The file's text, extracted by GovTribe without its formatting.
DEPARTMENT OF THE AIR FORCE
STRAWMAN CTS E3OBR17D1A 003A
81st Training Group (AETC)
(PDS Code 1GD)
Keesler Air Force Base, MS 39534-2494
November 2015 UNDERGRADUATE CYBERSPACE TRAINING (phase 3)
1. Implement training in support of this CTS with class beginning 2016_____ and graduating 2016____.
2. Purpose. This course training standard:
a. Establishes the training requirements using tasks, knowledge, and proficiency levels of training for course E3OBR17D1A 003A, Undergraduate Cyberspace Training (phase 3).
b. Provides the basis for the development of more detailed training materials, training objectives, and training evaluation instruments for the course.
3. Course Description. This course provides training to selected Department of Defense (DoD) military in AFSC 17X with the fundamental skills and knowledge necessary for the award of the A-Shred Air Force Specialty (AFS). Training includes Covering Tracks – Unix, Covering Tracks – Windows, Covering Tracks – Networks, Attack Vectors, Packet and Traffic Analysis, Forensics, Unified and Battlefield Systems Defense, and a Capstone.
4. Qualitative Requirements. Attachment 1 contains the tasks, knowledge, and proficiency levels referenced in paragraph 2. Prerequisites: Mandatory: Individuals selected to attend training must have completed both Undergraduate Cyberspace Training (phases 1 and 2) courses and have been granted their Top Secret/SCI clearance prior to class start date.
5. Recommendations. Send comments and recommendations regarding AETC training quality to 81 TRG, Keesler AFB, MS 39534. Reference this CTS in correspondence (paragraph, training standard element, etc.). A customer information line has been installed to enable to identify graduates who may have received over or undertraining on task/knowledge items listed in this training standard. For quick response, call the customer information line, day or night, at DSN 597-4566, or fax us at DSN 597-3790, or e-mail us at 81trg-tget@us.af.mil.
SCOTT E. SOLOMON, Colonel, USAF
Commander
1 Atch
Qualitative Requirements
Prepared by: 333 TRS/TRR
Approved by and Date: 333 TRS/TRR, 16 November 2015 Distribution:
SAF-CIO A6-1; HQ AETC/A1MRT-1; AETC/A3TC-1; 81 FSS/FSMM-1; 81 TRG/TGET-1; 333 TRS/UMA-1
CTS E3OBR17D1A 003A
QUALITATIVE REQUIREMENTS
PROFICIENCY CODE KEY
| SCALE VALUE |
| DEFINITION: The individual |
TASK
PERFORMANCE
LEVELS
| 1 |
| Can do simple parts of the task. Needs to be told or shown how to do most of the task. (EXTREMELY LIMITED) |
| 2 |
| Can do most parts of the task. Needs help only on hardest parts. (PARTIALLY PROFICIENT) |
| 3 |
| Can do all parts of the task. Needs only a spot check of completed word. (COMPETENT) |
| 4 |
| Can do the complete task quickly and accurately. Can tell or show others how to do the tasks. (HIGHLY PROFICIENT) |
*TASK
KNOWLEDGE
LEVELS
| a |
| Can name parts, tools, and simple facts about the task. (NOMENCLATURE) |
| b |
| Can determine step by step procedures for doing the task. (PROCEDURES) |
| c |
| Can identify why and when the task must be done and why each step is needed. (OPERATING PRINCIPLES) |
| d |
| Can predict, isolate, and resolve problems about the task. (COMPLETE THEORY) |
**SUBJECT
KNOWLEDGE
LEVELS
| A |
| Can identify basic facts and terms about the subject. (FACTS) |
| B |
| Can identify relationship of basic facts and state general principles about the subject. (PRINCIPLES) |
| C |
| Can analyze facts and principles and draw conclusions about the subject. (ANALYSIS) |
| D |
| Can evaluate conditions and make proper decisions about the subject. (EVALUATION) |
EXPLANATIONS
* A task knowledge scale value may be used alone or with a task performance scale value to define a level of knowledge for a specific task. (Examples: b and 1b) A subject knowledge scale value is used alone to define a level of knowledge for a subject not directly related to any specific task, ** or for a subject common to several tasks.
- This mark is used alone instead of a scale value to show that no proficiency training is provided in the course.
X This mark is used alone in course columns to show that training is required but not given due to limitations in resources.
CTS E3OBR17D1A 003A
QUALITATIVE REQUIREMENTS
Task, Knowledge, and Proficiency Level
| 1. PACKET/TRAFFIC ANALYSIS |
| - |
| 1.1. Identify Normal traffic header/payloads |
| 2b |
| 1.2. Identify Abnormal Traffic |
| 2b |
| 1.3. Identify Anomalous - Benign |
| 2b |
| 1.4. Identify Malicious Traffic (Beaconing, Spearfishing, Exfil, Worm & EXE) |
| 2b |
| 1.5. Identify Deep vs. Shallow Packet Inspection |
| 2b |
| 1.6. Identify Stateful Inspection |
| 2b |
| 1.7. Identify Behavioral Traffic Analysis In the AFNET |
| 2b |
| 2. COVERING YOUR TRACKS |
| - |
| 2.1. Demonstrate Hiding Files in *nix |
| 2b |
| 2.2. Demonstrate *nix Log Editing |
| 2b |
| 2.3. Demonstrate Accounting Entry Edit in *nix |
| 2b |
| 2.4. Demonstrate Analyzing a *nix Shell History File |
| 2b |
| 2.5. Demonstrate Hiding Files in Windows |
| 2b |
| 2.6. Demonstrate Windows Log Editing |
| 2b |
| 2.7. Demonstrate Alternate Data Streams in Windows |
| 2b |
| 2.8. Demonstrate Reverse WWW Shell |
| 2b |
| 2.9. Demonstrate ICMP Tunnels |
| 2b |
| 2.10. Demonstrate Covert_TCP |
| 2b |
| 2.11. Demonstrate Passive Covert Channels |
| 2b |
| 2.12. Demonstrate Sniffing Backdoors |
| 2b |
| 2.13. Demonstrate Steganography Methods |
| 2b |
| 3. OFFENSIVE OPERATIONS |
| - |
| 3.1. Special Access Programs (SAP) |
| B |
| 3.2. Integrated Joint Special Technical Operations (IJSTO) |
| B |
| 3.3. Execute O/S Attack Vectors |
| 2b |
| 3.4. Execute Virtual Environment Attack Vectors |
| 2b |
| 3.5. Unified and Battlefield Systems Offensive Courses of Action |
| B |
| 4.1. Forensic Methodology |
| B |
| 4.4. Digital Forensics Fundamentals |
| B |
| 5. DEFENSIVE OPERATIONS |
| - |
| 5.1. Unified and Battlefield Systems Defensive COAs |
| B |
| 5.2. Execute DCO Mission |
| 2b |
| 6. FIGHTING THROUGH A CYBER ATTACK |
| - |
| 6.1. Plan Cyber Operations |
| 2b |
| 6.2. Attack Cyber Technologies |
| 2b |
| 6.3. Defend Networks and Systems |
| 2b |
6.4. Prepare and Present Mission Brief and Debrief
SUMMARY OF CHANGES
None, this is a new course.
2b