SC580: BSI™ Incident Expert

Agenda:

• Framework Conditions for the Incident Expert
  • Digital Response Chain
  • Task Boundaries
  • Overview of Relevant Laws
  • Reporting Obligation
  • Integration of Specialists into Incident Response
  • Affected Party's Objectives in Commissioning
    
    
• Summary Additional Training Incident Practitioner
  
  
• Attack Scenarios and Forensics
  • Overview of Required Basic Knowledge
  • Summary of Relevant Attack Vectors
  • Presentation of Forensic Procedures
  • Data Collection/Acquisition
  • Data Analysis
  • Analysis Limitations
    
    
• Deepening of Standard Procedure Workflow
  • Preparation for Potential Incidents
  • IT Security Incident Identification
  • Damage Scope Containment
  • Root Cause Analysis of IT Security Incident
  • System Recovery
  • IT Security Incident Documentation
    
    
• Summary of Key Aspects in Incident Handling
  • Handling of Special IT Security Incidents
  • Individual Advanced Exercises and Use Cases
    
    
• OT (Operational Technology) Incident Response for Incident Experts
  • Deepening of "Incident Response for IT Systems Beyond Standard Office Applications" from Incident Practitioner Training
    
    
• On-Site Support: Situation Assessment
  • Establish Incident Expert as Crisis Manager
  • Assess Company's Analysis Capabilities
  • Define Collaboration Framework Conditions
    
    
• On-Site Support: Analysis
  • IT Security Incident Analysis
  • Procedure Planning
  • Emergency Operations
  • System Remediation
  • System Recovery
  • Post-Processing
    
    
• "After an Incident is Before an Incident"
  • Company Awareness Building for Preventive Security Measures
  • Security Awareness Development
  • Security and Emergency Concept Development
  • Exercise Design
  • Info Package Provision by CSN
  • Incident Expert Competency Maintenance

Objectives:

In this 3-day training you will be prepared for the personnel certification as Incident Expert by the BSI™.

This advanced training provides you with the official training curriculum to acquire the knowledge and skills you need as part of your work as a certified Incident Expert.

In the group you will develop your capabilities for handling information security incidents and consolidate your knowledge of Cyber Security.

Following the workshop, all course participants receive the work results as handout, the official training materials and the certificate of participation in the certification program.

As a training graduate you have the opportunity to participate in the examination for personnel certification at the BSI™ and obtain a certification as "Incident Expert" of the BSI™! The entire certification process (including examination) is billed according to effort, which is why no exact price can be stated. On average, however, around 600-700€ are incurred.

Target audience:

The course SC580 BSI™ Incident Expert is specifically targeted at participants who already possess knowledge and practice in the field of Cyber Security and now aim for certification as Incident Expert:

• IT Managers
• IT Security Officers (CISO)
• IT Specialists
• IT Technicians/Theorists
• ISMS Experts

Course participants are frequently decision makers, consultants and employees who already possess extensive knowledge in the field of IT Security and Incident Management.

Prerequisites:

You want to become an incident expert? Good decision!

To be admitted to participate in the certification process, the following requirements must be fulfilled:

• The applicant must have attended the minimum three-day advanced training based on the curriculum [CUR].
• Educational qualification
  The applicant must have completed training in which he has acquired fundamental knowledge and skills for his future activity as an incident expert. This includes, for example, completed training or completed studies in the field of IT and/or information security
• Professional experience
  The applicant must demonstrate from the last eight years at least five years of subject-specific, practical professional experience calculated on full-time basis in the field of IT/information security and from the last five years at least three years of experience in handling IT security incidents.
• Practical experience
  The applicant must have participated in a leading capacity in incident handling or projects with a total scope of at least 40 person-days in the past three years (reference date: application date).

Description:

The workshop SC580 BSI™ Incident Expert enables you to provide rapid and effective on-site support in case of IT security incidents and to initiate the corresponding damage control processes.

Other Info:

Note: You will receive a certificate of participation for the BSI™ Incident Expert preparation course.

Since October 2021, the CSN concept DIGITAL RESCUE CHAIN consists of:

• Self-help assistance (website)
• CSN hotline contact point
• Digital first responder certification
• Incident practitioner certification according to BSI™/ACS standard
• Incident expert certification according to BSI™/ACS standard
• IT service providers with a team of incident experts

qSkills™ has been an active partner of the Alliance for Cybersecurity (ACS) since its founding and supports the BSI™ as a training expert, among other things, with the training of security officers to become BSI™ incident experts.

The BSI™ incident experts, alongside the BSI™ incident practitioners, are a significant part of the new Digital Rescue Chain for victims of cyberattacks.