Fundamentals of Cyber Incident Handling

📋 Course Outline

1. Incident Handling Definition and Scope
2. Incident Handling Value and Goals
3. Cyber Kill Chain Stages
4. Incident Response Lifecycle
5. Preparation and Readiness
6. Protective Controls and Hardening
7. Detection and Initial Analysis
8. Incident Timeline and Triage
9. Investigation and IOC Usage

📖 1. Incident Handling Definition and Scope

🔑 Key Concepts & Definitions

• Event : An event is an action occurring in a system or network.
• Security incident : A security incident is an event that has negative consequences.
• IT security incident : An IT security incident is an event with a clear intent to cause harm performed against a computer system.
• Incident handling : Incident handling is a clearly defined set of procedures used to manage and respond to security incidents in a computer or network environment.
• Incident handling plan : An incident handling plan is a comprehensive plan that covers multiple incident types and the steps to identify, contain, eradicate, and recover.

📝 Essential Points