Preparing for incident management is essential in today’s environment. In this module, students will learn about the different stages of an incident, and how to prepare for them. Setting up a detection and response strategy, analysing logs, managing backups. Using a case study, we will dig into the key concepts and technical approaches to adopt in handling cybersecurity incidents.

Case study : Ransomware attack

In this scenario, the information system was breached by exploiting a remote access vulnerability several months ago. The attacker took control of the information system, exfiltrated data and then deployed a ransomware attack across the entire infrastructure. Finally, he published the stolen data publicly. Explanation of the underground ecosystem. We will use a similar scenario and perform an incident response.

In this course, participants will engage in a hands-on exercise focused on responding to a ransomware breach. They will learn how to conduct a thorough forensic investigation to identify the attack vectors, assess the extent of the damage, and gather critical evidence. By the end of the exercise, students will gain practical skills in incident response, including how to effectively manage ransomware incidents, mitigate their impact, and prevent future occurrences. This training will equip students with the necessary expertise to respond swiftly and effectively to real-world cybersecurity threats.

On completion of this module, learner will be able to:

• Perform an incident response,
  
• Acquire and analyse artefacts of a ransom attack.
  
• Understand how to deal with windows memory forensic.
  

Theory and exercises