Creating Computer Security
Incident Response Teams

Course Overview

This one-day course provides managers and project leaders with a detailed overview of the key issues and decisions that must be addressed in establishing a CSIRT.

The course is taught by one of the most prominent Network Security and Incident Response experts in the world, Dr. Klaus-Peter Kossakowski. He will share insights from his years of experience creating and working with CSIRTs worldwide. Dr. Kossakowski was the first one to license the source material from the CERT Coordination Center and has adapted it for an international audience.

Who should attend?

The course benefits people who want to understand the difficulties in establishing incident response teams and the issues they will face being tasked with such implementation. Past attendees have included information technology project managers as well as senior managers.

Many participants build on this course by taking Managing Computer Security Incident Response Teams , a three-day course. It gives managers a detailed picture of many primary challenges that arise in leading an incident response team and then reveals time-tested techniques and solutions for effectively dealing with them. By taking the course attendees can effectively learn to build up their own team and understand the operational issues their team will face once operational.

Course Objectives

After taking this course, you will understand the important issues for planning and implementing a new CSIRT. As part of the course, you will develop an action plan that can be used as a starting point in planning and implementing your CSIRT.

• Strategically plan the development and implementation
• Understand the variety and level of services that can be provided
• Be familiar with issues associated with assembling a responsive, effective team
• Identify policies and procedures that should be established and implemented

Course Topics

The course presents a realistic look from a strategic planning and implementation perspective. Important topics covered include:

• Prerequisites to planning a CSIRT
• CSIRT mission, objectives, and level of authority
• Funding issues and strategies
• CSIRT organizational issues and models
• Range and levels of provided services
• Hiring and training initial CSIRT staff
• Implementing CSIRT policies and procedures
• Requirements for a CSIRT infrastructure
• Collaboration and communication issues

Course Availability

Dr. Klaus-Peter Kossakowski is available to teach the Creating Computer Security Incident Response Teams course at your site (as long as it resides in the networked world!).

PRESECURE holds periodic sessions of this courses in North America and Europe.

For public course offerings please refer to our schedule.