The course will focus on understanding an incident lifecycle and to review for each step the preparation, handling and technical objectives of each phase.

Managing an incident happens during stressful moments for IT operations. Preparation and processes are mandatory to be able to handle such situation. Therefore, we will focus on understanding an incident lifecycle and to review for each step the preparation, handling and technical objectives of each phase.

This is a short, theoretical module, in which you will learn about the different stages of an incident, and how to prepare for them, including setting up a detection and response strategy, analysing logs, and managing backups.

• Preparation: In-depth, (log fields and capabilities, use cases, security application deployment, processes). Default security infrastructure seen in the enterprise.
• Detection: Overview of the role and purpose of an SOC or security alert logs.
• Containment: In-depth, what could be done at what level, the involvement of forensics to carry out this task, possible forensics.
• Eradication: Overview, principles and best practices.
• Recovery: Overview, principle and best practice.
• Lesson learned: Overview, principle and best practice.
• Case Study: Breach for Money

• Understand incident response life cycle
• Describe best practices for incident response management

This is a theoretical course.