What are the best ways to keep your incident response and forensics skills current?

Follow security researchers and first-line defense security vendors on social media, blogs, and newsletters to stay up-to-date on the latest threats and trends.

Social media and research teams are great sources to follow for current news in the cybersecurity industry. Top research teams you should follow would include RiskIQ, Unit 42, Mandiant, Symantec, and Google's TAG (Threat Analysis Group) have up to date and in depth thoughts on recent cybersecurity events. LinkedIn and Twitter are currently pretty good locations to see generic news in the industry.

There are many different online groups on many websites, including LinkedIn. The best groups are more secretive in nature and have vouch only systems for joining. You must be invited. Once invited, the conversations held in these more private forums are usually much more substantial than some more public forums.

Many folks with a certification, such as Security+ it CISSP, need continuing education to keep the cert. Whether you have a cert or not, it's worth looking for online education that includes CPE credits. Making it a habit to take this type of training will make it easier once you do get a cert to keep it. You can also feel better about the training as it has hit a certain threshold to be considered for CPE credits.

The best way to learn by far is through responding to actual security incidents themselves. Nothing will give you more knowledge than being forced to learn something in a high pressure environment under time constraints. That being said, you will learn a lot more working as an IR consultant for multiple customers than working in house planning for an attack that never comes. As a consultant, you may see multiple ransomware cases in a single month, whereas it may never happen while working in-house. You have to be where the “action” is if you really want to get good at this job.

Continuing education is key to staying on top of your game. Pet projects at home, Labs and Cyber Range live fire activities are some the best opportunities to sharpen your skills. For defensive security, Let's Defend is a great lab environment. Cyber Ranges are usually offered through local colleges or through large companies. Cyberbit is a top one and provides live exposure to malware in an online environment and can score individuals to see how they responded and what they found.

Many companies offer cyber ranges that can be customized scenarios tailored to the needs of your industry or company. If your organization has enough of a training budget, it may be helpful to employ one these training experiences for your team.

In my experience : - Continuous learning, attending conferences, connecting with peers… - Table Top simulations on recent security events (Practice your IR plan), how the teams work together cross functionally and report on such matters). Both for execs and Technical teams. - Identify strengths and improvement opportunities - Rinse & Repeat the process as semi-annual or annual event to test proficiency of your formal response team and to keep your data incident response plan updated.

How can we miss out on social media? Telegram, Clubhouse, even LinkedIn and so many other platforms that give security news in easily consumable and quickly assimilable formats. We do not have all the time in the world to read lengthy blogs or listen to small talk on podcasts.