Onsite IT professionals are the first responders to security breaches. They are the ones who detect anomalies on the network, discover indicators of attack and compromise, and act according to how they have understood the situation.
This course teaches IT professionals structured techniques and gives specific tools to investigate incidents and make the right decisions when breached. Our teachers also equip the students with a structured process to work with professional teams of incident responders and digital forensics investigators to ensure positive outcomes as achieved for organizations affected by security breaches.
Asking the ask the right questions, following the right procedures, investigating systems effectively and rapidly, and correctly documenting findings, are crucial activities that guarantee the success of responding to breaches. Any failure on the part of the IT team to correctly assess a threat or act inappropriately in response to a compromise can lead to the rest of the organization being unable to further respond appropriately to the breach. Very often, a failure from business executives and board members to properly manage a breach can be directly linked to a failure in investigation and communication from lower-level employees who received little to no training in handling security incidents.
Theoretical knowledge makes up 50% of the class, and the other 50% consists of tabletop exercises and wargames.
In this module, you are introduced to the attacker mindset and the different attack kill-chains employed by adversaries. You are taught the importance of this knowledge when responding to breaches as it will inform many incident response decisions. We will review multiple case studies of organisations that responded inappropriately to breaches because of failures in understand the adversaries they were facing and offer examples of what they could have been done instead.Module 2: Network and Endpoint Security Monitoring
When deploy across the network, Event logging and security monitoring greatly assist incident responders and forensics investigators detect, respond and counter cyberattacks. In this module, you will learn easy-to-use security tools that can be deployed across your endpoint fleet and network taps to capture all the security logs you’ll need to investigate security compromises. You will also be introduced to forensics tools to rapidly investigate whether a machine has been compromised, and how to do incident response in the cloud.Module 3: Investigating Security Anomalies
In the third module you are taught structured analytics techniques to rapidly and thoroughly investigate and triage security anomalies. Organisations that do not employ those techniques often miscalculate the risk of security alerts and thus begin the incident response process when it’s already too late (e.g. after they receive an email blackmailing them, or when they are alerted that their data is on the black market being sold to the highest bidder).Module 4: Consuming Threat Intelligence
Threat intelligence is a crucial tool meant to assist business decision makers understand the adversaries they are facing and the seriousness of early compromise events, and yet, it seems like almost no organization really knows how to consume it. In this module, you will learn how threat intelligence is meant to be used, and how to incorporate it into your organisation’s incident response process to significantly reduce the consequences of an attack against your organisation. The difference between an organisation that properly uses threat intelligence and one that does not is can amount in millions of dollars paid in blackmail or extortion that could otherwise have been avoided.Module 5: Incident Management
Onsite IT professionals and third-party incident responders must work hand-in-hand to minimize the consequences of security breaches. In this module, you will learn a formal process to engage external incident responders, provide them with the information that they need to hit the ground running, and how to manage incidents from the customer perspective. You will also learn how to write state-of-the-art incident reports that can be shared with senior management and the board, customers, and third parties.
|26-27 April 2018||Melbourne, AU||Enrol me!|