incident response Key incident response skills What should an incident response specialist be able to do and how can they improve their skills? Hugh Aver May 20, 2022 When a company is suffering from a cyberattack or corporate data is leaked, the business frantically tries to solve two problems: minimize the damage and return to normal workflow as soon as possible. The main burden of solving those problems falls on the incident response team. The efficiency of their actions will affect not only how quickly the source of the problem will be found, but also how reliably the company will be protected from a recurrence of the incident. After all, modern cybercriminals are trying to obstruct the investigation and destroy traces of their presence in the victim’s infrastructure, so without accurate identification of the entire attack chain, reliable protection against the same malicious tactics cannot be guaranteed in the future. Our experts have identified a set of key skills required for an incident response specialist: Incident detection Evidence acquisition Log file analysis Network analysis Creation of indicators of compromise Memory forensics To upgrade the skills of cyber incident response teams, Kaspersky Lab created the Windows Incident Response online course. It draws on the experience of our Global Emergency Response Team (GERT) experts who have been fighting advanced cyberthreats around the world for over 12 years. The course will be led by two practicing experts from the GERT team who will share their personal experience. Among other things, students will be able to explore the process of identifying an incident using the REvil ransomware attack case as an example. Course subscribers will be able to not only watch 40 video lessons, but also to gain practical skills in a virtual environment, having mastered all the necessary tools such as ELK stack, PowerShell, Suricata, YARA and others. The estimated training duration is approximately 15 hours, but participants will be given 100 hours of access to the virtual lab and six months to complete the course. The course is designed for professionals with basic knowledge and experience in Windows troubleshooting. They also should be familiar with Linux OS commands. You can learn more about the Windows Incident Response course on its page on the Kaspersky Expert Training portal.
Read next DHS recommends patching VMware, probably you should too The Department of Homeland Security is urging US federal agencies to “patch or remove” a list of VMware products within five days. Probably you should do it too.
Tips How to improve your resume with AI without exposing your data Let’s look at how to use AI as a resume editor without oversharing to build a document that gets past automated screening systems and catches a recruiter’s eye.
Tips How can students overcome the fear of unfulfilled potential, and where does cybersecurity come into it? University students sometimes don’t see the practical value of what they’re studying, and aren’t always sure what to do next. Kaspersky Academy’s free “Cybersecurity. Entry Level” course can help them pick up in-demand skills directly from Kaspersky experts.
Tips Nine reasons to set up a VPN on your router Get the most speed, reliability, and convenience out of your VPN by putting it on your router. Here’s a look at the real benefits of specific VPN setup scenarios for your whole home network.
Tips Fact and fiction about hidden Wi-Fi network names Hiding your Wi-Fi network name might seem like a smart security move, but in practice it does more harm than good. Let’s take a look at how it works, what side effects it can have, and how to properly secure your home Wi-Fi.