Security Incident Response Fundamentals

On this accelerated GIAC Security Incident Response Fundamentals course, you’ll gain an understanding of what an Incident is and how this approach may differ in an ICS Environment.

The ICS Security Incident Response Fundamentals course provides those at Practitioner or equivalent level with an understanding of the current cyber incident response challenges facing their ICS environments, including an understanding of how to best protect and support their organisations cyber incident response process and provide an understanding of the stages of the IR process, including the information required to be able to create an effective IR plan (based upon the ICS4ICS processes).

This course also benefits those participating in or engaging with an ICS Incident Response team for the first time, requiring vital knowledge to manage the day-to-day running of all aspects of security incident response for these environments.

In just 2 days, you’ll also learn how to:

• Distinguish between an incident and an event
• Understand the 6-stage ICS incident response lifecycle
• Identify key roles in an ICS IR team
• Navigate legal and regulatory aspects of cyber incident response
• Handle various types of incidents effectively
• Develop and implement an ICS-specific IR plan (based on ICS4ICS)

Through Firebrand’s Lecture | Lab | Review methodology, you’ll get certified at twice the speed of traditional training and get access to courseware, learn from certified instructors, and train in a distraction-free environment.

Audience

This course is ideal for:

• Anyone new to Cybersecurity in an ICS Incident Response environment
• Non-ICS staff who need to understand ICS terminology and how it differs from their current roles
• Professionals working in an ICS environment, including:
  • Site/Asset Operators
  • Procurement/Contract Staff
  • Supply Chain Staff
  • Site/Asset IT
  • Support Engineers
  • Site/Asset Physical Security/Facilities Manager Staff

Module 1: Introduction to the Incident Handling Process

• What is an Incident and an Event and how do they differ?
• What is Incident Response?
• The challenges of ICS Incident Response
• The IR lifecycle

Module 2: Preparation

• Obtaining Leadership support
• ICS IR Plans
• Who gets involved?
• What makes the CSIRT?
• Jump Kit and Grab Bags

Module 3: Identification

• Classification Levels
• Managing the Information Flow
• Evidence

Module 4: Containment

• What is Containment?
• Short-term Containment
• Long-term Containment
• Investigations

Module 5: Eradication

• The main aims of eradication
• Remove or restore?
• Improvement after

Module 6: Recovery

• Recovery Objectives
• Validation
• Post-Incident Monitoring

Module 7: Lessons Learned

• The Report
• Management Considerations
• Bringing it all together

There are no prerequisites for this accelerated course.