Automation of Security Tasks and Data Analytics

Key Details

This course provides a comprehensive introduction to using Python for automating cybersecurity tasks, including threat detection, intelligence gathering, vulnerability assessment, and incident response. Students will learn to write scripts, analyze data and integrate various tools, while adhering to ethical and legal guidelines in cybersecurity automation.

Time commitment

(Estimated) Total workload: 125 hours

The module is designed to fit around professional and personal commitments. All core content is available asynchronously for self-paced study, complemented by optional live sessions offered throughout the module.

Assessment

Two proctored midterm assessments

• take home lab (20%)
• assignments (40%)
• Proctored Finals (40%)

Subjects covered

12-Week Program: Automation of Security Tasks Week

1: Introduction to Python and Cybersecurity

• Classes: Focus Areas: Introduction to Python programming language, Overview of Python in cybersecurity, Basic programming concepts
• Level of Difficulty: Introductory
• Labs: Focus Areas: Setting up Python environment, Writing and running basic Python scripts using Jupyter Notebook and/or Anaconda.
• Level of Difficulty: Introductory

Week 2: Automating Reconnaissance

• Classes: Focus Areas: Reconnaissance techniques in cybersecurity, Importance of reconnaissance in cyber threat intelligence, Tools and methods for reconnaissance.
• Level of Difficulty: Introductory to Intermediate
• Labs: Focus Areas: Writing Python scripts to perform active scanning and search open technical databases using libraries for network interaction such as scapy and HTTP requests with request
• Level of Difficulty: Introductory to Intermediate

Week 3: Threat Intelligence Fundamentals

• Classes: Focus Areas: Introduction to threat intelligence, Sources of threat intelligence, Types of threat intelligence (strategic, operational, tactical, technical).
• Level of Difficulty: Intermediate
• Labs: Focus Areas: Gathering threat intelligence using Python from OSINT feeds, social media, and forums using parsing tools such as BeautifulSoup and HTTP requests with requests o Level of Difficulty: Intermediate

Week 4: Data Analysis and Visualization for Threat Intelligence

• Classes: Focus Areas: Importance of data analysis in threat intelligence, Techniques for data cleaning, transformation, and visualization. Level of Difficulty: Intermediate
• Labs: Focus Areas: Using Python libraries such as Pandas for data manipulation and Matplotlib for visualization of threat intelligence data Level of Difficulty: Intermediate

Week 5: Automating Log Analysis and Monitoring

• Classes: o Focus Areas: Importance of log analysis in cybersecurity, Techniques for parsing and analyzing log files. o Level of Difficulty: Intermediate
• Labs: o Focus Areas: Writing Python scripts to automate log analysis and monitoring using logging libraries such as the built-in logging module and Loguru. Level of Difficulty: Intermediate

Week 6: Network Traffic Analysis

• Classes: Focus Areas: Introduction to network traffic analysis, Importance in threat intelligence, Tools and techniques for analyzing network traffic. Level of Difficulty: Intermediate to Advanced
• Labs: Focus Areas: Writing Python scripts to capture and analyze network traffic using libraries for network analysis such as scapy. Level of Difficulty: Intermediate to Advanced

Week 7: Incident Detection and Response Automation

• Classes: Focus Areas: Incident detection and response processes in threat intelligence, Automating detection of suspicious activities, Tools for incident response automation. Level of Difficulty: Intermediate to Advanced
• Labs: Focus Areas: Developing Python scripts to automate incident detection and response workflows using system monitoring libraries such as psutil for system resource monitoring and subprocess for executing system commands Level of Difficulty: Intermediate to Advanced

Week 8: Threat Hunting Automation

• Classes: Focus Areas: Introduction to threat hunting, Techniques and tools for threat hunting, Automating threat hunting tasks. o Level of Difficulty: Advanced
• Labs: Focus Areas: Writing Python scripts to automate threat hunting activities using threat intelligence data and query libraries such as elasticsearch . Level of Difficulty: Advanced

Week
9: Vulnerability Management and Exploitation

• Classes: Focus Areas: Common vulnerabilities and exploitation methods, Automating vulnerability assessments. o Level of Difficulty: Intermediate to Advanced
• Labs: Focus Areas: Conducting automated vulnerability assessments and exploiting vulnerabilities using Python and tools for vulnerability scanning and exploitation such as nmap and metasploit. o Level of Difficulty: Intermediate to Advanced

Week 10: Advanced Web Scraping for Threat Intelligence

• Classes: o Focus Areas: Advanced techniques for web scraping, Legal and ethical considerations in web scraping. Level of Difficulty: Intermediate to Advanced
• Labs: Focus Areas: Writing Python scripts for advanced web scraping and data extraction using web scraping tools such as Beautiful- Soup, Scrapy, and browser automation tools such as Selenium. Level of Difficulty: Intermediate to Advanced

Week 11: Automating AI Models for Threat Intelligence

• Classes: Focus Areas: Introduction to AI in cybersecurity, Using pre-trained AI models for threat intelligence, Methods for integrating AI into threat intelligence workflows. Level of Difficulty: Advanced
• Labs: Focus Areas: Writing Python scripts to forward data to free AI models (e.g., OpenAI, Hugging Face) and processing responses for threat intelligence. Level of Difficulty: Advanced

Week 12: Integrating and Automating Security Tools

• Classes: Focus Areas: Integration of various security tools, Building automated workflows, Best practices for automation in security. Level of Difficulty: Advanced
• Labs: Focus Areas: Creating and deploying integrated automation solutions for security tasks using Python and orchestration tools such as Docker and Ansible. oLevel of Difficulty: Advanced

Learning objectives

On successful completion of this module the learner will be able to:

LO1: Utilize Python to implement advanced cybersecurity tasks, including configuring environments, writing scripts for network scanning, log analysis, vulnerability assessment, and ensuring secure coding practices.

LO2: Design and implement automated processes for threat detection, threat intelligence gathering, and incident response using Python, integrating various cybersecurity tools.

LO3: Use Python to manipulate, analyze, and visualize data related to cybersecurity, enhancing threat intelligence through data analysis.

LO4: Apply ethical and legal standards in the automation of cybersecurity tasks, including web scraping and threat intelligence gathering, ensuring compliance with industry regulations and ethical principles.

LO5: Independently create and refine automated solutions for cybersecurity challenges and communicate the importance and impact of automation in cybersecurity.

Module leaders

Name: Marija Buric