The Cyber Incident Response course will give students an understanding of how incidents are responded to at a high level, as well as allow them to build important technical skills through the hands-on labs and projects.
This course starts with a high-level discussion of what happens at each phase of responding to an incident, followed by a technical deep dive into some of the more exciting parts of memory, network, and host analysis and forensics. This course is for anyone wishing to apply learned forensics and offensive knowledge such as ethical hacking to the incident response process.
What you will learn
Stages of Incident Response
The Preparation section of the module goes into some detail with common definitions and severity criteria, with special attention being paid to making sure the student understands that the severity criteria should be based on overall organizational definitions and procedures. The latter part of the module goes into the importance of asset inventory and identification as a basis for establishing severity criteria. All these pieces are required for proper preparation for any incident.
Incident Response: Identification
The Identification section deals specifically with how incidents are identified, as well as the classification levels that incidents might fall within. It also reminds the student that these classification levels are established with input from upper management and the rest of the organization. We go into details of notifying the appropriate parties of the incident and how to do that properly. We end this course with a discussion of common tools and techniques.
Incident Response: Containment
This section explores containment and the proper scoping and management of it. We examine the details of how to contain an incident and, more importantly, how to define what containment means. We also explore common containment tools.
Incident Response: Investigation
In the Investigation segment, you’ll learn the questions asked in normal investigations and how to properly answer them. You’ll explore the important data sources these answers are pulled from and the role this process plays in incident response overall.