The Cyber Incident Response course will give students an understanding of how incidents are responded to at a high level, as well as allow them to build important technical skills through the hands-on labs and projects.
от партнера


Cyber Incident Response
InfosecОб этом курсе
Приобретаемые навыки
от партнера

Infosec
Infosec believes knowledge is power when fighting cybercrime. We help IT and security professionals advance their careers with skills development and certifications while empowering all employees with security awareness and privacy training to stay cyber-safe at work and home. Learn more at infosecinstitute.com.
Программа курса: что вы изучите
Incident Response Fundamentals
This course goes into some detail with common definitions and severity criteria related to incident response, with special attention being paid to making sure the student understands that the severity criteria should be based on overall organizational definitions and procedures. The latter part of the course goes into the importance of asset inventory and identification as a basis for establishing severity criteria. All these pieces are required for proper preparation for any incident.
Stages of Incident Response
The Preparation section of the module goes into some detail with common definitions and severity criteria, with special attention being paid to making sure the student understands that the severity criteria should be based on overall organizational definitions and procedures. The latter part of the module goes into the importance of asset inventory and identification as a basis for establishing severity criteria. All these pieces are required for proper preparation for any incident. The Identification section deals specifically with how incidents are identified, as well as the classification levels that incidents might fall within. It also reminds the student that these classification levels are established with input from upper management and the rest of the organization. We go into details of notifying the appropriate parties of the incident and how to do that properly. We end this course with a discussion of common tools and techniques. The next section explores containment and the proper scoping and management of it. We examine the details of how to contain an incident and, more importantly, how to define what containment means. We also explore common containment tools. In the Investigation segment, you’ll learn the questions asked in normal investigations and how to properly answer them. You’ll explore the important data sources these answers are pulled from and the role this process plays in incident response overall. Dive into what it takes to remove threats from and environment after the threat has been contained. We’ll also take a look at how to verify the threat has been eradicated and address proper notification of eradication to other authorized parties. Lastly, we’ll discuss some common tools for eradication. This Recovery segment shows how we tie directly into business continuity and disaster recovery at this phase. We deal with how to restore systems in the least disruptive and most efficient way, as well as defining what constitutes "recovered." Finally, we look at validation and sign-off of recovery. The module ends with how to effectively assess how well the team responded. It also looks at implementing needed improvements and how to ingest feedback from the rest of the organization or even outside organizations.
Technical Deep Dive with Incident Response Tools
This lesson is all about doing. Experience the incident response process from the perspective of a responder using real tools of the trade to detect, contain, and investigate cyber incidents, and eradicate threats. Follow the instructor as he examines two realistic scenarios: one of a data breach and the other of an incident that is still ongoing.
Часто задаваемые вопросы
Когда я получу доступ к лекциям и заданиям?
Что я получу, оплатив сертификацию?
Is financial aid available?
Остались вопросы? Посетите Центр поддержки учащихся.