Cyberattacks have a rapid disruptive capability, with potentially serious consequences. Therefore, they must be managed early and effectively. This training allows IT teams and SOC analysts to acquire an incident management methodology, familiarize themselves with detection and learning tools, and practice realistic simulations to formulate a better response at the time of an incident.
Day 1 - Identification and management of cyber incidents
Morning – 9 AM to 12:30 PM
Introduction to Security Incident Management
• Definition and classification of cyber incidents.
• Lifecycle of a cybersecurity incident.
• Examples of recent attacks and impacts on businesses.
Methodology and Tools for Incident Detection
• Monitoring tools and anomaly detection (SIEM, EDR, IDS/IPS).
• Roles and responsibilities of teams in charge of responding to incidents.
• Identification of log sources and preliminary analysis.
Afternoon – 1:30 PM to 5 PM
Incident Response Procedures
• Steps for containment, eradication, and recovery.
• Coordination with internal and external stakeholders (ANSSI, CERT).
• Best practices for documenting and escalating an incident.
Case Studies and Hands-on Exercises
• Case study of a ransomware attack and adequate response.
• Exercise for detecting an incident in real logs.
Day 2 - Incident Simulation and Crisis Management Plan
Morning – 9 AM to 12:30 PM
Introduction to Security Incident Management
• Real-time incident management exercise.
• Cyberattack simulation with participants taking the lead.
• Implementation of containment and eradication procedures.
Post-Mortem Analysis and Feedback
• Identification of errors and areas for improvement.
• Writing an incident report and action plan.
Afternoon – 1:30 PM to 5 PM
Development of a Cyber Crisis Management Plan
• Definition of roles and responsibilities.
• Internal communication and with external partners.
Lessons Learned and Best Practices
• Summary of acquired knowledge.
• Best practices and continuous improvement plan.
4,500 € before tax
Objectif
Training teams to detect a cyber incident and respond effectively
Public cible
IT teams, SOC, system administrators
Niveau
Intermediate / Advanced
Durée
Two (2) days
This training is offered in partnership with Académie Cyber, an accredited organization. It is Qualiopi certified and eligible for CPF.
Application security and DevSecOps
A simple bug can be an entry point for a cyberattack. Make sure your developers implement the best practices from the OWASP Top 10.
Cloud environment security (AWS, Azure, Google Cloud)
Cloud solutions (AWS, Azure, Google Cloud…) open the door to many cyber risks. Protect your business from data leaks or attacks on APIs.
