse overview. CompTIA A+ Certification (Exam 220 902) Official Study Guide (G188eng verdraft)
Overview This 5-day course is intended for those wishing to qualify with. A+ is a foundation-level certification designed for IT professionals with around 1 year's experience whose job role is focused
More informationADAPTIVE AUTHENTICATION ADAPTER FOR JUNIPER SSL VPNS. Adaptive Authentication in Juniper SSL VPN Environments. Solution Brief
ADAPTIVE AUTHENTICATION ADAPTER FOR JUNIPER SSL VPNS Adaptive Authentication in Juniper SSL VPN Environments Solution Brief RSA Adaptive Authentication is a comprehensive authentication platform providing
More informationProven LANDesk Solutions
LANDesk Solutions Descriptions Proven LANDesk Solutions IT departments face pressure to reduce costs, reduce risk, and increase productivity in the midst of growing IT complexity. More than 4,300 organizations
More informationRSA Authentication Manager 8.1 Planning Guide. Revision 1
RSA Authentication Manager 8.1 Planning Guide Revision 1 Contact Information Go to the RSA corporate website for regional Customer Support telephone and fax numbers: www.emc.com/domains/rsa/index.htm Trademarks
More informationImplementing Microsoft Azure Infrastructure Solutions 20533B; 5 Days, Instructor-led
Implementing Microsoft Azure Infrastructure Solutions 20533B; 5 Days, Instructor-led Course Description This course is aimed at experienced IT Professionals who currently administer their on-premises infrastructure.
More informationTwo-Factor Authentication
WHITE PAPER: TWO-FACTOR AUTHENTICATION: A TCO VIEWPOINT........................................ Two-Factor Authentication Who should read this paper This whitepaper is directed at IT, Security, and Compliance
More informationStrengthen security with intelligent identity and access management
Strengthen security with intelligent identity and access management IBM Security solutions help safeguard user access, boost compliance and mitigate insider threats Highlights Enable business managers
More informationHP Service Manager. Software Version: 9.40 For the supported Windows and Linux operating systems. Application Setup help topics for printing
HP Service Manager Software Version: 9.40 For the supported Windows and Linux operating systems Application Setup help topics for printing Document Release Date: December 2014 Software Release Date: December
More information6231A - Maintaining a Microsoft SQL Server 2008 Database
6231A - Maintaining a Microsoft SQL Server 2008 Database Course Number: 6231A Course Length: 5 Days Certification Exam This course will help you prepare for the following Microsoft Certified Professional
More informationWhite paper December 2008. IBM Tivoli Access Manager for Enterprise Single Sign-On: An overview
White paper December 2008 IBM Tivoli Access Manager for Enterprise Single Sign-On: An overview Page 2 Contents 2 Executive summary 2 The enterprise access challenge 3 Seamless access to applications 4
More informationCourse 20533: Implementing Microsoft Azure Infrastructure Solutions
Course 20533: Implementing Microsoft Azure Infrastructure Solutions Overview About this course This course is aimed at experienced IT Professionals who currently administer their on-premises infrastructure.
More informationHow To Manage A Privileged Account Management
Four Best Practices for Passing Privileged Account Audits October 2014 1 Table of Contents... 4 1. Discover All Privileged Accounts in Your Environment... 4 2. Remove Privileged Access / Implement Least
More informationeeye Digital Security Product Training
eeye Digital Security Product Training Retina CS for System Administration (4MD) This hands-on instructor led course provides security system administration/analysts with the skills and knowledge necessary
More informationImplementing Microsoft Azure Infrastructure Solutions
Course 20533A: Implementing Microsoft Azure Infrastructure Solutions Page 1 of 7 Implementing Microsoft Azure Infrastructure Solutions Course 20533A: 4 days; Instructor-Led Introduction This course is
More informationCitrix Desktop Virtualization Fast Track
Citrix Desktop Virtualization Fast Track Description: Days: 5 Prerequisites: This fast-paced course provides the foundation necessary for students to effectively centralize and manage desktops and applications
More informationPrivileged. Account Management. Accounts Discovery, Password Protection & Management. Overview. Privileged. Accounts Discovery
Overview Password Manager Pro offers a complete solution to control, manage, monitor and audit the entire life-cycle of privileged access. In a single package it offers three solutions - privileged account
