*Read our disclaimer
Disclaimer
Each certification is mapped to the National Cybersecurity Workforce Framework (NCWF). The Framework organizes cybersecurity into seven high-level Categories, each comprised of several specialty areas, work roles, knowledge, skills, abilities, and tasks. These seven high-level Categories are aligned directly to the CCE® Program’s certification Concentration Areas. Candidates often prepare for an exam by using a variety of resources that familiarize them with the authoritative sources and the exam’s concentration area.
Third-party products and services, including course instructors have helped many candidates to close knowledge and skill gaps. Lunarline does not endorse any particular provider and encourages candidates to use a variety of tools and resources that will enhance their understanding of relevant principles and the exam’s concentration area.
Certification Description
Successful completion of this exam will demonstrate a candidate’s ability to understand tactics, techniques and procedures (TTP) in the process of proactively and iteratively searching through networks, systems, and data (internal and external) to detect and isolate advanced threats that evade existing security solutions – specifically hacker/hacktivist and related group intentions and capabilities, and nation-state sponsored CNE (computer network exploitation) and CNA (computer network attack) targeting the critical systems, data, and infrastructure.
The candidate will be able to develop, implement, configure, and enhance organizational wide and system-level security forensic sampling tools and advanced multimedia exploitation tools to help identify internal and external organizational Indicators Of Compromise (IOCs) The candidate will use threat information from multiple sources to conduct analysis of system / network anomalies. The candidate will be able detect, respond, recover, and report these findings in accordance with Government and organizations incident handling requirements.
Authoritative Sources
- NIST SP 800-150 Guide to Cyber Threat Information Sharing
- NIST SP 800-101 Rev. 1 – Guidelines on Mobile Device Forensics
- NIST SP 800-86 – Guide to Integrating Forensic Techniques into Incident Response
- NIST SP 800-83 Rev. 1 – Guide to Malware Incident Prevention and Handling for Desktops and Laptops
- NIST SP 800-61 Rev.2 – Computer Security Incident Handling Guide
- The NIST Computer Forensics Tool Testing Project Handbook (Hash Analysis)
Requirements
Candidates must possess a Certified Expert Hunt Team (CEHT) certifications and at least 5 years of experience in advanced malware analysis, cyber hunt, forensic sampling, or incident response and forensics (or forensic sampling) in order to obtain the expert level credential. The associate level credential will be awarded to those who pass the exam, but do not have the required experience. The credential can be elevated to expert level upon attaining the required experience. Simply email [email protected] to start the experience verification process.
Mapping to the NICE Framework
NICE Work Role Name:
Cyber Operator
NICE Work Role Description:
Conducts collection, processing, and/or geolocation of systems to exploit, locate, and/or track targets of interest. Performs network navigation, tactical forensic analysis, and, when directed, executes on-net operations.
Lunarline Training Courses:
*Read our disclaimer
Disclaimer
Independence: The Lunarline SCS Training Program and Certification Program are independent from one another. Although they may target the same NICE category, specialty area, work role, and/or authoritative sources, certification exams are not based on any SCS training. Taking SCS training is NOT required and Lunarline does not guarantee that an individual will pass nor have any advantage based on participation with SCS training. The following training offerings are intended to show linkage only to the same NICE category, and not linkage to the certification or exam content.
Continuing Education: The Lunarline SCS Training Program and other third-party vendors offer activities, products and services across the country that qualify as Professional Development Credits (PDCs) that target the same NICE category, specialty area, work role, and/or authoritative sources as our certifications. We encourage candidates to use a variety of tools and resources that will enhance their understanding of relevant principles and reflect their learning styles and needs.
- Cyber Operator (CO101-RBT)
- Cybersecurity Hunt (CO280)
- Cybersecurity Operations Implementation (OM155)
- Cybersecurity Operations Implementation - SP (OM155-SP)
- Ethical Hacking - WBT (PR032-WBT)
- Warrior to Cyber Warrior Bootcamp (W2CW101)
Share Certified Expert Focused Operations (CEFO)®