登录查看更多内容

How can you find the best incident response training?

由人工智能和领英社区提供技术支持

Incident response (IR) is the process of identifying, containing, analyzing, and resolving cyberattacks that affect an organization's systems, data, or operations. IR training is essential for developing the skills, knowledge, and confidence to handle various types of incidents effectively and efficiently. But how can you find the best IR training that suits your needs, goals, and budget? Here are some tips to help you choose the right IR training for you.

此文章中的业界达人

由社区从 10 条内容中精选。了解更多

Joas A Santos

Cyber Security Leader | Red Team | Author of Books | Speaker and Teacher
Luiz Fernando Nunes [PwD]

Cybersecurity Assistant at Kryptus | SOC | SIEM | Threat Hunting
Camila Barbosa

Cybersecurity Specialist | Offensive Security and Cyber Intelligence

1 Identify your learning objectives

Before you enroll in any IR training, you should have a clear idea of what you want to learn and why. Do you want to gain a general overview of IR concepts and best practices, or do you want to focus on a specific domain, such as network forensics, malware analysis, or threat hunting? Do you want to prepare for a certification exam, such as the GIAC Certified Incident Handler (GCIH) or the Certified Incident Response Manager (CIRM)? Do you want to improve your existing IR skills, or do you want to learn new ones? Having a specific and realistic learning objective will help you narrow down your options and select the most relevant and appropriate IR training for you.

添加您的观点

Joas A Santos

Cyber Security Leader | Red Team | Author of Books | Speaker and Teacher
举报内容
There are practical trainings and more theoretical ones on incident response, I recommend that for those who are starting out and want to delve deeper into incident response, go to training that teaches how to create an IR plan, for example. In addition, there is more practical training such as eCIR from elearnsecurtiy, which focuses more on hunting and some specific analyses.

已翻译

赞
Luiz Fernando Nunes [PwD]

Cybersecurity Assistant at Kryptus | SOC | SIEM | Threat Hunting
举报内容
Before enrolling in any Incident Response course, it is crucial to clearly identify your learning objectives. By adopting a reflective and practical approach, you can ensure that Incident Response training is targeted to your specific needs, thus maximizing the benefits gained throughout the course.

已翻译

赞
Camila Barbosa

Cybersecurity Specialist | Offensive Security and Cyber Intelligence
举报内容
I started my career in IR, so the big differentiator that helped me develop my learning skills was an already defined process. For example, I had the experience of using NSIT SP 800-61 Rev. 2 1 (Computer Security Incident Handling Guide). I took the Cert.br FHI (Fundamentals of Incident Handling) course. But I often say that both give you an idea of how to proceed step-by-step in each situation, but only day-to-day experience will really teach you how to handle each incident. But if it's affordable, invest in this development - after all, learning is always important. Cert.br has an advanced level Incident Handling course in addition to SANS.

已翻译

赞
Farukh Ismailov

Logistics Safety Engineer @ NCOC N.V. | NEBOSH IGC | IOSH MS | HSE Competency Assurance | Risk Management | BOSIET | H2S OPITO
举报内容
Before embarking on incident response (IR) training, it's crucial to define your learning objectives clearly. Determine whether you seek a broad understanding of IR fundamentals or desire specialized expertise in areas like network forensics or threat hunting. Consider if your aim is certification preparation, such as GCIH or CIRM, or skill enhancement. Clarifying your goals ensures you select training aligned with your needs, maximizing its relevance and effectiveness.

已翻译

赞

2 Evaluate the training provider

When evaluating a training provider for incident response, it's important to consider their reputation and experience in the field, curriculum and content, instructors and qualifications, delivery mode, cost and value, and support and resources. Researching the provider can be done by visiting their website, reading reviews and testimonials, asking for referrals or recommendations, or contacting them directly for more information. It's also beneficial to analyze how well the provider aligns with your learning objectives, how flexible and convenient their delivery mode is for you, whether they offer discounts or financial aid, as well as the type of resources they provide such as labs, exercises, quizzes, forums or mentoring.

添加您的观点

Joas A Santos

Cyber Security Leader | Red Team | Author of Books | Speaker and Teacher
(已编辑)
举报内容
There are thousands of training courses, but I have had good experiences with content from EC-COUNCIL such as ECIH, from eLearnsecurity, antisyphon training helps a lot and in Brazil there is the Digital Forensic Academy. Don't forget to evaluate the cost-benefit as well.

已翻译

赞

3 Compare different training options

Once you have identified your learning objectives and evaluated the training provider, you should compare different training options that meet your criteria. You can use a comparison matrix or a checklist to compare different aspects such as the duration and schedule of the training, the topics and skills covered, the learning outcomes and objectives, the assessment and evaluation methods, the certification or accreditation, and the feedback and reviews. Additionally, you should consider your own preferences and learning style, such as how you like to learn (through lectures, videos, readings, or hands-on exercises), how you like to interact (with instructors, peers, or independently), and how you like to pace yourself (fast, slow, or self-paced). By evaluating these factors in detail, you can weigh the pros and cons of each option and select the one that best fits your needs, goals, and budget.

添加您的观点

Joas A Santos

Cyber Security Leader | Red Team | Author of Books | Speaker and Teacher
举报内容
See the training focused on your current needs, if you want to better understand the IR process, buy training that focuses on your current need as a professional, when I started studying IR I needed to understand how the process is done and how a plan is structured, and For this reason, some free introductory courses were important.

已翻译

赞

4 Try before you buy

Before you commit to any IR training, you should try it out. There are a few ways to do this, such as watching a demo or signing up for a free trial. Additionally, you can attend a webinar or workshop related to the training, read a sample chapter or syllabus, or ask for a reference or testimonial from someone who has taken the course. Trying before you buy will give you an idea of the quality, content, and style of the training and whether it meets your needs.

添加您的观点

5 Review and revise

Finally, you should review and revise your IR training choice periodically. This means that you should monitor your progress and performance, and evaluate whether the training is meeting your learning objectives and outcomes. You should also seek feedback and guidance from your instructors, peers, or mentors, and identify any gaps or challenges in your learning. You should also be open to new opportunities and developments in the IR field, and update your skills and knowledge accordingly. By reviewing and revising your IR training choice, you can ensure that you are getting the most out of your investment and achieving your desired results.

添加您的观点

Norberto Lopes

VP of Engineering at incident.io ??
举报内容
A good way to review and revise is to constantly be in touch with the latest developments. Either through newsletters, podcasts, or email updates. It has a very low barrier to entry and potentially a great return on investment. Keeping up to date also allows you to bring new ideas into the best IR training possible: be involved in incident response at work. A daily or even weekly read/listen will provide good food for thought for when you're in an incident.

已翻译

赞

6 Here’s what else to consider

This is a space to share examples, stories, or insights that don’t fit into any of the previous sections. What else would you like to add?

添加您的观点

John H. Upchurch [KCSP┃DUO Security Admin]

SEEKING REMOTE career opportunities where I can contribute value: Identity and Access Management (IAM)┃IT Leadership┃[15+ Years of Experience: Helpdesk ? Desktop Support ? Networks ? Healthcare IT ? MFA ? Cybersecurity]
(已编辑)
举报内容
#??0??5?? ?? Host a Question and Answer session, plus tell a story, and add in some humor: Q: How did the hacker get in? A: Someone left their Windows open. Q: How did hacker get away? A: Used the backdoor and ransomware. Q: Why couldn't the witness identify the hacker? A: Used Spyware and Subnet Mask to hide identity. Q: How did the hacker get caught? A: CSIRT used a Bug, to lure in Scattered Spider, and they got stuck in the Web. A2: The CSIRT used Python to Byte...well, let's just say that a little bird (a.k.a. Parrot) did some squawking, but now they are done talking. Q: What happened to the hacker after getting caught? A: Police made them WannaCry by clearing their cookies. A2: FBI made their Heartbleed by deleting their cache.

已翻译

赞
Luke H.

IT Administrator | Security+, Network+, Linux+, A+
举报内容
Training programs that provide networking opportunities with other cybersecurity professionals can be valuable. Networking allows you to exchange ideas, share experiences, while also building a professional network within the industry.

已翻译

赞
ArulPragash Sockalingam
举报内容
Previous incidents can be used as simulations too so that the team can keep their skills up to date, or even better - try new things to speed up recovery. If processes have changed within the company these simulations can help provide perspective on fine-tuning any existing practices. You can also come up with any creative scenarios as well and run drills to make incidents more complex and challenging.

已翻译

赞

Incident Response

+ 关注

给文章评分

我们借助人工智能创建了此文章。您认为这篇文章怎么样？

很棒不太好

举报此文章

查看全部

How can you find the best incident response training?

1

2

3

4

5

6

1 Identify your learning objectives

2 Evaluate the training provider

3 Compare different training options

4 Try before you buy

5 Review and revise

6 Here’s what else to consider

Incident Response

给文章评分

感谢您的反馈

更多Incident Response相关文章

更多相关阅读内容