Course curriculum

    1. Read before you start

    1. Self-assessment

    2. Blocking a binary ... that's easy, right?

    3. Exercise: Blacklists vs WinMine.exe

    4. Exercise: Blacklisting through Application Policies

    5. Limits of blacklists usage: inefficiency and performance impact

    6. Exercise: Performance impacts of Application Policies

    7. Limits of blacklists usage: an endless task

    1. Baselining as a prerequisite to restrict unknown applications

    2. Using Application Policies to block WinMine.exe

    3. Resource: ANSSI AppLocker Recommendations

    4. Exercise: Software restriction through ApplicationPolicies

    5. Going from the WinMine use case to a production deployment

    6. [OPTIONAL] Getting further: Dealing with LOLBIN/LOLBAS exceptions

    7. Chapter reflection and next steps

    8. Quiz

    1. Self-assessment

    2. Limiting unecessary alerts and kills

    3. Baselining to remove benign postives and false positives

    4. Key considerations when creating a Global Policy Whitelist

    5. But wait, isn't that risky to whitelist this binary?

    6. Exercice: Global Policy whitelist best practices

    7. Chapter reflexion and next steps

    8. Quiz

    1. Self-assessment

    2. What to do when faced with a false negative?

    3. Exercise: Creating a blacklist with the global policy best pratices

    4. [OPTIONAL] Getting further: Dealing with greyware

    5. Chapter reflexion and next steps

    6. Quiz

    1. Self-assessment

    2. Healthchecks to ensure expected performance

    3. EDR appliance and agent performance

    4. Configuration maintainability

    5. Security hygiene

    6. Healthchecking the EDR

    7. Chapter reflexion and next steps

    8. Quiz

About this course

  • Free
  • 45 lessons
  • 0 hours of video content

Discover your potential, starting today

Enroll today