• Online, Self-Paced

This course covers various incident analysis tools and techniques that support dynamic vulnerability analysis and elimination, intrusion detection, attack protection and network/resources repair. The student will be presented with real-world examples and scenarios to help provide knowledge, understanding, and capacity for effective cyber incident analysis and response.

Learning Objectives

  • Students will demonstrate an understanding of background and concepts for cyber incident management, as well as an overview of the cyber incident management process. 
  • Topics include the types of cyber incidents, common forms of malware and attacks, an outline of the cyber incident management process, and common standards for cyber incident management.
  • Students will demonstrate an understanding of the preparation phase of cyber security incident management.
  • Topics include cyber incident management policies; services and procedures; the organizational structure, roles, and personnel; and cyber incident management training and awareness programs. 
  • Students will demonstrate an understanding of reactive cyber incident management activities. Some of these activities include monitoring, log management, detection, cyber incident triage, event scope and characteristics, incident investigation, impact and escalation, and cyber incident management software and services.
  • Students will demonstrate an understanding of protecting and restoring systems that have been compromised by cyber security incidents including incident containment, identification, eradication, and recovery. The mitigation of specific common types of cyber incidents is also covered. 
  • Students will demonstrate an understanding of cyber incident proactive and post services, legal issues, and human resource issues.
  • Some topics include attack categories, outcome discussions, vulnerability analysis, evidence and digital forensics, chain of custody, as well as training and skills for Computer Security Incident Response Team members.

Framework Connections

The materials within this course focus on the NICE Framework Task, Knowledge, and Skill statements identified within the indicated NICE Framework component(s):

Specialty Areas

  • Incident Response

Specialty Areas have been removed from the NICE Framework. With the recent release of the new NICE Framework data, updates to courses are underway. Until this course can be updated, this historical information is provided to give better context as to how it can help you with your cybersecurity goals.