Description

About this course

This course is part of the Microsoft Professional Program in Cybersecurity.

This course is designed to help you manage an enterprise security incident, while avoiding common errors, increasing both the effectiveness and efficiency of your incident response efforts.

What you’ll learn

After completing this course, students will be able to:

• Effectively prioritize the response to a security incident
• Build a computer security incident response team (CSIRT)
• Develop an incident response action plan
• List appropriate post-incident activities

Prerequisites

A understanding of the current cybersecurity ecosystem.

Estimate Time : 8-16 hours

Module 1

• Introduction
• What is threat modelling?
• The need for incident response plans
• Assess vulnerabilities in your environment
• Establish routine monitoring and review of network traffic and system performance
• Log analysis

Module 2

• Incident Response Policy, Plan, and Procedure Creation
• Creation of a CSIRT
• Establish CSIRT team roles
• Establish governing policy

Module 3

• Initial assessment of incident
• Attack vectors
• What are false positives and false negatives?
• Determine the nature of the attack
• Identify the systems that have been compromised
• Choosing a containment strategy

Module 4

• Post-incident activity
• Protect the evidence while restoring functionality
• Recommendations and Lessons learned
• Security incident report

Philip E.Helsel
Senior Content Developer, Learning eXperiences Team
Microsoft

Philip Helsel is a Senior Content Developer with the Microsoft Learning team, where he is currently focused on building IT Professional courses for Windows 10, Hyper-V, and Configuration Manager. He is also the planner for a new Microsoft Virtual Academy Enterprise Security channel.

Before joining Microsoft, he was a Pre-Sales Engineer and trainer at Fast Search and Transfer, a Pre-Sales Engineer at Oracle Corporation, and Sun Microsystems. He also served as a Captain in U.S. Army.

Phil has a BS degree in Mathematics & Physics, and a Masters in Computer Science. Mr. Helsel also has a number of certifications including his Microsoft Certified Trainer (MCT), MCITP in Server Virtualization, CCNA, VCP5, CISM, Security+, Network+, and others.

Kimberly Rasmusson-Anderson
Senior Content Developer, Learning eXperiences Team
Microsoft

Kimberly is a Senior Content Developer with the Microsoft Learning team.

She is responsible for building IT Professional courses. She is also the project manager for a new Microsoft Virtual Academy Enterprise Security channel.

Prior to this, Kimberly was a technical lead in the Microsoft Customer Service and Support organization.

Additional information

Certificate

When you enrolled into this course you will automatically get a Certificate of Participation for completing the course. An example is provided below.