Introduction

• Courseware Materials
• Who is this class for?
• What is the purpose of this course?
• What information will be covered?
• The Exam 

Module I – Incident Handling Explained

• Security Events
• Logs
• Alerts
• What is an Incident?
• Security Incident
• Indication of Compromise
• What is Incident Handling?
• Difference between IH and IR
• Common Tools
• IPS vs WAF
• SOC
• Six Step Approach to Incident Handling 

Module II – Threats, Vulnerabilities and Exploits

• Overview
• Vulnerabilities
• Exploits
• Threat
• Incident Classification 

Module III – Preparation

• Overview
• Policies & Procedures
• The Team
• Identify Incident Handling Team
• Roles of the Incident Handling Team
• IH Team Makeup
• Team Organization
• Incident Communication
• Incident Reporting
• Incident Response Training and Awareness
• Underlining Technologies
• Anti-virus
• SEIM
• User Identity
• Ticketing Systems
• Digital Forensics
• eDiscovery
• Data Backup and Recovery
• Underlining Technologies
• Technical Baselines
• System Hardening
• Summary
• Module IV – First Response
• Overview
• Responder Toolkit
• Responder’s System
• What to look for
• Attention
• Volatility
• First things first
• Review
• Goal
• Challenges
• Categorize Incidents
• Incident Signs
• Basic Steps
• Receive
• Examples of Electronic Signs
• Examples of Human Signs
• Analyze
• Analysis
• Incident Documentation
• Incident Prioritization
• Incident Notification 

Module V – Containment

• Overview
• Containment
• Goals
• Delaying Containment
• Choosing a Containment Strategy
• On-site Response
• Secure the Area
• Conduct Research
• Procedures for Containment
• Make Recommendations
• Establish Intervals
• Capture Digital Evidence
• Change Passwords 

Module VI – Eradication

• Overview
• Eradication
• Goals
• Procedures for Eradication
• Determine Cause
• Procedures for Eradication 

Module VII – Recovery

• Overview
• Recovery
• Goals
• Procedure for Recovery 

Module VIII – Follow-Up

• Overview
• Follow-up
• Goals
• Procedures of Follow-up