More informationLesson Plans Microsoft s Managing and Maintaining a Microsoft Windows Server 2003 Environment
Lesson Plans Microsoft s Managing and Maintaining a Microsoft Windows Server 2003 Environment (Exam 70-290) Table of Contents Table of Contents... 1 Course Overview... 2 Section 0-1: Introduction... 4
More informationHP SiteScope software
HP SiteScope software When you can see availability and performance, you can improve it. Improve the availability and performance of your IT environment HP SiteScope software helps you to agentlessly monitor
More informationFIVE KEY CONSIDERATIONS FOR ENABLING PRIVACY IN HEALTH INFORMATION EXCHANGES
FIVE KEY CONSIDERATIONS FOR ENABLING PRIVACY IN HEALTH INFORMATION EXCHANGES The implications for privacy and security in the emergence of HIEs The emergence of health information exchanges (HIE) is widely
More informationAdvanced Configuration Steps
Advanced Configuration Steps After you have downloaded a trial, you can perform the following from the Setup menu in the MaaS360 portal: Configure additional services Configure device enrollment settings
More informationApplication Discovery Manager User s Guide vcenter Application Discovery Manager 6.2.1
Application Discovery Manager User s Guide vcenter Application Discovery Manager 6.2.1 This document supports the version of each product listed and supports all subsequent versions until the document
More informationMANAGEMENT AND ORCHESTRATION WORKFLOW AUTOMATION FOR VBLOCK INFRASTRUCTURE PLATFORMS
VCE Word Template Table of Contents www.vce.com MANAGEMENT AND ORCHESTRATION WORKFLOW AUTOMATION FOR VBLOCK INFRASTRUCTURE PLATFORMS January 2012 VCE Authors: Changbin Gong: Lead Solution Architect Michael
More informationRSA, The Security Division of EMC. Zamanta Anguiano Sales Manager RSA
RSA, The Security Division of EMC Zamanta Anguiano Sales Manager RSA The Age of the Hyperextended Enterprise BUSINESS ISSUES IMPACT Innovation Collaboration Exploding Information Supply Chain Customer
More informationCentrify DirectAudit Jump Start Service
CENTRIFY DATASHEET Centrify DirectAudit Jump Start Service What is the Centrify DirectAudit Jump Start Service? The Centrify DirectAudit Jump Start Basic Service is designed to give customers a quick start
More informationManaging Office 365 Identities and Services 20346C; 5 Days, Instructor-led
Managing Office 365 Identities and Services 20346C; 5 Days, Instructor-led Course Description This is a 5-day Instructor Led Training (ILT) course that targets the needs of IT professionals who take part
More informationIT Service Management with System Center Service Manager
Course 10965B: IT Service Management with System Center Service Manager Page 1 of 9 IT Service Management with System Center Service Manager Course 10965B: 3 days; Instructor-Led Introduction This Three-day
More informationRSA Identity Management & Governance (Aveksa)
RSA Identity Management & Governance (Aveksa) 1 RSA IAM Enabling trusted interactions between identities and information Access Platform Authentication Federation/SSO Employees/Partners/Customers Identity
More informationRSA ARCHER OPERATIONAL RISK MANAGEMENT
RSA ARCHER OPERATIONAL RISK MANAGEMENT 87% of organizations surveyed have seen the volume and complexity of risks increase over the past five years. Another 20% of these organizations have seen the volume
More informationManaging Office 365 Identities and Services
Course 20346B: Managing Office 365 Identities and Services Page 1 of 7 Managing Office 365 Identities and Services Course 20346B: 4 days; Instructor-Led Introduction This is a 4-day Instructor Led Training
More informationClassroom Training Schedule
Course Date and Location Classroom Training Schedule 4.4 System Administration Date Location With this course you ll receive a comprehensive overview of the Vocera communications system, with details on
More informationRSA Authentication Manager 8.1 Administrator s Guide
RSA Authentication Manager 8.1 Administrator s Guide Contact Information Go to the RSA corporate website for regional Customer Support telephone and fax numbers: www.emc.com/domains/rsa/index.htm Trademarks
More informationAn Overview of Samsung KNOX Active Directory-based Single Sign-On
C E N T R I F Y W H I T E P A P E R. S E P T E M B E R 2013 An Overview of Samsung KNOX Active Directory-based Single Sign-On Abstract Samsung KNOX is a set of business-focused enhancements to the Android
More informationCONNECTING ACCESS GOVERNANCE AND PRIVILEGED ACCESS MANAGEMENT
CONNECTING ACCESS GOVERNANCE AND PRIVILEGED ACCESS MANAGEMENT ABSTRACT Identity and access governance should be deployed across all types of users associated with an organization -- not just regular users
