Automation of Security Tasks and Data Analytics

Key Details

Time commitment

• Total workload: 125 hours
• Contact hours:
• Synchronous Lectures: 12 hours
• Tutorial Sessions: 12 hours
• Directed e-Learning Activities: 24 hours
• Independent learning and work on project: 77 hours

Assessment

• Two proctored midterm assessments (20%)
• Take-home lab assignments (40%)
• Proctored Finals (40%)

Subjects covered

12-Week Program:

Week 1: Introduction to Python and Cybersecurity

• Classes: Focus Areas: Introduction to Python programming language, Overview of Python in cybersecurity, Basic programming concepts. o Level of Difficulty: Introductory

• Labs: Focus Areas: Setting up Python environment, Writing and running basic Python scripts using Jupyter Notebook and/or Anaconda. o Level of Difficulty: Introductory

Week 2: Automating Reconnaissance

• Classes: Focus Areas: Reconnaissance techniques in cybersecurity, Importance of reconnaissance in cyber threat intelligence, Tools and methods for reconnaissance.
Level of Difficulty: Introductory to Intermediate

• Labs: Focus Areas: Writing Python scripts to perform active scanning and search open technical databases using libraries for network interaction such as scapy and HTTP requests with requests.
Level of Difficulty: Introductory to Intermediate

Week 3: Threat Intelligence Fundamentals

• Classes: Focus Areas: Introduction to threat intelligence, Sources of threat intelligence, Types of threat intelligence (strategic, operational, tactical, technical). Level of Difficulty: Intermediate

• Labs: Focus Areas: Gathering threat intelligence using Python from OSINT feeds, social media, and forums using parsing tools such as BeautifulSoup and HTTP requests with requests o Level of Difficulty: Intermediate

Week 4: Data Analysis and Visualization for Threat Intelligence

• Classes: Focus Areas: Importance of data analysis in threat intelligence, Techniques for data cleaning, transformation, and visualization. Level of Difficulty: Intermediate

• Labs: Focus Areas: Using Python libraries such as Pandas for data manipulation and Matplotlib for visualization of threat intelligence data Level of Difficulty: Intermediate

Week 5: Automating Log Analysis and Monitoring

• Classes: o Focus Areas: Importance of log analysis in cybersecurity, Techniques for parsing and analyzing log files. o Level of Difficulty: Intermediate

• Labs: o Focus Areas: Writing Python scripts to automate log analysis and monitoring using logging libraries such as the built-in logging module and Loguru. Level of Difficulty: Intermediate

Week 6: Network Traffic Analysis

• Classes: Focus Areas: Introduction to network traffic analysis, Importance in threat intelligence, Tools and techniques for analyzing network traffic. Level of Difficulty: Intermediate to Advanced

• Labs: Focus Areas: Writing Python scripts to capture and analyze network traffic using libraries for network analysis such as scapy. Level of Difficulty: Intermediate to Advanced

Week 7: Incident Detection and Response Automation

• Classes: Focus Areas: Incident detection and response processes in threat intelligence, Automating detection of suspicious activities, Tools for incident response automation. Level of Difficulty: Intermediate to Advanced

• Labs: Focus Areas: Developing Python scripts to automate incident detection and response workflows using system monitoring libraries such as psutil for system resource monitoring and subprocess for executing system commands Level of Difficulty: Intermediate to Advanced

Week 8: Threat Hunting Automation

• Classes: Focus Areas: Introduction to threat hunting, Techniques and tools for threat hunting, Automating threat hunting tasks. o Level of Difficulty: Advanced

• Labs: Focus Areas: Writing Python scripts to automate threat hunting activities using threat intelligence data and query libraries such as elasticsearch . Level of Difficulty: Advanced

Week 9: Vulnerability Management and Exploitation

• Classes: Focus Areas: Common vulnerabilities and exploitation methods, Automating vulnerability assessments. o Level of Difficulty: Intermediate to Advanced

• Labs: Focus Areas: Conducting automated vulnerability assessments and exploiting vulnerabilities using Python and tools for vulnerability scanning and exploitation such as nmap and metasploit. o Level of Difficulty: Intermediate to Advanced

Week 10: Advanced Web Scraping for Threat Intelligence

• Classes: o Focus Areas: Advanced techniques for web scraping, Legal and ethical considerations in web scraping. Level of Difficulty: Intermediate to Advanced

• Labs: Focus Areas: Writing Python scripts for advanced web scraping and data extraction using web scraping tools such as Beautiful- Soup, Scrapy, and browser automation tools such as Selenium. Level of Difficulty: Intermediate to Advanced

Week 11: Automating AI Models for Threat Intelligence

• Classes: Focus Areas: Introduction to AI in cybersecurity, Using pre-trained AI models for threat intelligence, Methods for integrating AI into threat intelligence workflows. Level of Difficulty: Advanced

• Labs: Focus Areas: Writing Python scripts to forward data to free AI models (e.g., OpenAI, Hugging Face) and processing responses for threat intelligence. Level of Difficulty: Advanced

Week 12: Integrating and Automating Security Tools

• Classes: Focus Areas: Integration of various security tools, Building automated workflows, Best practices for automation in security. Level of Difficulty: Advanced

• Labs: Focus Areas: Creating and deploying integrated automation solutions for security tasks using Python and orchestration tools such as Docker and Ansible. oLevel of Difficulty: Advanced

Learning objectives

On successful completion of this module the learner will
be able to:

LO1: Utilize Python to implement advanced cybersecurity
tasks, including configuring environments, writing scripts
for network scanning, log analysis, vulnerability assess-
ment, and ensuring secure coding practices..

LO2: Design and implement automated processes for
threat detection, threat intelligence gathering, and incident response using Python, integrating various cybersecurity tools.

LO3: Manipulate, analyze, and visualize data
related to cybersecurity, enhancing threat intelligence
through data analysis.

LO4: Apply ethical and legal standards in the automation
of cybersecurity tasks, including web scraping and threat
intelligence gathering.

LO5: Independently create and refine automated solutions
for cybersecurity challenges and communicate the im-
portance and impact of automation in cybersecurity.

Module leaders

Name: Marija Buric