ISO/IEC 27035: Information Security Incident Management (Udemy.com)

Every organization, regardless of size or industry, can become the target of a cyber attack — and security controls alone cannot guarantee total protection. Residual vulnerabilities will always exist, new threats emerge constantly, and information security incidents are a matter of when, not if. What separates a minor disruption from a business-ending crisis is how well the organization prepares for and responds to incidents.

This course teaches information security incident management according to ISO/IEC 27035, the international standard for incident management. You will learn the complete process for planning, detecting, assessing, responding to and learning from security incidents — the foundation of any incident response capability, and a natural complement to an ISO/IEC 27001 information security management system.

The five phases of incident management under ISO/IEC 27035

A section of the course is dedicated to each phase, with examples and case studies throughout:

• Plan and prepare — developing incident management plans and policies, training and awareness, identifying resources, establishing forms and templates, and setting up organizational structures such as the incident management team and the incident response team (IRT/CSIRT)

• Detect and report — identifying and reporting information security events, and the monitoring and detection capabilities that make this possible

• Assess and decide — triaging events, categorizing incidents by their impact on the organization, and deciding on the appropriate response

• Respond — containing the incident, eradicating the cause, and recovering affected systems and services

• Learn lessons — using the information collected during incident handling to improve security controls, the incident management process and the wider organization

What you will gain

• A complete understanding of the concepts, roles and tools of information security incident management

• The ability to categorize and analyse security incidents and select appropriate responses

• Practical knowledge for designing or improving your organization's incident response process — including plans, policies and team structures

• A foundation for incident manager or incident responder certification paths, and for consulting or auditing engagements covering incident management

Who this course is for

• IT and information security professionals building or joining an incident response team

• SOC analysts and incident responders who want the management-system view of incident handling

• CISOs, security managers and IT managers responsible for incident preparedness

• ISO/IEC 27001 implementers and auditors — incident management is a required control area of every ISMS

• Consultants supporting clients with incident management processes

Use this course to design or improve your company's incident management process, to support your consulting or audit work, or to advance your career in information security.