Strategies for Computer Security Incident Response Team (CSIRT)

Course details

In spite of all the options available on the market today, basic security hygiene is still one of the best ways to prevent a potentially devastating breach or attack. In this course, designed uniquely for cybersecurity and IT professionals, instructor Viktor Hedberg covers the essentials of working on a Computer Security Incident Response Team (CSIRT), highlighting some of the most important topics relevant to the role. Discover the core concepts and strategies used by a successful CSIRT such as network segmentation, using the correct tool for the correct job, administrative tiering, Active Directory, Entra ID, and more. Along the way, Viktor shows you how to secure both your data center and your backup solution.

Concepts

0. Introduction

01 - CSIRT strategies

1. Computer Security Incident Response (CSIRT) Basics

02 - Antivirus and endpoint detection and response (EDR)
03 - Lack of monitoring
04 - Spreading credentials

2. Implementing Administrative Tiering in Active Directory

05 - Why is Active Directory tiering important
06 - Implement Active Directory tiering

3. Implementing Administrative Tiering in Entra ID and Azure

07 - Why Entra ID tiering is important
08 - Entra ID and Azure tiering 101

4. Network Segmentation

09 - Next generation firewalls
10 - Virtual private networks
11 - Why network segmentation is super important

5. Backup Architecture

12 - Issues with agent-based backup
13 - Ideal backup architecture

6. Securing the Modern Data Center

14 - Direct and indirect administrators
15 - Separating data center from workload

7. Using the Right Tool for the Job

16 - Windows LAPS (Local Administrator Password Solution) vs. RDP (Remote Desktop Protocol)

Strategies for Computer Security Incident Response Team (CSIRT)

Authors

Viktor Hedberg