CFR: Incident Analysis, Response, and Forensics

Overview

To round out your skills as a cybersecurity practitioner, you'll analyze incidents and indicators of compromise (IOCs) using Windows- and Linux-based tools. Then, you'll deploy an incident handling and response architecture, mitigate incidents, and hand over incident information to forensic personnel. Lastly, you'll investigate cybersecurity incidents by applying a forensic investigation plan, securely collecting and analyzing electronic evidence, and following up on the results of an investigation. This is the fourth and final course in a multi-course Specialization. All of the courses in this Specialization require that you purchase the CFR-410 LogicalLABS, which are interactive, browser-based virtual labs that simulate the activity environment. These labs are already set up with the data files, networking, and system configurations required to perform the activities. With the coupon code provided in the first course for 25% off, the labs cost approximately $60. If you already purchased the labs for the first course, you're all set.

Syllabus

Performing Active Asset and Network Analysis

The analysis you perform on log data is important, but it tends to remain static. Most of the intelligence you'll be gathering and analyzing from logs will be actionable only after the event is either underway or already finished. So, to complement this static analysis, you need something a bit more dynamic. That's why, in this lesson, you'll take a more active approach to analyzing your organizational assets.

Responding to Cybersecurity Incidents

Now that you've performed a comprehensive analysis of your network and other assets, you need to prepare for what much of this analysis will reveal—the reality of a security incident affecting your organization. Responding quickly, yet cautiously, to the inevitable can make all the difference in preventing serious, long-term harm to the organization.

Investigating Cybersecurity Incidents

Following a cybersecurity incident, you may be called on to perform forensic analysis, such as collecting evidence and determining how and why the incident occurred, and who caused it.