Planning a Security Incident Response

Module 1

• Introduction
• What is threat modelling?
• The need for incident response plans
• Assess vulnerabilities in your environment
• Establish routine monitoring and review of network traffic and system performance
• Log analysis

Module 2

• Incident Response Policy, Plan, and Procedure Creation
• Creation of a CSIRT
• Establish CSIRT team roles
• Establish governing policy

Module 3

• Initial assessment of incident
• Attack vectors
• What are false positives and false negatives?
• Determine the nature of the attack
• Identify the systems that have been compromised
• Choosing a containment strategy

Module 4

• Post-incident activity
• Protect the evidence while restoring functionality
• Recommendations and Lessons learned
• Security incident report