Incident Response & Digital Forensics
This programme equips IT professionals and security teams with the structured skills to detect, contain, investigate, and recover from cybersecurity incidents. Covering the full incident response lifecycle and an introduction to digital forensics, participants will leave with practical procedures they can implement immediately in their organisation.
The programme covers the full response lifecycle and then goes further than most awareness training into the evidence side. Participants work through preparation, detection and analysis, containment, eradication and recovery, and post-incident review, using a worked scenario rather than a description. The forensic half covers evidence acquisition, chain of custody, volatile data, disk and memory basics, and log analysis, with attention to the actions that destroy evidence before anyone has decided whether it will be needed. Malaysian notification obligations under the amended PDPA and the Cyber Security Act 2024 are covered as part of the response timeline rather than as an afterthought.
HRD Corp SBL-Khas Claimable
Modules
Incident Response Fundamentals
The incident response lifecycle: preparation, detection, containment, eradication, recovery, and post-incident review. Building an incident response plan from scratch.
Threat Detection and Analysis
Identifying indicators of compromise (IoC), analysing logs and alerts, using SIEM tools, and distinguishing true positives from false positives.
Containment and Eradication
Short-term and long-term containment strategies. Removing malware, closing attack vectors, and restoring systems safely without destroying forensic evidence.
Introduction to Digital Forensics
Forensic principles, chain of custody, evidence preservation, disk imaging, memory forensics basics, and working with forensic tools including Autopsy and Volatility.
Ransomware and Malware Incident Handling
Step-by-step response to ransomware attacks including isolation, communication, recovery options, and post-incident hardening. Real Malaysian and regional case studies.
Reporting and Post-Incident Review
Writing an incident report, communicating with management and regulators, lessons learned documentation, and updating defences based on findings.
Key Outcomes
- Build and execute a structured incident response plan
- Detect and analyse security incidents using log data and SIEM tools
- Apply containment and eradication procedures without compromising evidence
- Conduct a basic digital forensics investigation following chain of custody principles
- Respond to ransomware and malware incidents using a structured playbook
- Produce a professional incident report for management and regulatory audiences
Final Activity
Incident Response Tabletop Exercise. Participants work through a simulated ransomware attack scenario in teams. Each team must detect, contain, investigate, and report the incident following proper procedures, with a full debrief at the end.
Training Mode Physical / Online / Hybrid / e-learning
HRD Corp SBL-Khas Claimable
Minimum enrolment 3 participants
Duration 2 Days
Level Intermediate (basic IT security knowledge required)
Certificate included Yes