Information Security, Incident Response and Computer Forensics

1. Introduction to Incident Response and Forensics
1. Real-World Incidents
2. Case Studies
3. Attack Lifecycle Phases
2. Incident Response Process
1. Incident Response Policy
2. What is an Incident?
3. Incident Response Goals
4. NIST Incident Response Process
3. Preparing for an Incident
1. Pre-Incident Activities
4. Data Collection
1. Live Data Collection
5. Evidence Handling o Evidence
1. Chan of Custody
2. Evidence Integrity
6. Network Evidence
1. Network-based Evidence
2. Goals of Network Monitoring
3. Types of Network Monitoring
4. Wireshark and Other Tools
7. Memory Evidence
1. Memory Forensics
2. Memory Acquisition
3. Redline
4. Memory Analysis to Find Evil
1. Zeus
2. Stuxnet
3. Storm Worm Rootkit
4. TDSS Rootkit
8. Remediation
1. Remediation Workflow
2. Remediation Owner
3. Remediation Actions
9. Putting it All Together