📘 Summary: Cyber Security Operations
(IS 504 A)
Prerequisites
Before starting, students should know:
PC & Internet navigation skills
Basics of Windows & Linux systems
Fundamentals of computer networks
Binary and hexadecimal number systems
Course Outcomes (What You’ll Learn)
By the end of this course, students will be able to:
✅ Explain the role of a Cybersecurity Operations Analyst in protecting enterprises.
✅ Understand how network protocols, services, and infrastructure operate.
✅ Classify and detect network attacks.
✅ Use monitoring tools to identify and analyze attacks.
✅ Evaluate and respond to security alerts.
✅ Investigate network intrusion data to detect compromised systems.
UNIT-WISE SUMMARY
UNIT I – Cybersecurity Foundations
Cybersecurity Incidents: Real-world security breaches and their impact.
Threat Actors: Hackers, insiders, nation-states, cybercriminal groups.
Network Security Attacks: Malware, phishing, DoS/DDoS, ransomware.
Security Operations Center (SOC): Role, team functions, incident response.
OS Security: Windows & Linux security features.
Linux File System & Permissions: Access control, ownership, security models.
UNIT II – Network Security Infrastructure
Network Topologies: Bus, star, ring, mesh, hybrid.
Security Devices: Firewalls, IDS/IPS, routers, VPNs.
Security Services: Confidentiality, Integrity, Availability (CIA Triad).
Network Attacks & Tools: Sniffers, scanners, exploit kits, botnets.
Network Monitoring & Tools: Wireshark, Snort, Splunk, Nagios.
UNIT III – TCP/IP Vulnerabilities & Defense
TCP/IP Protocol Weaknesses: IP spoofing, SYN floods, session hijacking.
Service Vulnerabilities: DNS attacks, HTTP/HTTPS threats, SMTP attacks.
Defense-in-Depth: Layered security approach.
Policies & Standards: ISO 27001, GDPR, NIST, regulations for compliance.
UNIT IV – Network & Endpoint Protection
Access Control Concepts: Identification, Authentication, Authorization, Accounting
(AAA).
Threat Intelligence: Data sources (feeds, OSINT, vendor reports).
Endpoint Security:
o Anti-malware software
o Host-based Intrusion Prevention Systems (HIPS)
o Application security controls
UNIT V – Security Analysis & Incident Response
Vulnerability Assessment: Endpoint, network, server scanning.
Profiling & Scoring: Common Vulnerability Scoring System (CVSS).
Information Security Management Systems (ISMS).
Analyzing Network Data: Identifying anomalies and intrusions.
Alert Evaluation: Prioritizing and responding to alerts.
Cyber Attack Models:
o Cyber Kill Chain (attack stages)
o Diamond Model (adversary, infrastructure, victim, capability)
Learning Path for Students
1. Basics of Cybersecurity → 2. Network & Threat Landscape →
2. TCP/IP Vulnerabilities & Defense → 4. Endpoint & Threat Intelligence →
3. Incident Response & Intrusion Analysis
Key References (Recommended Books)
1. Cybersecurity Operations Companion Guide – Cisco Press (2018)
2. Cybersecurity Operations Handbook – Bill Hancock et al., Elsevier
3. Security Operations Center: Building, Operating, and Maintaining Your SOC – Cisco
Press
✅ This subject prepares students to work in SOC teams, understand attacks & defenses,
and build practical skills for monitoring, detection, and incident response.
Here’s the visual roadmap (flowchart) for Cyber Security Operations (IS 504 A).
It shows the progression:
🔐 Cybersecurity Basics → 🌐 Network Security → ⚡ TCP/IP Defense → 🛡️ Access Control
& Threat Intelligence → 🖥️ Endpoint Protection → 🚨 Vulnerability Assessment & Intrusion
Models.
