CERT^® Program Course:

Advanced Incident Handling for Technical Staff

Date and Local

This course will be held in São Paulo/SP - Brazil - from November 29 to December 03, 2010.

Price

2010 fee, per person:

Industry and professionals:	R$ 2.300,00
Academic and Research Institutions:	R$ 2.300,00

Obtaining the Certificate

The certificates of the CERT^® Program courses delivered by CERT.br have the same validity of those issued directly by Carnegie Mellon^® University.

The certificates of the courses delivered by CERT.br will be issued to those who obtain at least 90% of presence.

The course participants will also be entitled to earn CEUs issued by Carnegie Mellon^® University.

Course Description

This five-day course, designed for computer security incident response team (CSIRT) technical personnel with several months of incident handling experience, addresses commonly used and emerging attacks that are targeted against a variety of operating systems and architectures.

Building on the methods and tools discussed in the Fundamentals of Incident Handling course, this course provides steps that incident handlers can take in response to system compromises at the privileged level.

Through interactive instruction, facilitated discussions, and small group exercises, instructors help participants identify and analyze a set of incidents and vulnerabilities and then propose appropriate response strategies. Participants also review broader aspects of CSIRT work (e.g., artifact analysis, development of advisories, alerts, and management briefings).

Before completing this course, participants must attend the companion course Fundamentals of Incident Handling, offered by CERT.br, or the Managing Computer Security Incident Response Teams course, offered by SEI/CMU.

The course Advanced Incident Handling for Technical Staff is part of the curriculum for the CERT^® Certified Computer Security Incident Handler program.

Objectives

This course will help participants to:

• detect and characterize various attack types
• gain practical experience in constructive analysis of artifacts left on a compromised system
• understand the complexity of and effectively respond to privileged and major event incidents within your CSIRT
• formulate effective advisories and alerts

Topics

• review of critical information and typical probes and scans
• consequences of privileged compromises
• responding to and recovering from privileged compromises
• overview of typical intruder toolkits
• understanding distributed denial of service attacks
• handling major computer security events
• the role of artifact analysis in incident handling
• fundamental vulnerability causes
• vulnerability handling
• publishing CSIRT information
• security case study

Audience

• current computer security incident response team (CSIRT) members
• system and network administrators responsible for identifying and responding to security incidents

Prerequisites

Before registering for this course, participants must:

• complete the Fundamentals of Incident Handling course or the Managing Computer Security Incident Response Teams course;
• have at least three months of incident handling experience;
• have basic programming skills and familiarity with various types of computer security attacks and tools;
• understand of Internet services and protocols.

Course Material

Participants will receive a course notebook containing the course materials, including class handouts and additional documentation.

(SM) SEI is a service mark of Carnegie Mellon University.

® CERT and Carnegie Mellon are registered in the U.S. Patent and Trademark Office by Carnegie Mellon University.