Course Overview
The training includes interactive presentations that provide an overview of the response process in the context of real-world examples of organisations facing cybersecurity attacks.
Learning Outcomes
By the end of this training, participants will be able to:
- Recognise the importance of a structured incident response process.
- Understand the stages of the incident response lifecycle and the activities involved in each stage.
- Identify and fulfil their roles and responsibilities during an incident.
- Develop effective communication strategies for incident response.
- Navigate legal and compliance issues related to cybersecurity incidents.
- Implement best practices to improve the organisation’s overall incident response capabilities.
Course Outline
The focus of this training course is the “Actions On” a realistic cyber-attack, starting with a solid foundation of the work the organisation should do prior to an attack being detected (“Preparation”), to an incident being detected (“Plan Execution”), right up to the incident recovery being completed and the organisation closing the incident (“Lessons Learned”).
Target Audience
Our training course is technical in nature and is intended for the following team members:
- IT Team Members
- System Administrators
- Network Engineers
- Security Analysts
- Incident Response Team Members
This course is ideal for IT professionals looking to reinforce their foundational knowledge, stay ahead of evolving threats, and proactively secure their organisation’s critical infrastructure against attacks.
We cover the following sections throughout the session:
Introduction to Incident Response
- Definition and Importance of Incident Response
- Goals of Incident Response
- Key Terminologies and Concepts
Roles and Responsibilities
- Defining roles within the incident response team
- Responsibilities of team members and other stakeholders
- Coordination with external entities (e.g., law enforcement, third-party vendors)
Incident Response Lifecycle
Preparation
- Developing and implementing an incident response plan
- Establishing an incident response team
- Tools and resources for incident response
Identification
- Detecting and analysing potential security incidents
- Sources of incident detection (logs, alerts, user reports)
- Initial categorisation and prioritisation
Containment
- Strategies for short-term and long-term containment
- Minimising damage and preventing further compromise
- Eradication
- Identifying and eliminating the root cause of the incident
- Removing malware and closing vulnerabilities
Recovery
- Restoring affected systems and services to normal operations
- Validating system integrity and performance
Lessons Learned
- Conducting post-incident analysis and reporting
- Updating response plans and improving security measures
Ensuring Effective Response
- Developing a communication plan
- Internal and external communication strategies
- Managing information disclosure and public relations
- Legal and Compliance Considerations