Incident Response Training

Course Overview

Foundational training in cyber incident response methodologies, playbooks, and procedures. Covers preparation, detection, analysis, containment, eradication, and recovery.

Includes tabletop exercises simulating ransomware, data breaches, and insider threats based on real incidents. Available in both technical and executive tracks.

Course Details

Duration: 3-4 days
Format: Classroom & tabletop exercises
Audience: ITInformation Technology professionals, security teams, executives
Prerequisites: Basic understanding of ITInformation Technology systems and security concepts

What You'll Learn

Preparation - Building incident response capabilities and playbooks
Detection - Identifying security incidents and understanding severity
Analysis - Investigating incidents and determining scope
Containment - Isolating threats and preventing further damage
Eradication - Removing threats and closing security gaps
Recovery - Restoring systems and returning to normal operations
Lessons Learned - Post-incident review and improvement

Training Tracks

Technical Track

Hands-on technical training for security analysts and incident responders. Deep dive into tools, techniques, and procedures for investigating and responding to cyber incidents.

Request Info →

Executive Track

Strategic overview for executives and leadership. Focus on decision-making, resource allocation, and communication during incidents. Includes tabletop exercises.

Request Info →

Tabletop Exercises

Real-world scenarios based on actual incidents

Exercise 1: Ransomware Response

Respond to a ransomware attack affecting critical systems. Practice containment, communication, and recovery procedures.

Exercise 2: Data Breach Investigation

Investigate a suspected data breach, determine scope, and implement containment measures.

Exercise 3: Insider Threat Response

Respond to an insider threat scenario, balancing security needs with operational requirements.

Exercise 4: Supply Chain Compromise

Address a supply chain compromise affecting multiple systems and vendors.