Incident handling: from preparation to recovery
You learn the defence team’s steps in a security incident (preparation, detection, classification, containment, eradication, recovery and lessons learned) and apply each step to a small incident.
Level 201 · 16 lessons · 15 practice labs
Lessons
Preparation
- The incident lifecycle: NIST and ISO approaches
- The incident response plan and roles
- Contact lists and external stakeholders
- The response kit: tools, access, templates
- Short task: write a one-page response plan for a small company
Detection and classification
- Declaring an incident: when, and who does it
- Severity classification and impact
- Preserving evidence: collect first, change later
- Keeping an incident log
- Short task: classify three incidents by severity and justify it
Response
- Containment options: short and long term
- Eradication: removing persistence and the way in
- Recovery and validation
- The lessons learned meeting and report
- Notification duties: regulators and affected people
- Capstone: handle a compromised web server incident from start to finish
Practice labs
- Match the roles in the response plan to people: Assign incident manager, technical lead, communications lead and scribe from a given staff list and name their deputies.
- Write a one-page response plan for a small company: Prepare a one-page plan for Ayçiçeği Gıda with declaration criteria, roles, contact list and the steps of the first hour.
- Test the response kit and find what is missing: Try the kit’s tools, access details and templates one by one in a drill scenario, find the three items that fail and write the corrected list.
- Classify three incidents by severity: Use the severity matrix to score the impact and urgency of three incidents and write each grade with its reason.
- Decide whether an alert warrants declaring an incident: Compare a record of unusual access to the customer database against the declaration criteria and write your decision and who you inform.
- Re-grade a developing incident as new evidence arrives: Record how the grade changes as findings arrive in three stages, naming the role brought in and the notification deadline at each step up.
- Keep an incident log entry in the right form: Enter five given actions in the incident log with time, person, action and result columns.
- Collect volatile evidence before changing anything: On the compromised lab server save processes, open connections and sessions in the right order, hash the files and record them in the log.
- Prove the integrity of evidence with a chain of custody: Fill in hash, time and hand-over records for the logs and disk copy you collected, and catch from a hash mismatch that one copy was altered.
- Separate short-term from long-term containment options: Sort eight measures into immediate and lasting lists and note the business impact of each in one word.
- Close the way in and the persistence on a web server: Find the web shell in the upload directory, the added cron line and the open upload flaw, remove all three and verify with a rescan.
- Handle a compromised web server incident from start to finish: Carry out detection, evidence collection, containment, eradication and validated recovery in order, logging every decision with its time.
- Find from a table who must be notified and when: Compare notification deadlines to the regulator and affected people for a personal data incident across examples from different countries.
- Write the agenda and findings of a lessons learned meeting: Draw from the incident log what went well, what was delayed and the root cause, and write three blame-free improvement items.
- Prepare the notifications to the regulator and to customers: For a data breach at Mercanköşk Otelcilik write two separate texts covering what is known, what is not and the measures taken, and show the deadline is met.
About this course
You learn the defence team’s steps in a security incident (preparation, detection, classification, containment, eradication, recovery and lessons learned) and apply each step to a small incident.
What you will learn
- Preparation
- Detection and classification
- Response
Prerequisites
Finishing the level 101 courses of the same path, or knowing those topics, is enough.
Lab environment
Lessons run in your own Kali Linux terminal in the browser, connected to a private lab network. Nothing to install.
Frequently asked questions
- Is this course right for my level?
- The course is at level 201; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.