Planning and Implementing a Security Incident Response

Name: Planning and Implementing a Security Incident Response
Rating: 4.4 (4163 reviews)

Learn all about planning and implementing a Security Incident Response along with best practices and recommendations

Created byIT New Courses

Last updated 10/2021

English

English [Auto],Spanish [Auto],

What you'll learn

Manage an enterprise security incident
Build a computer security incident response team (CSIRT)
Effectively prioritize the response to a security incident
Post-incident activity
Develop an incident response action plan

Course content

5 sections • 9 lectures • 1h 58m total length

Instructor Introduction1:53
Meet the instructor, Christian Calinescu, as he introduces the final piece in the nine-course Microsoft cybersecurity professional track for planning and implementing a security incident response.
About the Course7:28
Plan and implement a security incident response by building a computer security incident response team, prioritizing actions, and understanding threat modeling and incident reporting.

What is Threat Modeling17:21
Learn threat modeling as a systematic method and employ the stride method to identify threats from an attacker's view, map attack surfaces, and prioritize mitigations.
NIST Framework12:57
Explore the NIST cybersecurity framework, its identify, protect, detect, and respond functions, and how to tailor it to assets, governance, and risk management to reduce cyber risk.
Prepare and Response17:55
Develop a robust incident response plan by assembling a CSIRT, defining containment and recovery procedures, and minimizing damage during incidents. Train with scenario exercises and validate backups.
Section 2 Review Questions

Building a CSIRT Overview5:33
Explore building a computer security incident response team (csirt) and its role in the incident response lifecycle, including preparation, detection and analysis, containment, eradication, recovery, and post-incident lessons.
Preparation28:39
Train and organize a computer security incident response team with clear roles, realistic scope, and documented workflows; establish communications, legal coordination, backups, and continual improvement through drills and lessons learned.
Section 3 Review Questions

Security Incident Report (SIR) Overview4:55
Document and review the security incident report (seer) within the post incident activity phase to mitigate incidents and prevent similar future occurrences.
Practice SIR Report21:52
Learn to complete a security incident response report as a post incident activity, detailing basic organizational information, incident overview, severity, and remediation steps to capture lessons learned.

Requirements

Basic understanding of the current cybersecurity ecosystem
Basic understanding of analysis of hacks on computers and networks
Basic understanding of Risk Management

Description

This course is designed to help you manage an enterprise security incident, while avoiding common errors, increasing both the effectiveness and efficiency of your incident response efforts.

After completing this course, students will be able to:

Effectively prioritize the response to a security incident
Build a computer security incident response team (CSIRT)
Develop an incident response action plan
Post-incident activity

This course is designed to get you started as quickly as possible. There are a variety of self-paced learning activities. You will get:

Video lectures on each topic explaining each concept thoroughly with examples (and Demonstrations where applicable)
Review questions (quizz) at the end of each section
Final Exam at the end of the course - review questions to test your knowledge on the topics and concepts learned in the course
Links to official Microsoft resources/blogs/videos for further documentation

This course is the 9th course from a series of 9 courses which address all aspects to become a Microsoft Cyber Security Professional . This cyber security track is designed to teach you, or fill in the knowledge gaps, all the aspects and technologies to become a successful cyber security professional. The entire track addresses mostly Microsoft security technologies, including the latest cloud services made available by Microsoft like: Microsoft Defender Suite, Office 365 security features and services, Microsoft Graph, Azure Active Directory Security and many more.

Microsoft, Windows, Microsoft 365 and Microsoft Azure are either registered trademarks or trademarks of Microsoft Corporation in the United States and/or other countries. This course is not certified, accredited, affiliated with, nor endorsed by Microsoft Corporation.

Who this course is for:

Security Administrators, Security Analysts, System Administrator
Any IT enthusiast who wnts to get started in cyber security and be confortable with the Security Incident process

Planning and Implementing a Security Incident Response

What you'll learn

Explore related topics

Course content

Introduction2 lectures • 9min

What is Threat Modeling3 lectures • 48min

Building a Computer Security Incident Response Team (CSIRT)2 lectures • 34min

Security Incident Report2 lectures • 27min

Final Exam0

Requirements

Description

Who this course is for: