LDR553: Cyber Incident Management

Section 1 focuses on understanding incidents, standardizing language, and defining objectives. You will gather information, set clear goals for the Incident Management team, and assign initial responsibilities. This section introduces the Cyber Incident Management Tool Kit (CIMTK) and explores team composition and stakeholder communication strategies.

Section 2 explores interactions with attackers and remediation strategies. You will learn approaches that can buy time to address issues and prevent data leaks. You will categorize network and data damage, prioritize remediation tasks, and eliminate vulnerabilities, developing skills to create comprehensive incident reports and conduct Root Cause Analysis.

Section 3 explores training incident response teams and the broader organization. You will learn to develop effective training programs based on organizational maturity and specific needs. We examine integrating Cyber Threat Intelligence (CTI) into incident response efforts and developing strategies for managing supply chain and third-party compromises.

In section 4 you will gain a comprehensive view, visualizing incident timelines and addressing complex attack scenarios. You will learn to create timelines tailored to different audiences, understand credential theft attacks and the MITRE framework, and explore Business Email Compromise (BEC), as well as cloud-based attacks and management console breaches.

Section 5 teaches best practices in advanced incident management challenges and emerging threats. You will explore team improvement, KPIs, and efficacy metrics. The section examines AI applications, including Large Language Models and Generative AI. You will gain in-depth knowledge of ransomware incidents and participate in a comprehensive capstone exercise.