Cyber incident management and first response

Introduction to security incident management

• Understanding what a security incident is and its impact on the business
• Overview of common threats (ransomware, phishing, account compromise)
• Roles and responsibilities within a response team
• Incident lifecycle: detection, analysis, containment, eradication, recovery

Methodology and tools

• Frameworks and best practices (ISO 27035, NIST, ANSSI)
• Detection and correlation tools (SIEM, EDR, system logs)
• Incident classification and prioritisation
• Documentation and traceability of actions taken

Incident response procedures

• Triage and escalation procedures
• Containment and isolation strategies
• Digital evidence preservation
• Internal and external communication during an incident

Case studies and practical exercises

• Ransomware attack scenario
• Administrator account compromise scenario
• Team-based simulated incident response
• Debriefing and lessons learned

Real-time management

• Setting up a crisis cell (war room)
• Coordination between technical, legal and communications teams
• Managing deadlines and priorities in an emergency
• Interaction with authorities and external providers

Post-mortem analysis

• Root cause analysis
• Identifying areas for improvement
• Writing an incident report
• Knowledge sharing and procedure updates

Crisis management plan

• Designing and structuring a cyber crisis management plan
• Business continuity and recovery plans
• Regulatory obligations and incident notification
• Simulation exercise (tabletop exercise)

Wrap-up session

• Summary of course learnings
• Developing a personalised action plan
• Overview of certifications and CPF procedures
• Q&A