Planning a Security Incident Response

About this course

This course is designed to help you manage an enterprise security incident, while avoiding common errors, increasing both the effectiveness and efficiency of your incident response efforts.

What you'll learn

After completing this course, students will be able to:

Effectively prioritize the response to a security incident
Build a computer security incident response team (CSIRT)
Develop an incident response action plan
List appropriate post-incident activities

Prerequisites

A understanding of the current cybersecurity ecosystem.

Course Syllabus

Module 1

Introduction
What is threat modelling?
The need for incident response plans
Assess vulnerabilities in your environment
Establish routine monitoring and review of network traffic and system performance
Log analysis

Module 2

Incident Response Policy, Plan, and Procedure Creation
Creation of a CSIRT
Establish CSIRT team roles
Establish governing policy

Module 3

Initial assessment of incident
Attack vectors
What are false positives and false negatives?
Determine the nature of the attack
Identify the systems that have been compromised
Choosing a containment strategy

Module 4

Post-incident activity
Protect the evidence while restoring functionality
Recommendations and Lessons learned
Security incident report

Meet the instructors

Philip E.Helsel

Senior Content Developer, Learning eXperiences Team
Microsoft

Philip Helsel is a Senior Content Developer with the Microsoft Learning team, where he is currently focused on building IT Professional courses for Windows 10, Hyper-V, and Configuration Manager. He is also the planner for a new Microsoft Virtual Academy Enterprise Security channel.

Before joining Microsoft, he was a Pre-Sales Engineer and trainer at Fast Search and Transfer, a Pre-Sales Engineer at Oracle Corporation, and Sun Microsystems. He also served as a Captain in U.S. Army.

Phil has a BS degree in Mathematics & Physics, and a Masters in Computer Science. Mr. Helsel also has a number of certifications including his Microsoft Certified Trainer (MCT), MCITP in Server Virtualization, CCNA, VCP5, CISM, Security+, Network+, and others.

Kimberly Rasmusson-Anderson

Senior Content Developer, Learning eXperiences Team
Microsoft

Kimberly is a Senior Content Developer with the Microsoft Learning team.

She is responsible for building IT Professional courses. She is also the project manager for a new Microsoft Virtual Academy Enterprise Security channel.

Prior to this, Kimberly was a technical lead in the Microsoft Customer Service and Support organization.

Enrollment in this course is by invitation only