Events

The Cybersecurity and Infrastructure Security Agency (CISA) is proud to offer Incident Response Training event, Defend Against Ransomware Attacks Cyber Range Training (IR209). The 200-level training events are open to government employees and contractors across federal, state, local, tribal, and territorial government, educational partners, and critical infrastructure partners. Please use your organization email address when registering.

This course is ideal for those working in cybersecurity roles who are interested in learning technical incident response skills and requires active engagement from all participants. The course assumes a mixed audience (e.g., from disparate teams and organizations) of mixed capability.

Ransomware is the fastest growing malware threat targeting home, business, and government networks. Anyone with a computer connected to the internet is a target. Ransomware infection is one computer, one person, one click away from penetrating a network’s defense. If just one computer becomes infected with ransomware it could quickly spread all over the network, which is why ransomware protection is critical. Ransomware incidents have become increasingly prevalent and pose an enormous risk to you and your organization’s critical infrastructure. In this training, participants will be introduced to common applications and process that harden network defenses, as well as key terms to be aware of in the prevention of ransomware attacks.

Experience these benefits and more: 

• Common attack methods: Define ransomware and identify best practices and preventive measures to mitigate the impact of ransomware attacks. 

• Practice in a realistic environment: Learn how to apply specific tools to configure and backup active directory policies, reset KRBTGT account passwords and create application allowlisting policies. 

• Identify and mitigate vulnerabilities in real time: Students will identify malicious domains and mitigate them by establishing a sinkhole and by blocking the malicious domain.  

• Expert facilitation and peer discussion: Throughout the course, expert cybersecurity engineers will moderate discussions and conduct a recovery debrief for the exercises. Participants are also encouraged to help one another and offer relevant input to address peers' questions.

This exercise is a step-by-step, facilitated experience that uses a keyboard approach to understand these topics in a realistic technical environment.

Approved registrants must attend a mandatory student technical check the day before the training to establish a connection to the course content and lab environment.

The Cybersecurity and Infrastructure Security Agency (CISA) is proud to offer the Incident Response Training event, Preventing DNS Infrastructure Tampering Cyber Range Training (IR206). The 200-level training events are open to government employees and contractors across federal, state, local, tribal, and territorial government, educational partners, and critical infrastructure partners. Please use your organization email address when registering.

This course is ideal for those working in cybersecurity roles who are interested in learning technical incident response skills and requires active engagement from all participants. The course assumes a mixed audience (e.g., from disparate teams and organizations) of mixed capability.

DNS is one of the core foundations of the internet however, it continues to be one of the mechanisms attackers use to perform malicious activities across the globe. In this course participants will learn about various concepts associated with DNS, become familiar with DNS tools and mapping information, get introduced to common DNS tampering techniques, and gain an understanding of DNS mitigation strategies to enhance security.

Experience these benefits and more: 

• Practice in a realistic environment: Analyze network and host-based artifacts and implement remediation changes for the identified vulnerabilities.  

• Learn how to implement remediations: Course exercises include remediating vulnerabilities. 

• Identify and mitigate vulnerabilities in real time: Students will identify DNS infrastructure tampering techniques and mitigate them. 

• Expert facilitation and peer discussion: Throughout the course, expert cybersecurity engineers will moderate discussion and conduct a recovery debrief for the exercises. Participants are also encouraged to help one another and offer relevant input to address peers' questions.

This exercise is a step-by-step, facilitated experience that uses a keyboard approach to understand these topics in a realistic technical environment.

Approved registrants must attend a mandatory student technical check the day before the training to establish a connection to the course content and lab environment.  

The Cybersecurity and Infrastructure Security Agency (CISA) is proud to present the Introduction to Log Management (IR210) Cyber Range Training event. The 200-level training events are open to government employees and contractors across federal, state, local, tribal, and territorial government, educational partners, and critical infrastructure partners. Please use your organization email address when registering.

This course is ideal for those working in cybersecurity roles who are interested in learning technical incident response skills and requires active engagement from all participants. The course assumes a mixed audience (e.g., from disparate teams and organizations) of mixed capability.

Log files provide the data that are the bread and butter of incident response, enabling network analysts and incident responders to investigate and diagnose issues and suspicious activity from network perimeter to epicenter. Participants will be introduced to basic principles of log management and configuration. Federal compliance regulations of log configuration and management including OMB Memo M-21-31 will also be introduced.

Experience these benefits and more: 

• Common attack methods: Understand the importance of the configuration, management, and analysis of logs for incident response and identify key processes of log management. 

• Practice in a realistic environment: Investigate and analyze log data for suspicious activity. Detect and correlate possible IOCs or malicious activity with threat intel. Exercises include configuring a DNS server, network device firewall, an operating system and more for propper logging.  

• Expert facilitation and peer discussion: Throughout the course, expert cybersecurity engineers will moderate discussions and conduct a recovery debrief for the exercises. Participants are also encouraged to help one another and offer relevant input to address peers' questions.

This exercise is a step-by-step, facilitated experience that uses a keyboard approach to understand these topics in a realistic technical environment.

Approved registrants must attend a mandatory student technical check the day before the training to establish a connection to the course content and lab environment.

Colleges and universities have long been a valuable resource for small businesses in their communities. Examples of support and outreach include running start-up incubators and accelerators, hosting small business development centers, providing a source of interns and entry-level workforce members, hosting legal and medical clinics, and much more. Recently, higher education, with support from industry and government, has been addressing two critical questions in cybersecurity through an emerging network of cybersecurity clinics: 

• How can we bolster the cybersecurity posture of small, under-resourced organizations in our community?
• How can we build a stronger cybersecurity workforce by providing students with valuable, hands-on learning experiences?

Through the clinics, multidisciplinary teams of students work with faculty providing no-cost  cybersecurity services to the region’s small, under-resourced organizations—providing valuable workforce development experiences to students and important cybersecurity support to those organizations who need it the most. 

This webinar will provide an overview of cybersecurity clinics, while also highlighting experiences of students and small businesses who have participated in the program. The panel discussion will run for 45 minutes, with 15 minutes reserved at the end of the hour for questions. 

Opening Remarks: 

• Rodney Petersen, Director, National Initiative for Cybersecurity Education (NICE), NIST

Panelists: 

• Mehdi Abid, Cyber Program Coordinator, Department of Computer Science, University of Nevada, Las Vegas
• Aisha Ali-Gombe, Ph.D., Associate Professor and Director, LSU Cybersecurity Clinic, Louisiana State University
• Gary Anderson, Partner, Cardinal Capital, LLC
• Keith Daniel Tan, Scholarship for Service(SFS) Student, University of Nevada, Las Vegas

Moderator: 

• Daniel Eliot, Lead for Small Business Engagement, NIST