First-line Incident
Response training
for general ITspecialists
Free trial
cito.kaspersky.com

Cybersecurity
for IT Online

Cybersecurity for IT Online (CITO)
Interactive training that builds strong cybersecurity and first-level incident
response skills for general IT specialists
Creating a strong corporate cybersecurity posture is impossible
without the systematic education of all relevant employees.
Most enterprises provide cybersecurity education and training
on two levels – expert training for IT security teams and security
awareness for non-IT employees. Kaspersky offers a comprehensiveset of products for both. But what’s missing? For IT teams, service
desks, and other technically advanced staff, standard awarenessprograms are not enough. However, they don’t need to become
cybersecurity experts – it’s too expensive and too time-consuming.
Training format
Training is completely online. Trainees only
need Internet access and the Chromebrowser on their PC. Each of 6 modules
consists of a short theoretical overview,
practical tips and between 4 and 10
exercises covering specific skills teaching
students how to use IT security tools andsoftware in everyday work.
Study is intended to be spread over thecourse of a year. The recommended rate ofprogress is 1 exercise per week – each
exercise takes between 5 and 45 minutes tocomplete.
The current edition of the training istargeted at the Windows corporate
environment.

First-line incident response
Kaspersky is launching first-on-the-market online skills training for generalist enterprise
IT professionals. It consists of 6 modules*:
••
•
•
•
•

Malicious software
Potentially unwanted programs and files
Investigation basics
Phishing incident response
Server security
Active Directory Security

The program equips IT professionals with practical skills to recognize a possible attack
scenario in a seemingly benign incident, and how to collect incident data for handover toIT security. It also creates a passion for hunting out signs of malicious activity, cementing
the role of all IT team members as the first line of security defense.

Why is CITO training effective?
••••

Interactive: the stimulation of real processes without any risk to the computer
Creates skills as well as knowledge: learning by doing
Intuitive learning process: convenient navigation and hints
Covers all the main IT security topics and problems that general IT staff face in theirwork

Learning process
Training delivery method:
Cloud or SCORM format

Each learning exercise block consists of two parts: education and practice, with tasks
simulating real processes related to previous explanations.

* for the latest list of topics please checkcito.kaspersky.com

1When you’ve finished working through thelesson, please complete the task

If you did well, you will be directed to the next
exercise block and if you didn’t do too well,
you can use the hints or re-read the lesson
material to refresh your knowledge

Who is this training for?
Certificates
Personal certificates are available for
employees after the completion of eachmoduleThis training is recommended for all IT specialists within the organization, especially
service desks and system administrators. But most non-expert IT security teammembers will benefit from this course too.
Now
Aaah!
Somethingwent wrong

It seems weare safe

RebootThis certificate of successful
completion of the module
Ma li ci ous Sof twa reconfirms thatUser

Mr Michael Andrews
Learned basic skills tocollect data to analyze a security incident

IT Security

IT Support/AdminsShouldShouldbe
beAaah!
Somethingwent wrong

24 November 2021

We are reallysafe now!

Let’s check…

IT Support/Admins

User

IT Security

Training topics and outcomes
Modulename

Targetaudience

Knowledge
gainedPersonal
attitude

SkillsgainedPractice givenin module

Malicious
SoftwareUsers withadministrated rights
on servers and/or
workstations

Malwaretechniques andclassification

Malware can exist
anywhere on thecomputerMalicious andsuspicious
software actions
and signs

Malware can steal data in
multiple non-trivial ways

Verification of theexistence orabsence of a
malware-related
incident

Using ProcessHacker,
Autoruns, Fiddler,
Gmer tools for
detecting malware

Heuristic analysis
basics

It is mandatory to report
all suspicious potential
incidents to the security
team2

Modulename

Targetaudience

Knowledge
gainedPersonal
attitude

SkillsgainedPractice given
in module

Potentiallyunwantedprograms andfiles (PuPs)

Users with the rights
to install additional
software, and users
who actively evaluate/
open files received
from the outside

The basics ofstatistical anddynamic analysis ofsoftware samples
and suspicious
documents

Documents (pdf, docx)
can contain exploits

Working withsystem andsandbox event
monitors

Static (signature) andstatistical (virustotal)
analysis of thesoftware samples

Using statisticalengines

Using procmon, tosearch for exploits
and malicious
behavior of software

Unsigned files can containmalware or riskware
All unsigned executables
should be checked forpossible infection

Removing PuPs

File analysis with
Cuckoo sandbox

A digital signature does
not guarantee that the filedoesn’t contain malicious
functionalityInvestigation
basicsIT employees involvedin the forensic orincident response
activities led by thesecurity teamThe Incident
Response process
Methods of log
analysis
Specifics of storing
digital information

Creating scripts formalware removalusing AVZ

If you suspect acybersecurity incident,
immediately report it to
the security team andcollect digital evidenceCollecting digital
evidence

Analysis should be done
under the supervision ofand in co-operation withthe security teamTimeline analysis

