What an incident is and how to classify it
Differentiating minor operational alerts from actual security breaches that jeopardize confidentiality, integrity, or availability.
Section 6
Topic 19: Incident Response and Recovery
Detection, reporting, and containment basics
Isolating affected systems from the network, notifying designated incident response units, and preventing malware propagation.
Evidence handling and chain of custody ideas
Preserving original system logs, copying storage media using write-blockers, and keeping strict tracking documentation.
Recovery, backups, and safe rebuilding
Scanning recovery datasets for malicious indicators before restoration, and rebuilding compromised operating environments from known clean baselines.
Post-incident review and lessons learned
Analyzing how the compromise occurred, documenting gaps in existing security defenses, and improving response plans.
Interactive Tabletop Exercises and Scenarios
Engaging students in team roleplay walk-throughs based on active incident playbooks (e.g., handling a simulated enterprise ransomware outbreak or responding to an acute session token theft alert) to practice containment mechanics under structural stress.
Knowledge Check
What are the key operational phases of the standard incident response lifecycle?
Preparation, detection, analysis, containment, eradication, and recovery.
« Previous: Vulnerability Management and Patching — Next: Careers, Labs, and Next Steps »