Security Incident Reporting

By the end

What you'll build

• Distinguish a security event from an incident and from a confirmed data breach
• Report a suspected incident through the internal route, including out of hours, within the expected timeframe
• Write an initial report that separates observed facts from speculation and includes usable timestamps
• Preserve devices, messages and files as instructed instead of attempting your own fix
• Describe your role during and after an investigation, including what you must not do or share

Curriculum

What's inside

6 modules · 34 lessons

1. 01

   Knowing What You Are Looking At

   5 lessons
   • Event, Incident, Breach: Three Words With Different Consequences
   • Categories: Malicious Software, Account Compromise, Data Loss, Availability, Physical
   • Near Misses and Why They Are Worth Reporting
   • Warning Signals Visible From an Ordinary Desk
   • Naming what you have seenmatch pairs
2. 02

   Reporting Well and Reporting Fast

   6 lessons
   • Writing an Initial Report Responders Can Act On
   • The Internal Reporting Route and Its Out-of-Hours Path
   • Facts, Timestamps and the Line Between Observation and Guess
   • First Severity Estimate: A Starting Point, Not a Verdict
   • Reporting About Yourself, or About a Colleague
   • + 1 more lesson
3. 03

   Preserving the Picture

   6 lessons
   • Why Fixing It Yourself Can Destroy the Evidence
   • Leave It Running or Disconnect It: Following Instructions
   • Keeping Messages, Files and Screenshots Intact
   • Chain of Custody in Plain Terms
   • Avoiding Rumour, Speculation and Wider Sharing
   • + 1 more lesson
4. 04

   What Happens Next

   6 lessons
   • Triage, Containment, Eradication, Recovery: Your Part in Each
   • Who Runs the Response and Who Decides on Notification
   • Cooperating With an Investigation, Including Interviews
   • Communication Discipline While an Incident Is Open
   • Supplier and Third-Party Incidents That Reach Us
   • + 1 more lesson
5. 05

   Learning Instead of Blaming

   6 lessons
   • The Post-Incident Review and How to Contribute Honestly
   • Root Cause Versus the Person Nearest the Keyboard
   • Turning Findings Into Control Changes
   • Trends and Metrics: What Gets Reported Upward
   • Why Early Reporting Is Protected Behaviour
   • + 1 more lesson
6. 06

   Practice and check

   5 lessons
   • What the tidy-up costsmatch pairs
   • The first thirty minutes of a suspected compromisesequence order
   • Say what you mean in an incidentfill blank
   • Friday afternoon on the shared drivescenario
   • Course quizquiz

The shape of it

How this course works