Overview

This course covers incident response methods and procedures that are taught in alignment with industry frameworks such as US-CERT's NCIRP (National Cyber Incident Response Plan), and Presidential Policy Directive (PPD) 41, United States Cyber Incident Coordination. It is ideal for candidates who have been tasked with managing compliance with state legislation and other regulatory requirements regarding incident response, and for executing standardized responses to such incidents. The course introduces procedures and resources to comply with legislative requirements regarding incident response. This course is designed primarily for IT leaders and company executives who are responsible for complying with incident response legislation. This course focuses on the knowledge, resources, and skills necessary to comply with incident response and incident handling process requirements. This course is also designed to assist students in preparing for the CertNexus® IRBIZ™ (Exam IRZ-110). What you learn and practice in this course can be a significant part of your preparation. In this course, you will: explain the importance of risk management in preparation for incident response; given a scenario, execute incident response processes; explain general mitigation methods and devices; and assess and comply with current incident response requirements.

Syllabus

Assessing Information Security Risk

As a security leader, you are familiar with the ways in which information is vulnerable to theft, destruction, alteration, and unavailability. But good security is not just a process of reacting to individual threats when they appear or closing holes when they are discovered—it's a process of understanding how your information, by its very nature and the ways in which it is used, is at risk of being compromised. When you understand the risks you face on a foundational level, you can better prepare yourself to reduce or eliminate the chances of a security incident occurring. When an incident does occur, you'll also be better prepared to respond in a way that minimizes the impact the incident has on your information.

Responding to Cybersecurity Incidents

Now that you've identified the importance of risk management, you need to prepare for how these risks often manifest—as security incidents affecting your organization. Responding quickly, yet cautiously, to the inevitable can make all the difference in preventing serious, long-term harm to the organization.

Investigating Cybersecurity Incidents

Following a cybersecurity incident, the organization may be called upon to perform forensic analysis, such as collecting evidence and determining how and why the incident occurred, and who caused it.

Complying with Legislation

Although you've developed an effective incident response plan at this point, you're not done yet. You must ensure that this plan and its implementation align with any state, federal, or international laws that your organization is subject to. This is a necessary step in keeping the organization out of legal trouble, as well as minimizing other types of risk that result from non-compliance.