Explain Incident Response Activities

---

Goals

• Explore incident response planning concepts
• Understand incident response activities
• Explore post-incident activities
• Review incident response procedures
• Review legal concerns in incident response

Explore Incident Response Planning

• Incident Response (IR)
  • NIST SP 800-61
• Common Incident Response Components
• Incident Detection and Analysis
• Triage and Incident Response Concepts
• Incident Response Training and Testing
  • conduct cross-functional training
  • review lessons learned/after action reports
  • tabletop exercises
  • test incident response
    • pen test
• Post-Incident Activities
• Business Continuity and Disaster Recovery (BC-DR)

Perform Incident Response Activities

• Incident Response Procedures
  • Indicators of Compromise (IoCs)
  • Security Orchestration, Automation, and Response (SOAR)
• Digital Forensic Concepts
  • Digital Forensics
  • Digital Forensics Process
  • Forensic Acquisition
• Legal Process Requirements
  • Evidence Preservation
  • Chain of Custody
  • Legal Hold
  • e-Discovery
• Incident Impact Analysis
• Containment and Recovery Concepts
  • IR Containment
  • Reimaging
  • IR Recovery
  • Remediation
  • Compensating Controls