Incident Response Frameworks

Incident Response Frameworks

位教师：Starweaver

包含在中

了解更多

6个模块

深入了解一个主题并学习基础知识。

中级等级

推荐体验

9 小时完成

灵活的计划

自行安排学习进度

6个模块

深入了解一个主题并学习基础知识。

中级等级

推荐体验

9 小时完成

灵活的计划

自行安排学习进度

您将学到什么

Describe the fundamentals of a cybersecurity major incident response process.
Explain key industry frameworks (NIST and SANS).
Develop your own cybersecurity major incident response plan.
Test, measure, and improve your cybersecurity major incident management process.

您将获得的技能

要了解的详细信息

可分享的证书

添加到您的领英档案

了解顶级公司的员工如何掌握热门技能

了解关于 Coursera for Business 的更多信息

Petrobras, TATA, Danone, Capgemini, P&G 和 L'Oreal 的徽标

该课程共有6个模块

In today's digital battlefield, cyber incidents are not a matter of if, but when. Whether it's ransomware, phishing, or insider threats, the ability to respond swiftly and effectively can mean the difference between containment and catastrophe.

This course is designed to equip you with the tools, strategies, and confidence to implement and use industry best practice for cybersecurity incident response to create an incident response process that anyone can follow. We'll explore the most widely adopted industry frameworks (NIST and SANS) and learn how to apply them in real-world scenarios as well as integrate them into your existing IT Service Management solution. Through expert guidance and real-world examples, you'll gain a detailed understanding of how to build response plans, coordinate teams, and recovering from attacks. Whether you're an aspiring cybersecurity professional, an IT support manager, or a team member looking to sharpen your response skills, this course will prepare you to act decisively when it matters most. This course is designed for professionals who play a direct role in keeping IT systems secure and running smoothly. Cybersecurity engineers, Service Desk Analysts, Service Desk Managers, and IT Managers will benefit from the practical, structured approach to handling major incidents. Whether you’re already involved in incident response or looking to build stronger skills, the content is tailored to support real-world responsibilities. To fully engage with the material, you should have a basic understanding of IT Service Management and the four core ITIL pillars: Incident, Problem, Change, and Request. A general grasp of business IT operations, along with familiarity with common cybersecurity events, will help you connect the lessons to the scenarios you encounter in your own environment. By the end of the course, you’ll be able to explain the foundations of cybersecurity major incident response and compare the NIST and SANS frameworks with confidence. You’ll also learn how to build a complete incident response plan tailored to your organisation and understand how to test, evaluate, and continuously improve that plan so it remains effective over time.

In this course, you’ll learn how to respond confidently to major cybersecurity incidents using industry-standard frameworks like NIST and SANS. You’ll practice identifying incidents, coordinating response efforts, and building structured plans that integrate smoothly with IT Service Management workflows. Through clear examples and practical guidance, you’ll develop the skills to contain threats, recover systems, and improve your organisation’s readiness over time. By the end, you’ll be equipped to step into incident response roles and act decisively when a real attack hits.

涵盖的内容

1个视频1篇阅读材料

In this module we will look at defining the problem of what a major cybersecurity incident is and why it is important to our businesses to have a plan in place to manage these issues when they arise. We will cover key terminology that we will need for future sections, as well as what industry frameworks we will use to populate the requirements as we go. Finally, we will look at why having a major incident process in place before a cybersecurity incident is key to limiting damage, halting the attack, and recovering as quickly as possible.

涵盖的内容

10个视频1篇阅读材料1个作业1次同伴评审1个讨论话题

10个视频总计54分钟

Module Introduction 3分钟
Key Terminology and Acronyms 5分钟
IT Service Management 5分钟
Importance of an IT Service Management Solution5分钟
What Defines a Mature IT Service Management (ITSM) Solution5分钟
Importance of Preparation and Planning 5分钟
ITIL Incident, Major Incident, and Problem Management 5分钟
Cost Savings from Preventing Cyber Attacks 5分钟
Non-Monetary Impact on the Business5分钟
Understanding ROI for Cybersecurity Investments 5分钟

1篇阅读材料总计5分钟

What Is IT Service Management and Its Importance5分钟

1个作业总计20分钟

Defining the Problem 20分钟

1次同伴评审总计30分钟

Hands-On-Learning: Mapping Out an Incident Management Process 30分钟

1个讨论话题总计10分钟

Importance of IT Service Management 10分钟

This module is designed to provide participants with a comprehensive understanding of key cybersecurity incident management frameworks, including NIST, and SANS. The module aims to equip learners with the knowledge and skills necessary to effectively manage and respond to cybersecurity incidents.

