SC580: Incident Expert of the Cyber Security Network of the BSI™

Agenda:

• Framework conditions for the incident expert
  • Digital response chain
  • Task boundaries
  • Overview of relevant laws
  • Reporting obligation
  • Integration of specialists into incident response
  • Affected party's objectives in commissioning
    
    
• Summary additional training incident practitioner
  
  
• Attack scenarios and immediate or countermeasures
  • Overview of required basic knowledge
  • Summary of relevant attack vectors
  • Presentation of forensic procedures
  • Data collection/acquisition
  • Data analysis
  • Analysis limitations
    
    
• Deepening of standard procedure workflow
  • Preparation for potential incidents
  • IT security incident identification
  • Damage scope containment
  • Root cause analysis of IT security incident
  • System recovery
  • IT security incident documentation
    
    
• Summary of key aspects in handling
  • Handling of special IT security incidents
  • Individual in-depth exercises and use cases
    
    
• Incident response for OT (Operational Technology) for incident experts
  • Deepening of the topic "Incident response for IT systems" beyond standard office applications" from the training for incident practitioners
    
    
• On-Site support: situation assessment
  • Establish incident expert as crisis manager
  • Assess company's analysis capabilities
  • Define collaboration framework conditions
    
    
• On-Site support: Analysis
  • IT security incident analysis
  • Approach planning
  • Emergency operations
  • System remediation
  • System recovery
  • Post-processing
    
    
• "After an Incident is Before an Incident"
  • Company awareness raising for preventive security measures
  • Security awareness development
  • Security and emergency concept development
  • Exercise design
  • Info package provision by CSN
  • Incident expert competency maintenance

Objectives:

Target audience:

The course SC580 Incident Expert of the Cyber Security Network of the BSI™ is specifically designed for participants who already possess knowledge and practice in the field of Cyber Security and are now seeking certification as an Incident Expert in the CSN of the BSI™:

• IT Managers
• IT Security Officers (CISO)
• IT Specialists
• IT Technicians/Theorists
• ISMS Experts

Course participants are often decision-makers, consultants, and employees who already have extensive knowledge in IT security and incident management.

Prerequisites:

Do you want to become an Incident Expert? Good decision!
There is a concrete risk of being affected by an IT incident for approximately 83 million citizens and about 3 million small and micro enterprises.

To be eligible for participation in the certification process, the following prerequisites must be met:

• The applicant must have attended the minimum three-day advanced training based on the curriculum [CUR].
• Educational Qualification
  The applicant must have completed an education in which they acquired fundamental knowledge and skills for their future role as an Incident Expert. This includes, for example, completed training or a degree in the field of IT and/or information security.
• Professional Experience
  The applicant must demonstrate at least five years of specialized, practical professional experience calculated on a full-time basis in the field of IT/information security from the last eight years, and at least three years of experience in handling IT security incidents from the last five years.
• Practical Experience
  The applicant must have participated in a leading role in incident handling or projects with a total scope of at least 40 person-days in the past three years (reference date: application date).

The exact requirements are documented at the Cyber Security Network of the BSI™: Certification as an Incident Expert

Description:

 The Federal Office for Information Security (BSI™) is responsible for IT security matters. To strengthen the reactive offering in the field of Cyber Security or IT security, the Cyber Security Network (CSN) was established as a contact point for incident handling. This voluntary association of qualified IT security experts aims to detect and analyze IT security incidents more quickly, limit the extent of damage, and prevent further harm.

The workshop SC580 Incident Expert of the BSI™ Cyber Security Network enables you to provide rapid and effective on-site assistance in the event of IT security incidents and to initiate the appropriate damage control processes.

Other Info:

Note: You will receive a Certificate of Participation for the BSI™ Incident Expert preparation course.

Since October 2021, the CSN concept DIGITAL RESCUE CHAIN consists of:

• Self-help assistance (Website)
• CSN Hotline contact point
• Qualification as a Digital First Responder
• Qualification as an Incident Practitioner according to BSI™/ACS standard
• Qualification as an Incident Expert according to BSI™/ACS standard
• IT service provider with a team of Incident Experts

qSkills™ has been an active partner of the Alliance for Cybersecurity (ACS) since its inception and supports the BSI™ in the Cyber Security Network CSN as a training expert, including the training of security officers to become BSI™ Incident Experts.

The BSI™ Incident Experts are, alongside the BSI™ Incident Practitioners, a significant part of the new Digital Rescue Chain for victims of cyberattacks. The BSI™'s CSN aims to assist citizens and companies as quickly as possible in the event of a "K-case" (cyberattack).