G³CYBER · SE · IT/OT DEFENSEG³ Bootcamp LMS← CONSTRUCT
All weeks
← Week 14Week 16 →
WEEK 15

Incident Response, Forensics & Exec Communication

Operational scenario

Ransomware notes appeared on two workstations at 6 a.m. Contain it, preserve evidence, and brief the CEO by 9.

Week completion
0%
~10 hours this week
Assessment: IR tabletop (10%); knowledge check 14
Deliverable: IR report + executive summary
Learning objectives
  • Run the IR lifecycle
  • Handle evidence
  • Brief executives without fearmongering
Classroom topics
  • Prep → detect → analyze → contain → eradicate → recover → lessons
  • Evidence handling: disk / memory / network / email / log
  • Escalation & crisis comms
  • Executive briefings
  • Inherent vs residual risk
  • Golden Ticket Access concept
Standards · vocabulary
NIST SP 800-61r3ISO 27035SP 800-86
RTORPOBCPDRChain of custody
Open glossary
Competency demonstrated: Runs IR and communicates to executives.

Four-mode learning matrix

~1.5 h
Physical hands-on lab

Acquire a disk / memory image from a lab machine (documented).

~2 h
Docker container lab

Lab 16 — Restore the environment and validate remediation.

~0.5 h
AR/VR immersive scenario

Present findings in a virtual executive briefing room. Role: Incident responder.

No headset? Desktop briefing-deck exercise. Printed and mobile versions are also available.

Individual technical assignment

Run one IR tabletop (ransomware / phishing / insider / OT).

Team exercise

Tabletop: contain a simulated incident + after-action review.

Required hardware
  • Imaging tool
  • Evidence bags / labels
Required software
  • FTK Imager / dd (lab)
  • IR templates
Workplace application

Calm, clear executive communication during an incident decides budgets and careers.

Docker progression step
L16 Restoring the environment and validating remediation

Restore from snapshot, apply remediation, and re-run steps 4, 12 and 15 to prove closure.

Open the Docker range
Lab evidence to collect
Safety controls — confirm before starting
Controls practiced this week
Risk assessmentData recovery & continuityIncident response
See the full crosswalk
Reflection & rubric for week 15