Attack Training
摘要
This chapter discusses in detail the attack training form of cybersecurity training. An overview of the attack training methodology is provided first, focusing on the interdependency with respect to the other forms of cybersecurity training, namely forensics and defense training. The two main attack training types, fundamental attack training and pentesting training, are presented next, examining in detail the various methods used to teach or learn basic attack skills, as well as pentesting skills. A set of additional resources is also provided, such as knowledge bases (ATT&CK, CAPEC, CWE, etc.) and security testing guidelines, as well as attack training tools (Nmap, Metasploit) and platforms. Finally, the main advantages of attack training, as well as potential issues that may arise, are discussed, both from the trainee and organizer perspectives.