Soc Specialist Path
Specialists in Cyber Defense:
Trained by experts

Access a practical path to becoming an internationally recognized SOC Specialist.

Obtain Official Certification and
Increase Your Market Value

The Certified Professional SOC Specialist (CPSS)* adheres to international standards and is recognised worldwide.

Fata Informatica is a Personnel Certification Body accredited under international ISO 17024:2012 standard.

02250

University
professors
24/7 access to the course
Tests and assessment exercises
Downloadable material
Final examination and certification

Our courses have been integrated by E-Campus University!

Our courses have been assimilated into the prestigious Computer Engineering degree programme at e-Campus University. Not only will you access cutting-edge content delivered by distinguished lecturers, but you can also earn up to 30 academic credits !

SOC Specialist Path

Our Soc Specialist Path is designed to offer a tailored learning experience with a modular and flexible approach, designed to adapt to your needs and pace. Thanks to the structure of our courses, you can start with the Basic Course to build a solid foundation, and continue with the Advanced Course to acquire advanced skills in the field of cybersecurity and obtain the most prestigious certifications.

CPSS certification is issued only if the requirements of the standard are met and after passing an official exam.

If the requirements are not met, it will be possible to take the exam to obtain CTSS certification (non-accredited certification).

Why participate in our cybersecurity courses?

From Zero to Expert quickly and easily

Start with the basic course to learn the fundamentals of security operations management and progress to the advanced course, where you will acquire in-depth threat hunting techniques and advanced monitoring skills, including on mobile devices.

Realistic Simulation Laboratories

You will have access to sophisticated simulation labs designed to replicate complex cybersecurity scenarios. This controlled environment is ideal for experimenting and honing your skills without the risks of the real world.

Acquiring the Secrets of Incident Monitoring and Response

You will learn the correct methods for monitoring networks and responding to security incidents, a critical skill for preventing and mitigating threats. This skill is essential for maintaining the integrity and security of your IT infrastructure.

You will receive constant support from the teacher

Our instructor Andrea Tassotti will guide you through the platform and answer all your questions.

Unlimited Access to Content and Resources

Study without time constraints with content accessible online 24/7, allowing you to organize your studies around your other commitments. You will have all the material you need to prepare for the final exam, ensuring flexible training at your own pace.

You will obtain prestigious certifications

This path will lead you to obtain the Certified Associate SOC Specialist and Certified Professional SOC Specialist (*) certifications, which are internationally recognized and will increase your career opportunities.

(*) To obtain this certification, you must meet the prerequisites, which can be found on the website certificazioni.fatainformatica.it.

Teaching approach

The course integrates theory and practice, offering hands-on experience with cybersecurity tools and real-world case studies. Students learn how to detect, analyse and mitigate cyber threats, fully understanding their scope and potential impact on organisations.

The Teachers

Andrea Tassotti is an Ethical Hacker and System Engineer with over 30 years of experience. He works for leading clients such as the Presidency of the Council of Ministers, the Ministry of Foreign Affairs and agencies belonging to the Ministry of Defence on projects of national strategic interest.

Antonio Capobianco, CEO of Fata Informatica, parent company of the CybersecurityUP brand and leader for over 30 years in the field of IT security.
He has an extensive background in academia, spanning Italy’s most elite institutions and currently lectures in Ethical Hacking and Malware Analysis at e-Campus University.
He is the author of the podcast ‘Cybersecurity & Cybercrime’.

The Company

We were founded in 1994 with the aim of providing IT security services to Italian companies and public administrations.
We are the only Italian company to have been included by Gartner in its ‘Marketing Guide for IT monitoring tools’ thanks to our Sentinet3 product, developed in 2004 and now recognised as the leader in the Italian market.
We have created a business unit specialising in cybersecurity services, called CybersecurityUP, with the aim of providing vertical cybersecurity services to our customers, primarily the defence sector and companies of national strategic interest.

Course details

BASIC course

Course objectives

The Security Operation Center (SOC) is the hub of corporate IT operations, with the goal of ensuring infrastructure security through the definition of internal security and incident response actions against current or potential attacks. This course aims to develop specific technical skills to operate independently in a SOC. SOC specialists are in high demand on the market, with a significant shortage of available skills. The course covers TCP/IP networks, firewall configuration, IDS/IPS, SIEM, Packet Analyzer, and includes lessons on the basics of IT security such as Kill Chain, Malware, typical attacks, Social Engineering, etc.

