The top 9 Incident Response courses you need to take

1. Cyber Incident Response

The Cyber Incident Response Specialization will give students a high-level understanding of incident response processes. Students will learn about Incident Response from a practitioner perspective and they will walk away with valuable skills that they will be able to demonstrate, on demand.\n\nThis Specialization begins with a high-level discussion of what happens at each phase of responding to an incident, followed by a technical deep dive into some of the more exciting parts of memory, network, and host analysis and forensics. This Specialization is for anyone wishing to apply learned forensics and offensive knowledge such as ethical hacking to the incident response process...

2. Cyber Incident Response

The Cyber Incident Response course will give students an understanding of how incidents are responded to at a high level, as well as allow them to build important technical skills through the hands-on labs and projects. This course starts with a high-level discussion of what happens at each phase of responding to an incident, followed by a technical deep dive into some of the more exciting parts of memory, network, and host analysis and forensics. This course is for anyone wishing to apply learned forensics and offensive knowledge such as ethical hacking to the incident response process...

3. Incident Response for Cyber Professionals

4

(90)

Incident Response Course Syllabus Course Overview In this course you will learn how to use open source tools for incident response purposes.   This course utilizes first hand explanations and screencast demonstrations of how to use these tools in a step-by-step manner so you can start incident response work immediately on your own.    Table of Contents Course Overview - Introductory Lesson Incident Response - Incident response is an organized approach to addressing and managing the aftermath of a security breach or attack.  The goal is to handle the situation in a way that limits damage and reduces recovery time and costs. An incident response plan includes a policy that defines, in specific terms, what constitutes an incident and provides a step-by-step process that should be followed when an incident occurs. Cyber Attacks - Here we will cover CyberAttacks on Wi-Fi networks and over the web so you can understand how to respond to them.  Virtualization and Cloud Security - So virtualization can mean many things at different layers of the stack.   At the network layer you have VLAN's, MPLS networks and even SDN (Software Defined Network) technologies such as Openflow.    At the storage layer you have VSAN's.     At the Hardware and OS layer you have hypervisors for machine virtualization and containers for runtime virtualization and isolation.     Databases have even gotten in on the act using container technology.     Malware - In this section we will define Malware categories and characteristics and talk through protective countermeasures to keep networks, systems and data safe from compromise. ' Static Malware Analysis - Analyze malware statically in VM environments. Operational Security - Once we have a Risk Management program in place we need to implement operational security to manage the day to day aspects of security.    In this lesson you will learn about Operational Security Controls what they consist of and how they help us to incrementally manage risk on a daily basis. Lesson 7 - Disaster Recovery - While at first glance DR might not seem like a natural fit with cybersecurity after further analysis we realize that disasters are threats that can inflict much more damage than any hacker.   Here we will talk about DR planning, strategies and best practices.   Platform Hardening and Baselining - Minimizing the attack surface area of operating systems, databases and applications is a key tenet of operational security.   In this lesson you will learn about techniques for OS/DB and App hardening.   Lesson 9 - Advanced Perimeter Security - While many argue that with the advent of mobile technologies and the cloud the perimeter is dissolving, it will remain a key component in securing network resources for years to come.    Here we'll cover Load balancers, forward and reverse proxies, API Security Gateways,  Firewall rules and Unified Threat Management technologies.   IDS - Intrusion Detection technology is offered in multiple flavors.    They are either network based or host based and can be detective or preventive in nature.   Advanced IDS - Previously we've talked about IDS basic concepts.   Now it's time to cover advanced IDS architectures, standards and further explore the inner workings of statistical and Rule based IDS.  Snort and Bro - In this lesson you will learn how to use Snort and Bro NIDS/HIDS by example.      Honeypots and Honeynets - Luring attackers away from critical data and studying their behavior can help us to protect the data that matters most.   Let's found out how we can use honeypots to tie up attackers and find out what they are up to. Kippo SSH Honeypot Firewalls - In this lesson we will cover the evolution of firewalls and their capabilities.    Apache Security Logging - Apache is still the most popular web server by install base on the web.   Let's learn how to log malicious activities using Apache logging.       SIM - Management of logs is a key component of operational security.    These days the velocity, variety and volume of data collected via logs has catapulted log management into the realm of Big Data.   You will learn how to effectively manage these logs and derive useful security information from them.  Forensic Duplication Learn how to acquire a forensic duplicate using Linux based tool...

