06 - Identifying and classifying security incidents

Description

Even the best security controls aren't foolproof. That's why security professionals need a solid incident management plan. The fourth domain of the Certified Information Security Manager (CISM) exam—Information Security Incident Management—tests your mastery of this important topic. Take this CISM Cert Prep course to study for the exam and gain a deeper understanding of how your team should react to and resolve a security incident, whether it's an attack on your network, an email-born virus, or data theft. Instructor Mike Chapple explains how to identify, triage, and respond to an event, minimizing the damage and maximizing your ability to find the root cause, so you can resume normal operations. He also provides tips for logging and monitoring ongoing security-related events. Each topic maps to a relevant objective from the CISM certification exam.

Topics include:

Creating an incident response team
Classifying incidents
Building an incident response program
Identifying symptoms of incidents
Conducting forensic investigations
Logging and monitoring<