Course 04 · Cyber incident response
When Cyber Strikes
Twenty video chapters adapted from Parts I–IV of When Cyber Strikes: The Cyber Incident Response Playbook, covering the first alert, investigation, containment, recovery, crisis decisions, and cloud, AI, and cyber-physical incidents.
When the Alarm Sounds
Establish what happened, who leads, and what the first response must preserve.
When Cyber Strikes
Follow scattered service failures as a possible incident, linking technical alerts to business impact, authority, and communication.
Watch lessonWhat Is a Cyber Incident
Distinguish events from incidents through consequence, confidence, urgency, and the decisions coordinated response enables.
Watch lessonThe First 60 Minutes
Establish command, preserve evidence, limit immediate harm, and set the next decision point during the first hour.
Watch lessonBuilding the Incident Response Team
Assign incident command, technical and business workstreams, approval rights, external support, and sustainable handovers.
Watch lessonThe Incident Response Lifecycle
Treat preparation, detection, response, recovery, and improvement as overlapping capabilities with testable acceptance criteria.
Watch lessonInside the Attack
Investigate attacker activity, contain harm, remove access, and rebuild trustworthy services.
The Anatomy of a Cyberattack
Reconstruct attacker access, permissions, persistence, and data effects from incomplete observations without forcing a tidy story.
Watch lessonDetection: Finding the Signal in the Noise
Test the telemetry-to-responder chain and connect detections to decisions and known blind spots.
Watch lessonDigital Forensics and Evidence Preservation
Preserve evidence with provenance, custody, and context across devices, cloud, and SaaS.
Watch lessonContainment: Stopping the Bleeding
Choose and verify containment actions by expected effect, business impact, and access routes they do not block.
Watch lessonEradication: Removing the Attacker
Remove attacker capabilities and persistence, rebuild untrusted systems, rotate credentials, and prove access is gone.
Watch lessonRecovery: Rebuilding Trust
Restore services from a trusted recovery plane using security checks, business-data reconciliation, and explicit release gates.
Watch lessonThe Human Side of a Cyber Crisis
Lead decisions, communication, obligations, and partner coordination under pressure.
Leading Under Pressure
Make accountable decisions under uncertainty, invite challenge, set checkpoints, and manage fatigue and handover.
Watch lessonCrisis Communication
Coordinate internal and external messages from verified facts, communicate uncertainty, and protect the emergency channel.
Watch lessonLegal, Regulatory, and Reporting Obligations
Map privacy, sector, contractual, and other notification duties to the right entities, thresholds, owners, and clocks.
Watch lessonThe Ransomware Negotiation Dilemma
Separate contact, payment, restoration, notification, and public-messaging decisions during ransomware extortion.
Watch lessonThird Parties, Supply Chains, and Shared Responsibility
Map supplier authority and shared dependencies while coordinating evidence, containment, and communication across organizations.
Watch lessonThe Modern Cyber Battlefield
Apply incident response to cloud, infrastructure, AI, and cyber-physical systems.
Cloud and Identity Under Attack
Investigate cloud and SaaS incidents through identities, sessions, applications, permissions, and verified revocation.
Watch lessonWhen the Infrastructure Becomes the Target
Treat virtualization, backup, storage, and management control planes as high-impact targets and plan trusted recovery around them.
Watch lessonAI-Powered Attacks and AI System Incidents
Distinguish attacker use of AI from incidents in AI systems or responder tools, then trace data, tools, actions, and versions.
Watch lessonCyber-Physical Incidents
Coordinate cyber containment with qualified operational personnel where digital actions may affect physical safety and service recovery.
Watch lesson