More informationMigrating to RSA Authentication Manager Version 8.1
Migrating to RSA Authentication Manager Version 8.1 2014 EMC Corporation All Rights Reserved Rev. P3 1 Why Migrate to AM 8.1? Solid, quality release puts your authentication platform on excellent footing
More informationData Sheet: Archiving Altiris Client Management Suite 7.0 from Symantec Deploy, manage, secure, and troubleshoot
Deploy, manage, secure, and troubleshoot Overview The cost of a PC is only a small part of its total cost. Nearly 80 percent of the total cost of owning a client system goes toward the support and maintenance
More informationSalesforce Certified Force.com Developer Study Guide
Salesforce Certified Force.com Developer Study Guide Summer 15 STUDY GUIDE 0 Contents ABOUT THE SALESFORCE CERTIFIED FORCE.COM DEVELOPER PROGRAM... 1 SECTION 1. PURPOSE OF THIS STUDY GUIDE... 1 SECTION
More informationInfor CRM Education on Infor Campus
Infor CRM Education on Infor Campus Infor CRM courses are located on Infor Campus here! Instructions to locate and register for Infor CRM videos, non-certification, and certification courses are included
More informationQlik Sense Enabling the New Enterprise
Technical Brief Qlik Sense Enabling the New Enterprise Generations of Business Intelligence The evolution of the BI market can be described as a series of disruptions. Each change occurred when a technology
More informationSe i o Pricing Document
Se i o Pricing Document This document details pricing structures and policies for ServiceNow. It includes information on the ServiceNow pricing model for standard packages as well as all options and add---ons.
More informationEssentials of Training. Your resource for Education Services
Essentials of Training Your resource for Education Services Introduction As the educational arm of Enterprise Software, our mission is to empower Customers through premier, customer-centric educational
More informationCourse 20533B: Implementing Microsoft Azure Infrastructure Solutions
Course 20533B: Implementing Microsoft Azure Infrastructure Solutions Sales 406/256-5700 Support 406/252-4959 Fax 406/256-0201 Evergreen Center North 1501 14 th St West, Suite 201 Billings, MT 59102 Course
More informationSP Monitor. nfx One gives MSPs the agility and power they need to confidently grow their security services business. NFX FOR MSP SOLUTION BRIEF
NFX FOR MSP SOLUTION BRIEF SP Monitor Jump Start Security-as-a-Service Designed to give you everything you need to get started immediately providing security-as-a service, SP Monitor is a real-time event
More informationRSA Authentication Manager 7.0 Administrator s Guide
RSA Authentication Manager 7.0 Administrator s Guide Contact Information See the RSA corporate web site for regional Customer Support telephone and fax numbers. RSA Security Inc. www.rsa.com Trademarks
More informationVulnerability Management
Vulnerability Management Buyer s Guide Buyer s Guide 01 Introduction 02 Key Components 03 Other Considerations About Rapid7 01 INTRODUCTION Exploiting weaknesses in browsers, operating systems and other
More informationRSA Authentication Manager 8.1 Setup and Configuration Guide. Revision 2
RSA Authentication Manager 8.1 Setup and Configuration Guide Revision 2 Contact Information Go to the RSA corporate website for regional Customer Support telephone and fax numbers: www.emc.com/domains/rsa/index.htm
More informationVMware vsphere Data Protection Evaluation Guide REVISED APRIL 2015
VMware vsphere Data Protection REVISED APRIL 2015 Table of Contents Introduction.... 3 Features and Benefits of vsphere Data Protection... 3 Requirements.... 4 Evaluation Workflow... 5 Overview.... 5 Evaluation
More informationRSA SecurID Software Token 1.0 for Android Administrator s Guide
RSA SecurID Software Token 1.0 for Android Administrator s Guide Contact Information See the RSA corporate web site for regional Customer Support telephone and fax numbers: www.rsa.com Trademarks RSA,
More informationPayment Card Industry Data Security Standard
Symantec Managed Security Services support for IT compliance Solution Overview: Symantec Managed Services Overviewview The (PCI DSS) was developed to facilitate the broad adoption of consistent data security
More informationLDAP Authentication Configuration Appendix
1 Overview LDAP Authentication Configuration Appendix Blackboard s authentication technology is considered a focal point in the company s ability to provide true enterprise software. Natively, the Blackboard
More informationLEARNING SOLUTIONS website milner.com/learning email training@milner.com phone 800 875 5042
