Enterprise Incident Response - 5 Days

Attacks against computer systems continue to increase in frequency and sophistication. In order to effectively defend data and intellectual property, organizations must have the ability to rapidly detect and respond to threats. 

This five-day intensive course is designed to teach the fundamental investigative techniques needed to respond to today’s landscape of threat actors and intrusion scenarios. Completely redeveloped with all-new material in 2014, the class is built upon a series of hands-on labs that highlight the phases of a targeted attack, key sources of evidence, and the forensic analysis know-how required to analyze them.

Who Should Attend:
Attendees with some background in conducting forensic analysis, network traffic analysis, log analysis, security assessments & penetration testing, or even security architecture and system administration duties.

It is also well suited for those managing CIRT / incident response teams, or in roles that require oversight of forensic analysis and other investigative tasks.

​Attendees Learn

• The incident response process
• The composition of an effective incident response team
• To manage an effective incident response 
• Acquiring Forensic Evidence
• The fundamentals of NTFS file system analysis
• Memory acquisition and analysis
• Investigating Lateral Movement 
• Persistence
• Tips and tricks used by investigators

​Course Pre-requisites
Attendees must be familiar with

• Executing command line utilities as an Administrator.
• Navigating the Windows file system using the command line.
• Common file system structures.
• Microsoft Windows registry.
• Active Directory and basic Windows security controls.
• Networking fundamentals, including common Windows protocols

What Attendees Should Bring
Laptop or virtual machine running Windows 7 (32 or 64 bit). Attendees must possess Administrator rights to the system they will use during class and must be able to install software provided on a USB device

What Attendees Will be Provided With
Class hand outs and slides thumb-drive containing class materials, labs, tools MANDIANT gear.