Our teams in the Vertical Specialization Trainings to be held by the Turkish Cyber Security Cluster;
SOC Team (Cyber Security Operations Center)
It is sufficient for the participants in the SOC team to have basic cyber security knowledge. It will be useful for them to know how network traffic works, the basic types of attacks, and how protection mechanisms such as firewalls work. Since they need to learn log analysis and event investigation processes, knowing how to use a basic SIEM tool makes their job easier. It is important to be able to perform simple log analysis on Windows and Linux systems and detect malicious activities using threat intelligence sources. Additionally, understanding the workflow in the SOC environment and how incidents are responded to will enable them to apply the training they receive in the field.
Cloud Computing Security Team
It is sufficient for the participants in this team to first understand how cloud computing works and basic security principles. It will be useful to know the basic services of popular cloud providers such as AWS, Azure or Google Cloud. It is important for them to learn how data is stored in the cloud, encryption methods, and secure access control mechanisms. Familiarity with identity and access management (IAM) is essential so that they can manage who can access the systems. Additionally, learning how to detect and fix security threats and basic vulnerabilities in the cloud environment will help them make their cloud systems more secure.
IoT Team
Participants in the IoT team first need to understand how IoT devices work and why these devices pose security risks. It is important that they have basic network knowledge and know how IoT devices connect to the network and exchange data. It will be useful for them to recognize common IoT security threats (such as weak passwords, open ports, unupdated firmware) and learn basic methods to reduce these risks. Additionally, understanding security solutions such as remote access and authentication will help them manage devices securely.
SCADA Team
Participants in the SCADA team simply need to understand how industrial control systems (ICS) work and why they are vulnerable to cyber attacks. It is important for them to know that SCADA systems are generally used in critical infrastructures such as energy, water and transportation. It will be useful for them to have basic network knowledge and to be familiar with SCADA protocols (Modbus, DNP3, etc.). Knowing the common security risks in these systems (lack of network isolation, weak authentication, outdated software) and learning basic security measures (firewalls, network segmentation, monitoring systems) will help them ensure the security of the infrastructures.
Reverse Engineering Team
It is sufficient for the participants in this team to first understand how software and hardware work at a basic level. It will be beneficial for them to have basic programming knowledge (to be able to read simple codes in languages such as C and Python) and to understand assembly language logic. In order to perform malware analysis, it is important that they know basic static and dynamic analysis methods and learn to use tools such as disassembler (Ghidra, IDA Free) and debugger (x64dbg, OllyDbg). In addition, they are expected to analyze vulnerabilities in software using simple reverse engineering techniques and work to improve basic security measures.
Red Team (Attack Team)
It is sufficient for the participants in the Red Team team to understand basic cyber attack methods and defense mechanisms. It is important for them to understand the logic of penetration tests, recognize basic types of vulnerabilities (weak passwords, open ports, misconfigurations) and learn how to exploit them. It will be beneficial for them to be able to use simple network discovery and vulnerability scanning tools (such as Nmap, Burp Suite, Metasploit) and to have basic knowledge about social engineering attacks. In addition, it is expected to report vulnerabilities and provide improvement suggestions by observing how security teams respond after attack simulations.
Linux Hardening Kit
It is sufficient for the participants in this team to have a basic knowledge of the Linux operating system. It is important that they know terminal commands and are familiar with issues such as file permissions and user management. It will be useful for them to learn how to use a firewall (iptables, ufw), examine system logs, and basic security configurations (SSH certificate usage, sudo configuration, security mechanisms such as SELinux/AppArmor). They are also expected to be able to scan for vulnerabilities in the system, shut down unnecessary services, and implement basic hardening measures.
Linux Kernel Development Team
It is sufficient for the participants in this team to have a basic level of familiarity with the Linux operating system and kernel structure. It will be useful to understand Linux system calls (syscalls) and how kernel modules work. It is important that they master the C programming language at an entry level and learn basic system programming topics. They are expected to know how to detect security vulnerabilities by examining kernel logs and to be familiar with kernel security mechanisms such as SELinux and AppArmor. It will also be helpful for them to learn how basic security patches are developed and applied.
Mobile Application Security Team
It is sufficient for the participants in this team to understand at a basic level how Android and iOS applications work. It is important for them to know about common security threats in mobile applications (weak encryption, insecure data storage, use of uncertified API). It will be useful for them to learn how to analyze an APK file with simple reverse engineering methods, capture mobile application traffic (Burp Suite, MITM Proxy) and perform basic security tests. Additionally, their familiarity with secure authentication mechanisms (OAuth, JWT) and data encryption methods will contribute to making mobile applications more secure.
Gallery
