OffSec IR-200 - Foundational Incident Response (OSIR) - Self-paced

Course subjects

Incident Response Overview

• Introduces the concepts of incident response with the main focus being NIST Special Publication 800-61

Fundamentals of Incident Response

• The roles and responsibilities of incident response teams

• The main frameworks used by incident responders (CREST, SANS, NIST)

Phases of Incident Response

• NIST SP800-61 provides a four-phase model of Incident Response

• Describing what each phase comprises

Incident Response Communication Plans

• The value and contents of incident response communications plans

• Review examples of good and bad external communications

Common Attack Techniques

• Opportunistic attacks

• Targeted attacks

Incident Detection and Identification

• Detection of malicious activities

• Analysis of malicious activities

Initial Impact Assessment

• The first thing to do when an incident occurs

• How to conduct an initial assessment of the scope and impact of the incident

Digital Forensics for Incident Responders

• Forensic measures and evidence handling considerations

Incident Response Case Management

• Case management theory with an IRIS lab

Active Incident Containment

• How to isolate and neutralise detected threats

• Explore techniques such as design-led isolation and dynamic containment during incidents

• Isolation techniques, containment strategies, and their implications for businesses

View the full syllabus here.