Essentials of Incident Response Frameworks

Syllabus

• Week 1

  Defining the Problem

  • Lesson 1: Introduction to Entire Course

    This lesson will outline what you'll learn, who will guide you, and the key takeaways upon completion, providing a clear understanding of the content and expectations. Ideal for those looking to deepen their knowledge in this area

  • Lesson 2: What is Incident Management and Why is it Important?

    This section defines what a major cybersecurity incident is, why businesses need a plan, key terminology, industry frameworks, and the importance of having a major incident process to limit damage and recover quickly.

  • Lesson 3: Importance of a Mature IT Service Management Solution

    This lesson defines IT Service Management (ITSM), its importance, what makes a mature ITSM solution, and key ITIL processes that support effective major incident management.

  • Lesson 4: Justifying the Effort and Cost

    In this lesson, we'll explore the financial and non-financial costs of cybersecurity incidents and how to calculate and communicate the ROI of cybersecurity investments to business leaders.

• Week 2

  Cybersecurity Incident Management Frameworks

  • Lesson 5: SANS Framework: 6-Step Process

    This lesson covers the SANS Institute's six-step Incident Response (IR) process, designed to help organizations manage and mitigate cybersecurity incidents with a structured approach. SANS is a leading cybersecurity organization.

  • Lesson 6: NIST SP 800-61r3: Incident Response Recommendations and Considerations for Cybersecurity Risk Management

    NIST, founded in 1901, promotes U.S. innovation and competitiveness through measurement science, standards, and technology. SP 800-61r3 provides incident response guidelines for cybersecurity risk management.

  • Lesson 7: Documentation Management Frameworks

    Documentation of business processes is useful only if it's easy to retrieve, read, and maintained. Before creating an Incident Management process, ensure staff can find, trust, and follow up-to-date documents.

• Week 3

  Developing a Cyber Incident Response Plan (CIRP)

  • Lesson 8: Defining a Major Incident

    The first step in developing a Cyber Incident Response Plan (CIRP) is defining a major incident. This ensures IT teams address serious issues without overreacting to false positives or overlooking severity.

  • Lesson 9: Building a Cyber Incident Response Plan (CIRP)

    Now that we understand industry best practices and the What, Where, and Why of cybersecurity major incident management, it's time to define our plan and document how a major incident will run for our organization.

  • Lesson 10: Post Implementation Review Process

    A Post Incident Review (PIR) is a detailed review after a major incident to identify process failures or improvements. It can also trigger problem management to prevent future incidents.

• Week 4

  Implementing a Cyber Incident Response Plan

  • Lesson 11: Implementing the Process

    A Cyber Incident Response Plan is useless if no one knows about it, where it is, or how to use it. This lesson covers how to deploy the plan and ensure everyone knows how to access and implement it.

  • Lesson 12: Testing the Plan

    Testing the Cyber Incident Response Plan (CIRP) ensures it works in real-world scenarios. This lesson covers running test scenarios to measure its effectiveness before it's needed in a business-critical situation.

  • Lesson 13: Review, Maintain, and Improve

    The Cyber Incident Response Plan (CIRP) must evolve with changing systems, technology, and business needs. Regular updates ensure it stays relevant and effective in protecting systems over time.

  • Lesson 14: Course Wrap-up

    A quick recap of the key lessons and frameworks, ensuring you’re ready to apply your incident response knowledge in real-world situations.

Who will you learn with?