NetFlow traffic
analysis

Event log analysis

Collecting volatileand non-volatile data(FTK-imager)
Log analysis to findthe source and thelinks of the attack(eventlogexplorer)
Lateral movement
investigation by
NetFlow analysis(ntop)
Disk analysis using
Autopsy

Phishing andOpen source
intelligence(OSINT)

Server security

IT employees involvedin forensic or incident
response activities

Server administrators

Modern phishingmethods
Methods ofanalysis for email
headers

Analyze thenetwork
environment
Server hardening
Analyze PowerShelllogs to detectattacks

Active Directory
Security

Active Directoryadministrators

Use an API to checkpasswords in a
database ofcompromisedpasswords
Configure domain
policies according
torecommendations
Methods foranalyzing Active
Directory domain
security

Phishing can be very
sophisticated, making it
hard to discover, but it canalways be detected bymanual investigation
Phishing emails need to bedeleted from user’
mailboxes

Phishing email
analysis anddeleting
obfuscatedphishing emails
from users’
mailboxes

Search and removalof the phishing emails
in Exchange Mailbox
Using Recon-ng forweb reconnaissanceOpen source
intelligence forunderstanding
what hackers know
about yourcompany

Network perimetercompromise is one of themajor attack vectors. It’s
impossible to close allvulnerabilities - you needto reduce the attack
surface to make it as hard
as possible for an attack
to succeed. Even if it
doesn’t stop an intruder, it
will buy you time fordetection.

Search forvulnerable andnon-standard
network services

Search for signs ofan attack inPowerShell logs

Analyze events using
Event Log Explorer

Default Active Directory
configuration is not
optimal from security
point of view.

Safely check forpassword hashes
in a database

Use the Have I Been
Pwned? API to search
the database ofcompromised
passwords

Attacker can elevate theirprivileges in many ways.
Study security
recommendations, usetools which provide better
visibility for Active
Directory

Configure systems
according to the‘default deny’principle

Search forinconsistencies
betweenrecommended andactual domain
policies
Assess the
security of Active
Directory settings

Use Nmap to findvulnerable network
services
Configure Software
Restriction Policies
for program control
and Windows Firewall
for network control

Use Policy Analyzer tocompare current
domain policies withbest practices
Use Ping Castle
reports3Integration with Kaspersky Endpoint
Security Cloud
Boost your cybersecurity skills and get the most out of specialized cybersecurity
products with CITO training, available for KES Cloud Pro users directly from theBusiness Hub.

Kaspersky Security Awareness –a new approach to mastering
IT security skills
Key program differentiators

One flexible training solution for all
Kaspersky Security Awareness has a longstanding international track record of success.
Used by businesses of every size to train over a million employees across more than
75 countries, it brings together over 25 years of Kaspersky’s cybersecurity expertisewith extensive experience in adult education.

Substantial cybersecurity expertise25+ years’ experience in cybersecurity
transformed into a cybersafety skillset thatlies at the heart of our products

The portfolio offers a range of engaging training options that increase thecybersecurity awareness of your employees at every level, empowering them to playtheir part in the overall cybersecurity of your organization.
Because sustainable changes in behavior take time, our approach involves building acontinuous learning cycle with multiple components. Game-based learning engages
senior management, turning them into advocates of cybersecurity initiatives andsupporters of building a culture of cybersafe behavior. Gamified assessment helps todefine gaps in employee knowledge and motivate them for further learning, while online
platforms and simulations equip them with the right skills, reinforced.
С-Level ExecutivesAs G
se am
ssmCu
hyg rrenien t ueas

gementEngali ns k illsetarng&ent

in geofcde ybersec
fe nu ri t yseCybfor ersec
IT O uritynlineGeneralist
ITR e i n f o rc e mPraneninac ti cyblceds P Se
lat curfo ityrmli z

op

1sLe

ygie

ci adrharLeSpehrk swotive velInterac r C-lefos
ive
cut
ExevelС-Leg
inin
trativeExecu

300+
cybersecurity
skillstema nesot
Au wareAAll Employees

Ssim trate
ula gtiam eteic gam
onled ooifi nt Te

KaPro spete rsk
ct yionetivac tionrte la
In imuSeryb ntr c mese esss

Our gamified training provides engagement
and motivation through edutainment, while
the learning platforms help to internalize thecybersecurity skillset to ensure that learnt
skills don’t get lost along the way.

All E
mp
loyeesTraining that changes employees’
behavior at every level of yourorganization

www.kaspersky.com

2023 AO KASPERSKY LAB. REGISTERED TRADEMARKS AND SERVICE MARKS ARE THE PROPERTY OF THEIR RESPECTIVE OWNERS.

Enterprise Cybersecurity: www.kaspersky.com/enterprise
Kaspersky Security Awareness: www.kaspersky.com/awarenessKaspersky Cybersecurity for IT Online: cito.kaspersky.com