What are the best cybersecurity incident response resources for you?

1 Frameworks and standards

When developing a robust incident response plan, one of the first steps is to adopt a framework or standard that defines the best practices and processes for managing cybersecurity incidents. Depending on your industry, size, and needs, there are many options available. The National Institute of Standards and Technology (NIST) Special Publication 800-61 provides a comprehensive and detailed guide for incident response, while the ISO/IEC 27035 standard outlines the principles and phases of incident response. The SANS Institute Incident Handler's Handbook offers a practical and concise overview of the incident response lifecycle with tips and templates for various scenarios. Additionally, the Center for Internet Security (CIS) Critical Security Controls identifies essential actions and controls to prevent and respond to cybersecurity incidents.

2 Online courses and certifications

Enhancing your cybersecurity incident response skills and knowledge can be done by taking online courses and certifications. These courses and certifications provide valuable insights, case studies, and hands-on exercises to apply learning to real-world situations. Popular and reputable online courses and certifications include the Cybersecurity Incident Response MicroBachelors Program from edX, the Cybersecurity Incident Response and Threat Hunting Professional (CIRP) certification from EC-Council, the Certified Incident Handler (CIH) certification from GAQM, and the Incident Response Specialization from Coursera. Each of these offers different levels of knowledge ranging from fundamentals to advanced methods and tools.

3 Blogs and podcasts

If you want to stay informed on the latest trends, news, and best practices in cybersecurity incident response, following some influential and informative blogs and podcasts is a great idea. For instance, The Incident Response Consortium blog offers articles, white papers, and webinars on various topics related to incident response. The SANS Internet Storm Center podcast provides daily updates and analysis on current threats and incidents. The CyberWire podcast covers the latest news and events in cybersecurity as well as interviews with leaders and innovators. Lastly, The Cyber Incident Response podcast explores the challenges and solutions for cybersecurity incident response, as well as stories from incident responders.

4 Tools and platforms

Finally, you can leverage some of the best tools and platforms to automate, streamline, and improve your cybersecurity incident response process. These tools and platforms offer features and functions that can help you detect, analyze, respond, and report on cybersecurity incidents. Plus, they provide the ability to collaborate and communicate with your team and stakeholders. Popular tools and platforms for incident response include the Elastic Security platform, IBM Security Resilient platform, Splunk Enterprise Security platform, and Volatility framework. The Elastic Security platform combines endpoint protection with threat detection and incident response capabilities. The IBM Security Resilient platform enables you to orchestrate and automate incident response workflows. The Splunk Enterprise Security platform provides a SIEM solution to monitor, analyze, respond to security events, and generate reports for compliance. The Volatility framework is an open source tool for memory forensics and analysis on various operating systems.