Incident response for the service desk: the first 15 minutes

Skills you'll practise

• Recognize when a ticket has become a security incident.
• Take safe first containment steps for a device and for an account.
• Preserve evidence and keep a timeline with times and time zone.
• Escalate with the details security needs, using the playbook's contacts.
• Communicate on a need-to-know basis without causing panic.

Course outline

1. 1.Incident response for the service desk: the first 15 minutesVideo · 4 min
2. 2.Recognize, contain, preserveLesson · 8 min
3. 3.Escalating and communicatingLesson · 8 min
4. 4.Notes and evidence in the first 15 minutesLesson · 8 min
5. 5.Incident response for the service desk: the first 15 minutes: knowledge checkKnowledge check · 17 questions
6. 6.Incident response for the service desk: the first 15 minutes: practical exerciseKnowledge check · 1 question
7. 7.Final exam9 questions · passing it completes the course, so people who already know the material can test out

Sources it draws on

The lessons and questions are written from these references, so learners can go back to the original.

• NIST SP 800-61 Rev. 3: Incident Response Recommendations and Considerations for Cybersecurity Risk Management
• CISA: #StopRansomware Guide
• CISA: Incident response and reporting guidance