涵盖的内容

13个视频1篇阅读材料1个作业1次同伴评审1个讨论话题

13个视频总计70分钟

Module Introduction2分钟
SANS Institute's Incident Response (IR) Framework 4分钟
Preparation and Identification 5分钟
Containment and Eradication 4分钟
Recovery and Lessons Learned 7分钟
Third-Party/Supply Chain Incident Management 7分钟
What is NIST SP 800-616分钟
Preparation 6分钟
Incident Response 3分钟
Lessons Learned 6分钟
Document Management Standards. ISO 76865 5分钟
Creation, Storage, and Tracking of Document 5分钟
Monitoring and Maintenance Processes and Procedures 5分钟

1篇阅读材料总计5分钟

Document Management: Minimum Requirements for the Storage of Documents5分钟

1个作业总计20分钟

Cybersecurity Incident Management Frameworks 20分钟

1次同伴评审总计60分钟

Hands-On-Learning: Determine the Best Templates and Management Products to Use 60分钟

1个讨论话题总计10分钟

Documentation Challenges 10分钟

A Cyber Incident Response Plan (CIRP) is a crucial document and associated process for IT and cybersecurity departments within a business. It provides a clearly defined process for handling any major cybersecurity event including, but not limited to, security breaches, data leaks, malware attacks, and other disruptions. In this module we will look at how to build out a CIRP specific to your business and how it can help minimize damage, reduce downtime, and protect an organization's reputation.

涵盖的内容

10个视频1篇阅读材料1个作业1次同伴评审1个讨论话题

10个视频总计41分钟

Module Introduction 2分钟
CIRP Templates 4分钟
Gathering the Right People for the Team 4分钟
Defining The Trigger for a Major Incident Process 4分钟
Planning for Identification Phase 4分钟
Planning for Response 4分钟
Planning for Lessons Learned 4分钟
Cost Savings from Preventing Cyber Attacks 3分钟
Non-Monetary Impact on the Business4分钟
Understanding ROI for Cybersecurity Investments 4分钟

1篇阅读材料总计5分钟

Post Implementation Review (PIR) Guide 5分钟

1个作业总计20分钟

Developing a Cyber Incident Response Plan (CIRP) 20分钟

1次同伴评审总计60分钟

Hands-On-Learning: Mapping Out an Incident Management Process 60分钟

1个讨论话题总计10分钟

Post Implementation Review Timing 10分钟

This module will guide you through the essential steps of implementing an effective cyber incident response plan. It aims to equip you with the knowledge and skills needed to swiftly and efficiently address major cybersecurity incidents. From making the plan available to practical hands-on training, and improving the plan over time, you'll learn how to deploy a successful CIRP, ensuring your organization can minimize damage and recover quickly from cyber threats.

涵盖的内容

10个视频1篇阅读材料1个作业1次同伴评审1个讨论话题

10个视频总计43分钟

Module Introduction 1分钟
Making the Process Available 4分钟
Communicating the Process 3分钟
Training Staff 4分钟
Simulating an Incident 4分钟
Advanced Simulations 3分钟
Measuring Simulation Success 5分钟
Continuous Process Improvement 4分钟
Creating a Review Schedule 4分钟
System Architecture Involvement 5分钟

1篇阅读材料总计5分钟

Learn About Quality 5分钟

1个作业总计20分钟

Implementing a Cyber Incident Response Plan 20分钟

1次同伴评审总计30分钟

Hands-On-Learning: Build Out First Draft of a Cyber Incident Response Plan 30分钟

1个讨论话题总计10分钟

Document Review Schedule 10分钟

In this wrap-up module, you’ll apply everything you’ve learned by creating a practical implementation plan for a full cybersecurity incident response process. This final project brings the core concepts together and shows your ability to design, document, and prepare an organisation for effective incident response.

涵盖的内容

1个视频1次同伴评审

位教师

Starweaver

458 门课程896,013 名学生

Brett Moffett

Starweaver

1 门课程7 名学生

提供方

Starweaver

人们为什么选择 Coursera 来帮助自己实现职业发展

Felipe M.

自 2018开始学习的学生

''能够按照自己的速度和节奏学习课程是一次很棒的经历。只要符合自己的时间表和心情，我就可以学习。'

Jennifer J.

自 2020开始学习的学生

''我直接将从课程中学到的概念和技能应用到一个令人兴奋的新工作项目中。'

Larry W.

自 2021开始学习的学生

''如果我的大学不提供我需要的主题课程，Coursera 便是最好的去处之一。'

Chaitanya A.

''学习不仅仅是在工作中做的更好：它远不止于此。Coursera 让我无限制地学习。'

通过 Coursera Plus 开启新生涯

无限制访问 10,000+ 世界一流的课程、实践项目和就业就绪证书课程 - 所有这些都包含在您的订阅中

了解更多

通过在线学位推动您的职业生涯

获取世界一流大学的学位 - 100% 在线

探索学位

加入超过 3400 家选择 Coursera for Business 的全球公司

提升员工的技能，使其在数字经济中脱颖而出

了解更多

常见问题

To access the course materials, assignments and to earn a Certificate, you will need to purchase the Certificate experience when you enroll in a course. You can try a Free Trial instead, or apply for Financial Aid. The course may offer 'Full Course, No Certificate' instead. This option lets you see all course materials, submit required assessments, and get a final grade. This also means that you will not be able to purchase a Certificate experience.

When you purchase a Certificate you get access to all course materials, including graded assignments. Upon completing the course, your electronic Certificate will be added to your Accomplishments page - from there, you can print your Certificate or add it to your LinkedIn profile.

Yes. In select learning programs, you can apply for financial aid or a scholarship if you can’t afford the enrollment fee. If fin aid or scholarship is available for your learning program selection, you’ll find a link to apply on the description page.