4. Cybersecurity Incident Handling and Response

4.5

(2,317)

This course covers the six phases of incident handling and responding as follows:0- Introduction: Includes the definition of an event, incident, as well as the difference between them1- Preparation Phase: Shows the elements of preparation and the team building, 2- Identification Phase:  Demonstrates where identification occurs and the assessment for identification3- Containment: Explains the deployment and categorization needed as well as the short/long- term actions taken4- Eradication: Stresses on restoring systems and improving defenses5- Recovery: Elaborates the validation and monitoring required for attacked systems6- Lessons Learned: Confirms the importance of meeting as a team to fix and improve and to share our experiences with othersThe course targets cybersecurity officers and incident handlers, and the material requires only basic IT knowledge and a little of cybersecurity background. It is worth noting that incident response is a structured approach to handle various types of security incidents, cyber threats, and data breaches. The incident response methodology aims to identify, contain, and minimize the cost of a cyberattack or a live incident. A well-built incident response (IR) plan can fix a potential vulnerability to prevent future attacks, but it is not the sum game. Response is a part of Incident Handling which in turn looks at the logistics, communications, synchronicity, and planning required to resolve an incident...

5. Technical Deep Dive with Incident Response Tools

The Cyber Incident Response course will give students an understanding of how incidents are responded to at a high level, as well as allow them to build important technical skills through the hands-on labs and projects. This course starts with a high-level discussion of what happens at each phase of responding to an incident, followed by a technical deep dive into some of the more exciting parts of memory, network, and host analysis and forensics. This course is for anyone wishing to apply learned forensics and offensive knowledge such as ethical hacking to the incident response process...

6. Cyber Security Incident Response Wannacry Ransomware

4.7

(78)

Wannacry has been one of the most famous ransomware in computer history (so far) which allows us to investigate how it worked and identify indicators of compromise. The goal of the course is not to protect against Wannacry, but to provide you with a methodology to be able to quickly assess the behavour of a suspicious application in a computer. The tools we are using in this course are free for personal use, but there are way more other solutions you can use for the same purpose. At the end of this training you will have a solid understanding how the ransomware works and how to protect you environment, also you will be able to use the tools to identify and analyse other malicious tools. You will not be a malware analyst, this is not the course for that. This course will give you the steps to be able to do incident response in a quick manner and see what areas you need to develop yourself using other courses. Deep malware analysis is a very interesting area, but not necessarily the part of the incident response team. There are companies specialized in malware analysis, or people specializing in malware analysis. One can spend hours, days, weeks, months analyzing a single malware. This course aims for quick response...

7. Planning and Implementing a Security Incident Response

4.4

(1,105)

This course is designed to help you manage an enterprise security incident, while avoiding common errors, increasing both the effectiveness and efficiency of your incident response efforts. After completing this course, students will be able to: Effectively prioritize the response to a security incidentBuild a computer security incident response team (CSIRT)Develop an incident response action planPost-incident activityThis course is designed to get you started as quickly as possible. There are a variety of self-paced learning activities. You will get: Video lectures on each topic explaining each concept thoroughly with examples (and Demonstrations where applicable)Review questions (quizz) at the end of each sectionFinal Exam at the end of the course - review questions to test your knowledge on the topics and concepts learned in the courseLinks to official Microsoft resources/blogs/videos for further documentationThis course is the 9th course from a series of 9 courses which address all aspects to become a Microsoft Cyber Security Professional. This cyber security track is designed to teach you, or fill in the knowledge gaps, all the aspects and technologies to become a successful cyber security professional. The entire track addresses mostly Microsoft security technologies, including the latest cloud services made available by Microsoft like: Microsoft Defender Suite, Office 365 security features and services, Microsoft Graph, Azure Active Directory Security and many more. Microsoft, Windows, Microsoft 365 and Microsoft Azure are either registered trademarks or trademarks of Microsoft Corporation in the United States and/or other countries. This course is not certified, accredited, affiliated with, nor endorsed by Microsoft Corporation...

8. Malware Analysis & Incident Response for IT Technicians

3.9

(417)

Over this course, we'll be covering some of the ways that you can prevent and respond to IT security incidents, such as a ransomware attack, on your organisation's network. Course topics include the following:* An explanation of the key differences between malware analysis and incident response* Known malware, online file analysis and tools that can be used to analyse running processes* Unknown malware and how to recognise suspicious files, using heuristic activity detection and vulnerability analysis* Incident prevention methods, including securing removable storage and an explanation of email filtering and analysis tools.* Incident response methods, such as escalation procedures and service priorities. Note that, in the real world, protecting against and reacting to security incidents is something that is unique to every organisation, taking into account its size and service priorities. For example, a company that hosts some websites internally may focus on getting them back online first, and then move onto getting internal staff back online, or vice versa. Before making any critical changes to your organisation's network, it is critical that that this is done in accordance with your company's policies, as this will ensure that incidents are resolved as smoothly as possible, and with the least amount of downtime and inconvenience to end users...