Cybersecurity · Advanced level

Advanced level · Module 3 of 6 · 22 guided hours

Incident Response and Digital Evidence

Prepare for, handle and learn from incidents, preserving evidence properly.

Learning objectives

  • Write an incident response plan aligned with NIST SP 800-61 Rev. 3
  • Triage, contain and eradicate incidents
  • Preserve digital evidence correctly
  • Run post-incident reviews and tabletop exercises

Topics

  • incident response plan
  • roles and communication
  • triage and severity
  • containment and eradication
  • evidence and chain of custody
  • lessons learned and tabletop exercises

Lessons

  1. Lesson 1 Incident Response Planning

    Prepare roles, contacts and procedures before an incident happens.

    NIST SP 800-61 Rev. 3rolescommunication planplaybooks

  2. Lesson 2 Triage, Containment and Eradication

    Handle an incident from first report to removal of the threat.

    triageseveritycontainmenteradication and recovery

  3. Lesson 3 Preserving Digital Evidence

    Collect and protect evidence so it remains reliable.

    volatile evidencelogs and imageschain of custodywhen to call specialists

  4. Lesson 4 Lessons Learned and Tabletop Exercises

    Improve after incidents and test plans before they are needed.

    post-incident reviewblameless culturetabletop exerciseimprovement actions

Practical activity

Write an incident response plan for the case NGO and run a tabletop exercise on a business email compromise.

Expected outcomes

  • A tested incident response capability
  • Sound evidence handling

Assessment

Incident response plan and tabletop exercise report assessed.

Taught live by an instructor — online or in person. Free course lessons are for self-study and do not lead to a certificate — see registration options.