Course 6451B: Planning, Deploying and Managing Microsoft System Center Configuration Manager 2007 Length: 3 Days Published: June 29, 2012 Language(s): English Audience(s): IT Professionals Level: 300 Technology:
More informationBasic Administration for Citrix XenApp 6.5 Course CXA206; 5 Days, Instructor-led
Basic Administration for Citrix XenApp 6.5 Course CXA206; 5 Days, Instructor-led Course Description Basic Administration for Citrix XenApp 6.5 training course provides the foundation necessary for administrators
More informationWhite Paper. Anywhere, Any Device File Access with IT in Control. Enterprise File Serving 2.0
White Paper Enterprise File Serving 2.0 Anywhere, Any Device File Access with IT in Control Like it or not, cloud- based file sharing services have opened up a new world of mobile file access and collaborative
More informationMcAfee VirusScan and epolicy Orchestrator Administration Course
McAfee VirusScan and epolicy Orchestrator Administration Course Intel Security Education Services Administration Course Training The McAfee VirusScan and epolicy Orchestrator Administration course from
More informationHow To Manage Security On A Networked Computer System
Unified Security Reduce the Cost of Compliance Introduction In an effort to achieve a consistent and reliable security program, many organizations have adopted the standard as a key compliance strategy
More informationAltiris IT Management Suite 7.1 from Symantec
Altiris IT 7.1 Achieve a new level of predictability Overviewview Change is inevitable for IT and it comes from several sources: changing needs from lines of business, managing and supporting too many
More informationRSA Authentication Manager 7.1 Security Best Practices Guide. Version 2
RSA Authentication Manager 7.1 Security Best Practices Guide Version 2 Contact Information Go to the RSA corporate web site for regional Customer Support telephone and fax numbers: www.rsa.com. Trademarks
More informationWhen your users take devices outside the corporate environment, these web security policies and defenses within your network no longer work.
Deployment Guide Revision C McAfee Web Protection Hybrid Introduction Web Protection provides the licenses and software for you to deploy Web Gateway, SaaS Web Protection, or a hybrid deployment using
More informationEMC Physical Security Enabled by RSA SecurID Two-Factor Authentication with Genetec Omnicast Client Applications
RSA SecurID Two-Factor Authentication with Genetec Omnicast Client Applications A Detailed Review EMC Information Infrastructure Solutions Abstract This white paper provides the reader with an overall
More informationData Sheet: Endpoint Management Altiris Client Management Suite 7.0 Deploy, manage, secure, and troubleshoot
Deploy, manage, secure, and troubleshoot Overview The cost of a PC is only a small part of its total cost. Nearly 80 percent of the total cost of owning a client system goes toward the support and maintenance
More informationThe SIEM Evaluator s Guide
Using SIEM for Compliance, Threat Management, & Incident Response Security information and event management (SIEM) tools are designed to collect, store, analyze, and report on log data for threat detection,
More informationMICROSOFT BITLOCKER ADMINISTRATION AND MONITORING (MBAM)
MICROSOFT BITLOCKER ADMINISTRATION AND MONITORING (MBAM) MICROSOFT BITLOCKER ADMINISTRATION AND MONITORING (MBAM) Microsoft BitLocker Administration and Monitoring (MBAM) provides a simplified administrative
More informationBlackStratus for Managed Service Providers
BLACKSTRATUS FOR MSP SOLUTION GUIDE PAGE TM BlackStratus for Managed Service Providers With BlackStratus MSP suite of solutions, you can quickly and effectively ramp up customer security offerings and
More informationSecurity management White paper. Develop effective user management to demonstrate compliance efforts and achieve business value.
Security management White paper Develop effective user management to demonstrate compliance efforts and achieve business value. September 2008 2 Contents 2 Overview 3 Understand the challenges of user
More informationSimplified Management With Hitachi Command Suite. By Hitachi Data Systems
Simplified Management With Hitachi Command Suite By Hitachi Data Systems April 2015 Contents Executive Summary... 2 Introduction... 3 Hitachi Command Suite v8: Key Highlights... 4 Global Storage Virtualization
More informationAchieve Your Business and IT Goals with Help from CA Services
Achieve Your Business and IT Goals with Help from CA Services How Does CA Services Approach an Engagement? Whether its planning, implementing or running our industry leading software, CA Services can help
More information