Cybersecurity Incident Command with Gerard Johansen

The Cybersecurity Incident Command course is designed to provide students with the foundational concepts and techniques necessary to manage a cybersecurity incident.

The focus is on building knowledge and skills in the operational and strategic levels of incident response such as crisis communications, crafting containment and eradication plans and managing the various teams leveraged during an incident.

Students will first be exposed to incident command fundamentals. From here, they will be guided through the various stages of incident response activities such as properly scoping an incident response, addressing escalations, crafting a containment plan, removing the threat actor from the network, and returning to normal. Throughout this process, they will also be shown how to incorporate technical actions such as digital forensics and network modifications in response to an incident. In addition to the technical aspects, students will also be instructed to address the operational concerns in incorporating various business units such as legal, senior management, marketing, and facilities during an incident.

To reinforce these concepts, students will work through a realistic incident scenario during which they will be required to apply the concepts taught using the IRIS-DFIR platform and document templates.