CyberSecurity Training

Front

INCIDENCE RESPONSE PROCESS

What is the first step in the incident response process?

Back

Identify and confirm the incident by analyzing logs and alerts.

Front

INCIDENCE RESPONSE PROCESS

1. 
   
   

   • Scenario: A company detects unusual outbound network traffic that could indicate data exfiltration.
     
     

Question: What is the first step in the incident response proce

Back

Answer: Identify and confirm the incident by analyzing logs and alerts

Front

INCIDENCE RESPONSE PROCESS

• Scenario: Employees report receiving emails from a compromised internal account requesting sensitive data.
  
  

Question: Should this be escalated immediately? Why or why not?

Back

Answer: Yes, because it indicates a potential account takeover and requires immediate containment.

Front

• INCIDENCE RESPONSE PROCESS

• Scenario: A ransomware infection has locked multiple workstations. The IT team is unsure whether to shut down affected systems.
  
  

• Question: What should the team do first—shut down systems or isolate them?
  
  

Back

• Answer: Isolate them from the network to prevent further spread before taking further action.
  
  

Front

Real World Reporting

The Twitter Bitcoin Scam (2020)

📌 Incident: Attackers gained access to Twitter’s internal tools via a phishing attack on employees, leading to a large-scale scam.

Back

• Identify: Weak internal security protocols for employee access.
  
  

• Protect: Lack of multi-factor authentication on internal admin tools.
  
  

• Detect: Attack detected only after fraudulent tweets went viral.
  
  

• Respond: Twitter locked down affected accounts and restricted employee access.
  
  

Recover: Twitter improved security policies and employee training.

Front

• INCIDENCE RESPONSE PROCESS

Containment & Mitigation

1. 
   

   • Scenario: A malware outbreak spreads across an organization’s network. IT blocks external traffic from affected machines.
     
     

Question: What additional containment steps should be taken?

Back

Answer: Disable compromised accounts, segment the network, and block malicious IP addresses.

Front

• INCIDENCE RESPONSE PROCESS

• Containment and Mitigation

• Scenario: A phishing attack compromised employee credentials. The attacker is attempting unauthorized access.
  
  

Question: What immediate actions should be taken?

Back

Answer: Force password resets, revoke unauthorized sessions, and monitor for further suspicious activity.

Front

• INCIDENCE RESPONSE PROCESS

Containment & Mitigation

Scenario: The IT team detects unauthorized administrative access on a critical server.

Question: Should they immediately remove the hacker’s access or collect forensic evidence first?

Back

Answer: Collect forensic evidence first to understand the attack vector before removing access.

Front

• INCIDENCE RESPONSE PROCESS

Eradication & Recovery

1. 
   

   • Scenario: After a successful incident containment, IT is ready to remove malware.
     
     

Question: What is the best approach to ensure complete malware remo

Back

Answer: Reimage infected systems and update security patches to prevent reinfection.

Front

• INCIDENCE RESPONSE PROCESS

Eradication & Recovery

• Scenario: A cyberattack exploited a known vulnerability.
  
  

Question: Besides removing the threat, what long-term fixes should be implemented?

Back

• Answer: Patch the vulnerability, enhance monitoring, and update access controls.