Secu2: Incident response

Topics

Basic incident response procedure

• 5-phase model
• What is only possible internally? What can be outsourced?
• Dos and dont's (unknown tools, "blaming", etc.)

Preparation: Incident readiness

• Basic tools
• Personal preparation ("know your tools, know your procedures")
• Organizational preparation
• Technical preparation
• Analysis of the existing network ("baselining", structure, etc.)

Attack detection

• Working methods of hackers
• Anti-forensic measures and what can still be seen
• Warnings from third parties
• IPS, SIEM, etc.

Defensive measures and clearing up

• Importance of people when protecting systems
• Concentration on tools
• Limits of IPS, SIEM, AV and firewall

Technical requirements

Basic knowledge of networks and Linux 

Duration

Three days