-: Welcome to domain three, Cyber Incident Response.
Now what are we gonna cover in this section?
Well, we're gonna talk about the
phases of an incident response.
We'll talk about creating an incident response team,
how to classify an incident, analyzing your network events,
and detecting network probes and attacks.
Then we're gonna move on into investigating
the issues on a host or server,
investigating services and applications,
and then we're gonna move into some digital forensic stuff,
where we're gonna talk about building
a basic forensic toolkit, the capabilities
of different forensic tools, both on the mobile side,
as well as on the network or host side,
and we're gonna talk about how
to conduct a forensic investigation.
And after we're done with all that,
I've even gonna walk you through how to
collect a forensic image using software
that you can download for free,
or using stuff that's built in to the Linux and Unix OS.
So, what is a cyber incident response?
Well, that is the actions you're gonna take
in response to a security incident or event.
And really when we put it simply,
it's just an organized approach to understanding
what the incident has occurred, mitigating the negative
effects of that incident, planning how we're gonna recover
from it, and investigating the root cause
to prevent it from happening again.
That's all we do inside of a cyber incident response.
Really easy to say, really hard to do.
So what's the bottom line?
Well in this section, we're gonna focus
on the high-level concepts of how to develop
a cyber incident response program,
and how your incident response team should operate
during the cyber incident, including
basic digital forensics and associated toolsets,
as well as doing basic analysis.
And then, we'll be able to be ready
to respond to any cyber event that
we get as a cyber security analyst.