Course Programme

1. Introduction to Cybersecurity

Programme Details

Cyber Security
1. What is a Cyber Attack
2. Incident Response process
3. CIA Triad
4. Types of Hacker
5. Cyber Theft Ring
6. How much our personal dat is worth on the Dark Web
7. Main actors
8. Main attacks
9. Techniques used
10. Preferred vectors

The Kill Chain
1. Phases
2. Targeting
3. Reconnaissance
4. Weaponization
5. Delivery
6. Exploitation
7. Installation
8. Command & Control
9. Example of an attack: Action
10. Attack on the target

2. Networks

Programme Details

TCP/IP protocols
1. Packets
  1. ISO/OSI models
  2. TCP/IP models
  3. Levels
  4. Encapsulation
2. Headers
  1. TCP
  2. IP
  3. Ethernet
3. Internet Protocol
  1. Addresses
  2. Classful Network
  3. Netmasks
  4. IPv6
4. IP routing
  1. Routing tables
  2. Autonomous system
  3. Routing protocols
    1. IGP protocols
    2. EGP protocols
  4. Distance Vector
  5. RIP
  6. Link State
  7. Path vector
5. Data Link level
  1. MAC Addresses
  2. MAC Table
  3. Switches
  4. ARP protocol
6. TCP and UDP
  1. Ports
  2. Headers
  3. Netstat commands
  4. Three way handshake
7. DNS
  1. Structure
  2. Resolution
8. DHCP protocol
  1. Phase
  2. DHCP discover
  3. DHCP offer
  4. DHCP request
  5. DHCP hack
  6. renewal
9. Other protocols
  1. SNMP
  2. ICMP
  3. FTP
  4. SMTP
  5. IMAP
  6. POP3
WEB Applications

HTTP protocol
HTTP request
HTTP response
HTTPs
Cookies
HTTP sessions

The systems to protect the network
1. Proxy
2. Firewalls
3. Honeypots
4. VPNs
5. IDS/IPS systems
6. DLP systems

3. Attacks and Vulnerabilities

Programme Details

Web Application Vulnerabilities
1. What is OWASP
2. How a web application is composed
3. The OWASP Top Ten
  1. Injection
  2. Broken Authentication
  3. Sensitive Data Exposure
  4. XML External Entities (XXE)
  5. Broken Access Control
  6. Security Misconfiguration
  7. Cross-Site Scripting (XSS)
  8. Insecure Deserialization
  9. Using Components with Known Vulnerabilities
  10. Insufficient Logging and Monitoring
The Attacks
1. What is a Zero-day
  1. DoS, DDoS and DRDoS
    1. Smurf
    2. Xmas Scan Attack
  2. Man-in-the-Middle
  3. Man-in-the-Browser
  4. Buffer Overflow
  5. Privilege Escalation
  6. ARP Poisoning
  7. DNS Poisoning
  8. Domain Hijacking
  9. Clickjacking
  10. Session Hijacking
  11. Spoofing
    1. MAC
    2. Email
    3. Phone
  12. Downgrade Attack
  13. Wi-Fi Attacks
    1. Wi-Fi Protocols
    2. Replay Attack
    3. Rogue AP
    4. Evil Twin
    5. WPS Attacks
  14. Bluetooth Attacks
    1. Bluejacking
    2. Bluesnarfing
    3. Bluebugging
  15. Cryptographic Attacks
  16. Hash Functions
  17. Pass the Hash
  18. Password Attacks
    1. Rainbow Tables
    2. Salt
    3. Dictionary Attacks
    4. Hybrid Attacks
    5. Online Attacks
    6. Brute Force
    7. Birthday Attack
Social Engineering

4. Malware

The PE Format
DLLs
Kernel Mode vs User Mode
Protection Rings
APIs
Switching from User Mode to Kernel Mode
How infection occurs
Signatures
Obfuscation & Mutation
Polymorphic Malware
Metamorphic Malware
Mutation Engines
Persistence
1. System Registry
2. DLL Hijacking
3. DLL Load Order Hijacking
4. Trojanized System Binaries
Types of Malware
1. Viruses
2. Backdoors
3. Adware
4. Spyware
5. Keyloggers
6. Trojans
7. RATs
8. Cryptojacking
Rootkits
1. User mode
2. Kernel mode
3. IAT Hooking
4. Bootkits
Hybrid Malware
1. Conficker
Ransomware
1. Stages of a Ransomware Attack
2. WannaCry
3. How to react
Macro Viruses
Scareware
Fileless Malware
Exploit Kits
1. Angler
2. Zeus Builder
Crime as a Service
1. Grand Crab

4. The SOC Specialist

Programme Details

The SOC Specialist

The Role and Responsibilities
Preparation and Experience

5. IncidentResponse process

Programme Details

Preparation
Detection & Analysis
Containment
Eradication
Recovery
Post-Incident Activities

6. Network Diagnostics

Programme Details

Tools for different ISO/OSI layers

ARP scanning
ICMP scanning
Traceroute/tracepath
Port probing
Netcat
Nslookup/dig
Curl/wget

Automatic detection of network objects and services
1. Nmap
2. Sweeping

7. The Packet Inspection

Programme Details

Introduction
Use case
Tcpdump
Tshark
Introduction to Wireshark
1. Filters utilization

8. The firewall opensource

Programme Details

Linux Netfilter/Iptables
1. Architecture
2. Defense Model
3. Rules
4. Administration
5. Old School
6. firewalld
7. ufw and other interfaces
BSD pf
1. Architecture
2. Defense Model
3. Rules
4. Administration

