Incident Response and Network Forensics Training Boot Camp

Learn how to detect and respond to security incidents! This popular boot camp builds your knowledge around network forensics and incident response with hands-on labs and expert instruction — and prepares you to become a Certified Computer Security Incident Handler (CERT-CSIH).

Earn your CERT-CSIH, guaranteed!

Boot camp overview

Infosec’s Incident Response and Network Forensics Boot Camp covers the essential information you need to properly detect, contain and mitigate security incidents. You’ll learn the ins and outs of incident response as well as the tools used by incident responders on a daily basis. You’ll gain hands-on experience in how systems are compromised and what traces are left behind by attackers on the network, on disk and in volatile memory.

Security incidents are a way of life in the modern world, and how organizations respond to them makes a massive difference in how much damage is ultimately done. This boot camp addresses cutting-edge attack vectors as well as tried-and-true methods for compromise. You leave with the knowledge of how to prevent incidents and the skills to defend against a security incident if it does happen.

What's included?

93% pass rate — the best in the industry

• Five days of training with an expert instructor
• Infosec proprietary digital courseware (physical textbooks available to purchase)
• CERT-CSIH digital review guide
• CERT-CSIH exam voucher
• 90-day access to cyber range (Flex Pro)
• 90-day access to course replays (Flex Pro)
• Curated videos from other top-rated instructors (Flex Pro)
• 100% Satisfaction Guarantee
• Exam Pass Guarantee (Flex Pro)

Course objectives

This boot camp focuses on teaching you the five key incident response steps:

1. Plan – Preparing the right process, people and technology enables organizations to effectively respond to security incidents
2. Identify – Scoping the extent of the incident and determining which networks and systems have been compromised; includes assessing the extent to which systems have been compromised
3. Contain – Prevent the incident from further escalating using information gathered in the previous stage
4. Eradicate – Remove intruder access to internal and external company resources
5. Recover – Restore fully operational system capability and close out incident

Who should attend?

• Incident response professionals
• Network and system administrators
• Computer security incident response team (CSIRT) members
• Anyone interested in improving their network forensics and incident management skills

Prerequisites

One or more years of experience in incident handling or equivalent information security experience is recommended.

What you'll learn

• The incident response process
• Building an incident response kit
• Event/incident detection
• Categorizing and prioritizing events
• Sources of network evidence
• TCP reconstruction
• Flow analysis
• NIDS/NIPS
• Vulnerability analysis
• Log analysis
• Firewall log investigation
• Log aggregation

• Network artifact discovery
• Identifying rogue processes
• DNS forensics and artifacts
• NTP forensics and artifacts
• HTTP forensics and artifacts
• HTTPS and SSL analysis
• FTP and SSH forensics
• Email protocol artifacts
• Wireless network forensics
• Defensive review
• Secure credential changing
• Reporting and coordinating incidents

Can’t get away for a week?
Learn Learn incident response and network forensics  on-demand

et the cybersecurity training you need at a pace that fits your schedule with a subscription to Infosec Skills. Includes unlimited access to hundreds of additional on-demand courses — plus cloud-hosted cyber ranges where you can practice and apply knowledge in real-world scenarios — all for just $34 a month!

• 70+ learning paths
• 500+ courses
• Cloud-hosted cyber ranges and hands-on projects
• Skill assessments and certification practice exams
• Infosec community peer support