Black Hat USA 2003

Note: if the class is overfilled, then you will be wait-listed. You will be contacted should this occur.


Black Hat USA Training 2003
Caesars Palace, Las Vegas, NV, July 28-29, 2003

All course materials, lunch and two coffee breaks will be provided. A Certificate of Completion will be offered for each student. You must provide your own laptop.

Course Length: 2 days

Cost: US $2100 before July 3, 2003 or US $2300 after July 3, 2003
NOTE: this is a two day course. The OPSA exam will take place at the end of the second day.  A Blackhat Certificate of Completion will be offered.


course description
Two Day Course
Mon, July 28 thru Tues, July 29
OSSTMM Professional Security Analyst (OPSA)
Dyad Security, Inc. - Robert E. Lee
What to bring:
We recommend that students  bring their own laptop and suitable note taking material to enhance their learning experience.

No laptops are provided


What we cover:

  • Security Analysis
  • Red/Blue Team Strategies
  • Security Testing Project Management

Security Analysis provides the baseline for understanding security test results from sources such as log files, security tool output, protocol dumps and the output from the OSSTMM test modules. Also applied are strategies for risk assessment, system and network survivability, and design solutions in network security architecture. Some exposures and solutions are covered using basic examples. Other exposures or attacks will be presented using data gathered previous to the class.

Red/Blue Team Strategies provides an in depth review of the security consulting rules of engagement; from the marketing, pre-sales, and test preparation phase through the final reporting and workshop phase.  Students will also analyze various Red Team and Blue Team strategies for best results including various attack-net structure deployments both for internal and external testing.

Security Testing Project Management provides insight and knowledge transfer in the realm of OSSTMM testing projects and their applications. The focus of this component will be project management: time reporting, estimations, team management, contracts, client interaction, testing efficiency, and cost controls including Return of Investment management using the OSSTMM.

The student will analyze real test data, understand how/why it was generated, and if it's complete. The final exam is working with scope information and test data to answer analysis, policy, and risk planning questions. In passing the exam the student will earn ISECOM's OSSTMM Professional Security Analyst Certification (OPSA).

What to expect:
The premise of the training course is to provide a variety of hard and soft skills to the security professional. The training course focuses on the analytical skills and security knowledge necessary for security and risk analysis and the business skills required for successful security team and project management. The course is designed to bring the combined international knowledge and experiences of security team leaders and security consultants together.

Those with management experience will have the advantage on the project planning and team management side where those with technical experience will have the advantage on the analysis side. However both could take the class and find it insightful, beneficial, and challenging.

If all you want to do is pass an exam, we recommend the following:

  • Read the newest versions of the OSSTMM, OSSTMM Internal, and the BSTA Workbook.
  • Take a few MBA classes in business information and security.
  • Read books on intrusion detection, honey pots, secure programming, and anything else you can to see how attacks arrive.
  • Learn how to get what you need for security analysis off the Internet. Know where you can get the needed trend information, solutions, CVE info, hacks, exploits, etc. to do an OSSTMM security test.
  • Learn how TCP, UDP, ICMP, IP, RIP, OSPF, BGP and various application level protocols work like FTP, DNS, SNMP, BOOTP, HTTP, HTTPS, etc. and how to analyze them.
  • Learn how to analyze and categorize information leaks, privacy breaches, and competitive intelligence.
  • Learn where to look in the Security presence to find weaknesses and deficiencies.
  • Calculate risk assessment based on the current version of the OSSTMM.
  • Understand how to calculate and execute project plans while upholding proper legal and ethical testing.
  • Know how to follow the security tester's rules of engagement as per the most recent OSSTMM.
  • Work with an efficient red team either internal or as a consultancy to learn efficient teamwork and project requirements.
  • Read what you can about security policies and security architecture to be able to design secure network topographies with associated process controls.

Otherwise, you may be interested in the training course.

Who Should Attend?
The target audience for this class includes security testing team leads, security analysts, security managers, CTO's, CIO's, CSO's, CISO's and any other individual that will actively participate in analyzing of data received from a security test.

Course Length: 2 days

Cost: US $2100 before July 3, 2003 or US $2300 after July 3, 2003

NOTE: this is a two day course. The OPSA certification test will be conducted at the end of the 2nd day. Once ISECOM has reviewed the test results, the certificate will be mailed to the student.



Robert E. Lee's career focus has been on Business Survivability. Robert defines Business Survivability as a combination of Security, High Availability, and Disaster Recovery. Robert's consulting expertise, tools, and documentation have been used by hundreds of organizations world wide.

Black Hat Logo
(c) 1996-2007 Black Hat