9. Commercial firewalls and endpoint-protection

Dettagli Programma

Check Point Firewall
1. Architettura
2. Modello di difesa
3. WebUI e Clish
4. Smart console
5. Gestione politiche di sicurezza

10. Gli IDS/IPS

Programme Details

Snort
1. Introduction
2. Getting Started
3. The Detection Engine and Rules
4. Snort in pfSense
5. Rule Management
6. Alert and Log Management
7. Tcpdump in pfSense

11. SIEMs

Programme Details

IBM QRadar
1. Introduction
2. Architecture
3. Event and Flow Collection
4. Alert Management
5. Rule Construction
6. Use Case

Final certification

ADVANCED Course

Course objectives

The course trains personnel specialized in hunting cyber threats on a local network, identifying their presence and actions, thus enabling SOC specialists to evolve in their profession. This allows for more effective defense against current threats and prevention of future ones, thanks to an understanding of their behavior. The course develops skills in packet analysis techniques, tools, and procedures for hunting threats on TCP/IP networks. Investigation techniques will be introduced at different levels of the ISO/OSI stack to counter threats in all forms. The course culminates with an analysis of the network behavior of current real threats (malware).

Course Programme

Module 1: Threat research

Programme Details

Introduction
What is Threat Hunting
Type of Strategy
Tools
Objectives
Threat Hunting within the Incident Response process
Threat Hunting and the Risk Management process
The Phases of the Hunt
Threat Intelligence and Forensic Analysis
The Boundaries of the Hunt
Intelligence Information: IoC

Module 2: Models and methods

Programme Details

Reference Models
Pyramid of Pain
The Kill Chain and Countermeasures
The Diamond Model
How to Explore the Hunting Ground
From Hypothesis to Report: The Hunting Process
The Structure of a Report

Module 3: Network hunting

Programme Details

From Intelligence to Infrastructure
The Role of the Hunter
The Origin of the Hunt: Anomalous Traffic
Packet Inspection
1. Live or Recorded
2. Defense Strategies and Plans
3. Defense Tools
4. Investigation Points
5. Ways to Intercept Network Traffic: Insertion Points
Tools for Packet Inspection
Libpcap and Derived Tools
1. Tcpdump
2. TShark
An Agile Tool: Wireshark
1. Using Filters
2. User and Host Identification
3. Exporting Pcap Streams

Module 4: Threat Hunting across the ISO/OSI Stack

Programme Details

Detection of Attacks at the Physical Layer
1. Anatomy of the ARP Protocol
2. Exploitation of the ARP Protocol
3. ARP Pinging
4. ARP and Vendors
5. Security Criteria and New Approaches
6. Normal and Anomalous Traffic
Detection of Attacks at the IP Layer
1. Anatomy of the ICMP Protocol
2. Exploitation of the ICMP Protocol
3. Ping Sweep
4. Malicious ICMP: Data Exfiltration
5. Normal and Anomalous Traffic
Detection of Attacks at the Transport Layer: TCP
1. The TCP Protocol and the 3-Way Handshake
2. Wireshark and TCP Counters
3. Normal and Anomalous Traffic
Specific Activities at the Transport Layer: Scanning
1. Analyzing the activity of one of the most widespread scanning tools: Nmap
  1. Host Discovery
  2. Port Sweep
2. Different Scanning Modes
  1. TCP SYN Scan / Stealth
  2. TCP Connect Scan
  3. FIN Scan
  4. NULL Scan
  5. XMAS Scan
3. Detection of Attacks at the Transport Layer: UDP
  1. The UDP Protocol
  2. Normal and Anomalous Traffic
  3. Analyzing UDP Scanning Activity
4. Detection of Attacks at the Application Layer
  1. The DHCP Protocol
    1. Anatomy of the DHCP Protocol
    2. Wireshark Specifics
    3. Normal and Anomalous Traffic
  2. The DNS Protocol
    1. Anatomy of the DNS Protocol
    2. Exploitation of the DNS Protocol
    3. Normal and Anomalous Traffic
  3. The HTTP Protocol
    1. Anatomy of the HTTP Protocol
    2. Normal and Anomalous Traffic
    3. Wireshark Tools Dedicated to the HTTP Protocol
    4. The Secure HTTPS Protocol
    5. Analyzing HTTPS
    6. Decrypting HTTPS

Module 5: Analysis of supsicious flows

Programme Details

Attack Detection via Flow Analysis
Unknown Traffic
Examination of Flows Linked to Known Malware
1. Examining an Ursnif Infection
2. Examining a Qakbot Infection

Final certification

BASIC course certifications
+

*CPSS certification is issued only if the requirements of the standard are met and after passing an official exam.

Would you like to learn more about our courses and find out if there are any current promotions?

Fill in the form and one of our experts will get back to you as soon as possible.