Certified Information Security Manager (CISM) Cert Prep (2022): 4 Incident Management
2h 21mAdvanced2022-09-08
Authors
Mike Chapple
Teaching Professor at the University of Notre Dame
Course details
Even the best security controls aren't foolproof. That's why security professionals need a solid incident management plan. The fourth domain of the Certified Information Security Manager (CISM) exam—Information Security Incident Management—tests your mastery of this important topic. Take this CISM Cert Prep course to study for the exam and gain a deeper understanding of how your team should react to and resolve a security incident, whether it's an attack on your network, an email-born virus, or data theft. Instructor Mike Chapple explains how to identify, triage, and respond to an event, minimizing the damage and maximizing your ability to find the root cause, so you can resume normal operations. He also provides tips for logging and monitoring ongoing security-related events. Each topic maps to a relevant objective from the CISM certification exam.
Skills covered
Governance, Risk, and ComplianceDevOps FoundationsDevOpsCert PrepCybersecurity
Concepts
Introduction
- Incident management
- What you need to know
- Study resources
Incident Response
- Role of a manager in incident response
- Creating an incident response team
Assessing Incidents
- Identifying and classifying security incidents
- Threat classification
- Zero days and the advanced persistent threat
- Determining incident severity
Incident Response Process
- Build an incident response program
- Incident communications plan
- Incident identification
- Escalation and notification
- Mitigation
- Containment techniques
- Incident eradication and recovery
- Validation
- Post-incident activities
- Incident response exercises
Incident Symptoms
- Network symptoms
- Rogue access points and evil twins
- Endpoint symptoms
- Application symptoms
Forensic Investigations
- Conducting investigations
- Evidence types
- Introduction to forensics
- System and file forensics
- File carving
- Creating forensic images
- Digital forensics toolkit
- Operating system analysis
- Password forensics
- Network forensics
- Software forensics
- Mobile device forensics
- Embedded device forensics
- Chain of custody
- Ediscovery and evidence production
- Exploitation frameworks
Logging and Monitoring
- Security information and event management
- Continuous security monitoring
Conclusion
- Continuing your studies