This course covers various incident analysis tools and techniques that support dynamic vulnerability analysis and elimination, intrusion detection, attack protection and network/resources repair. The student will be presented with real-world examples and scenarios to help provide knowledge, understanding, and capacity for effective cyber incident analysis and response.
Learning Objectives
- Students will demonstrate an understanding of background and concepts for cyber incident management, as well as an overview of the cyber incident management process.
- Topics include the types of cyber incidents, common forms of malware and attacks, an outline of the cyber incident management process, and common standards for cyber incident management.
- Students will demonstrate an understanding of the preparation phase of cyber security incident management.
- Topics include cyber incident management policies; services and procedures; the organizational structure, roles, and personnel; and cyber incident management training and awareness programs.
- Students will demonstrate an understanding of reactive cyber incident management activities. Some of these activities include monitoring, log management, detection, cyber incident triage, event scope and characteristics, incident investigation, impact and escalation, and cyber incident management software and services.
- Students will demonstrate an understanding of protecting and restoring systems that have been compromised by cyber security incidents including incident containment, identification, eradication, and recovery. The mitigation of specific common types of cyber incidents is also covered.
- Students will demonstrate an understanding of cyber incident proactive and post services, legal issues, and human resource issues.
- Some topics include attack categories, outcome discussions, vulnerability analysis, evidence and digital forensics, chain of custody, as well as training and skills for Computer Security Incident Response Team members.
Framework Connections
The materials within this course focus on the NICE Framework Task, Knowledge, and Skill statements identified within the indicated NICE Framework component(s):
Specialty Areas
- Incident Response
Feedback
If you would like to provide feedback on this course, please e-mail the NICCS team at NICCS@mail.cisa.dhs.gov. Please keep in mind that NICCS does not own this course or accept payment for course entry. If you have questions related to the details of this course, such as cost, prerequisites, how to register, etc., please contact the course training provider directly. You can find course training provider contact information by following the link that says “Visit course page for more information...” on this page.