Managing Computer Security
Incident Response Teams

Course Overview

This three-day course gives managers a detailed picture of many primary challenges that arise in leading an incident response team and then reveals time-tested techniques and solutions for effectively dealing with them.

The course is taught by one of the most prominent Network Security and Incident Response experts in the world, Dr. Klaus-Peter Kossakowski. He will share insights from his years of experience creating and working with CSIRTs worldwide. Dr. Kossakowski was the first one to license the source material from the CERT Coordination Center and has adapted it for an international audience.

Who should attend?

The course benefits people who want to understand how incident response teams work and the issues they face. Past attendees have included information technology managers, constituents, media-relations staff, legal counsels, as well as senior managers.

Many participants build on this course by taking Fundamentals of Incident Handling, an introductory five-day course. It is designed to deepen team members' knowledge of the skills and methods needed to better operate the daily activities of an incident response team. By taking the course attendees can effectively learn to train their own team and understand the more operational issues their team faces.

Course Objectives

After taking this course, you will understand the requirements for establishing an effective incident response team and be familiar with a wide range of incident response team goals, challenges, techniques, and solutions. During a simulated response to an incident, Dr. Kossakowski uses interactive instruction and role-playing techniques to help you experience the situational decisions you may encounter working on an incident response team. After attending this course, you will:

• Understand incident response issues, tools, and major strategies available
• Be familiar with the variety of services incident response teams can offer
• Realize what it takes to manage an effective and responsive team
• Identify essential incident response team policies and procedures

Course Topics

The course offers a realistic look at the range of work incident response teams engage in daily. Important topics covered include:

• Communication inside and outside the incident response team
• Cryptographic and data protection issues
• Incident response team management issues such as hiring and media relations
• Incident response team work environment
• Forum of Incident Response and Security Teams (FIRST)
• Hotline and triage functions
• Incident response practices and strategies
• Information gathering methods
• Setting task priorities and balancing workloads
• Vulnerability assessment and intruder threats

Course Availability

Dr. Klaus-Peter Kossakowski is available to teach the Managing a Computer Security Incident Response Team course at your site (as long as it resides in the networked world!).

PRESECURE holds periodic sessions of this courses in North America and Europe.

For public course offerings please refer to our schedule.