{"id":137,"date":"2016-02-26T09:21:05","date_gmt":"2016-02-26T17:21:05","guid":{"rendered":"http:\/\/iacis.com\/?page_id=137"},"modified":"2025-04-05T12:48:38","modified_gmt":"2025-04-05T16:48:38","slug":"cyber-incident-forensics-response","status":"publish","type":"page","link":"https:\/\/allprowebworks.dev\/_iacis\/training\/cyber-incident-forensics-response\/","title":{"rendered":"CIFR: Cyber Incident Forensic Response"},"content":{"rendered":"

The concept of the IACIS intrusion investigation training class was born when one of the instructors retired from law enforcement and started working Incident Response consulting.\u00a0 He quickly realized that there were gaps in his forensic knowledge that hindered his ability to quickly and accurately support corporate clients who were victims of a cyber intrusion (\u201cimaging a shutdown Windows system is easy, but what\u2019s ESXi and how do I get an image out of it?\u201d).\u00a0 These gaps were further highlighted when LE peers asked for advice or recommendations for training or skill development. A list of primary functional skills was developed and provided to peers wanting to update or improve their skills in the IR arena. Unfortunately, there wasn\u2019t any single class that covered most of these skills, much less all of them.\u00a0 So, it was decided to develop a one-week class, which quickly turned into a two-week class that focused on providing investigative functionality in most of these skill areas.\u00a0 This class became the IACIS Cyber Incident Forensic Response (CIFR) class, which focuses on teaching the combined lists of investigation concepts.\u00a0 While the class doesn\u2019t make a student an expert in all these areas, the level of training is deep and broad enough so the student understands the concepts and processes and can competently apply them to an investigation.\u00a0 The intent is to provide \u201ca 12-inch deep and a mile wide\u201d approach to a broad range of investigation skills, vs. having to spend many thousands of dollars for 5 days on an \u201cinch wide and an unnecessary mile deep\u201d single topic, then many thousands of dollars for 5 days on yet another single topic.<\/p>\n

CIFR uses a real network environment in the classroom to simulate a corporate network, integrating actual network and domain architecture into the instruction to increase realism. Students interact with Windows and Linux VMs in the class and are shown how their actions are presented at the local, domain, and SIEM logging levels. The class has a large number of labs, based on a belief the student learns better by doing the task vs reading about the task in bullets on a slide presentation.<\/p>\n

The typical class attendees include:<\/p>\n