– Digital Forensics & Incident Response

Course overview

CYB-201: Intermediate Cybersecurity builds on foundational cybersecurity knowledge by equipping participants with practical skills in network defense, vulnerability management, incident response, and security operations. The course incorporates AI-powered tools to enhance threat detection, automate security analysis, and strengthen an organization's cyber resilience against evolving threats.

CYB-201: Applied Cybersecurity is designed for professionals who want to deepen their cybersecurity expertise through practical, hands-on learning. Participants explore advanced security concepts, risk management, ethical hacking techniques, and AI-enhanced security tools to proactively identify, analyze, and respond to modern cyber threats.

Course objectives

• Course Objectives – CYB-201: Applied Cybersecurity By the end of this course, participants will be able to: Strengthen the security of enterprise networks, systems, and applications. Identify, assess, and remediate security vulnerabilities using industry-standard tools. Detect, analyze, and respond to cyber incidents using structured incident response methodologies. Implement security controls to reduce organizational cyber risks. Apply ethical hacking concepts to identify and address security weaknesses. Use AI-powered cybersecurity tools for threat detection, security monitoring, and vulnerability analysis. Conduct basic digital forensics and security investigations. Develop and implement cybersecurity policies and security awareness programs. Evaluate cloud and endpoint security risks and apply appropriate protection measures. Improve organizational cyber resilience through proactive security monitoring and best practices.
• Understand the principles of digital forensics and incident response, including legal, ethical, and regulatory considerations
• Identify and classify cybersecurity incidents based on their nature, severity, and business impact
• Apply a structured incident response process to detect, contain, eradicate, recover from, and document security incidents.
• Collect, preserve, and handle digital evidence using industry best practices while maintaining the integrity and chain of custody.
• Conduct forensic investigations on computers, mobile devices, networks, cloud environments, and digital storage media.
• Analyze forensic artifacts such as system logs, memory dumps, file systems, browser history, and network traffic to determine the cause and scope of incidents.
• Use industry-standard digital forensic and incident response tools to investigate cyberattacks and security breaches.
• Develop comprehensive incident response capabilities that support coordinated investigation, evidence preservation, decision-making, and business continuity during cyber incidents.
• Enhance organizational cyber resilience by implementing structured incident response processes, conducting post-incident reviews, and applying lessons learned to improve future responses.

Who should attend

Course content

• Introduction to Digital Forensics and Incident Response DFIR concepts and lifecycle Roles and responsibilities Legal, ethical, and regulatory considerations
• Cyber Incident Detection and Analysis Types of cyber incidents Indicators of compromise (IOCs) Threat intelligence Log analysis and event correlation
• Incident Response Process Preparation Detection and analysis Containment Eradication Recovery Lessons learned
• Evidence Collection and Preservation Digital evidence fundamentals Chain of custody Evidence acquisition techniques Documentation and evidence handling
• Computer and Mobile Device Forensics Windows, Linux, and macOS forensics Mobile device investigations File system analysis Deleted file recovery
• Memory and Malware Forensics Live memory acquisition Memory analysis Malware identification and analysis Ransomware investigations
• Network and Cloud Forensics Network traffic analysis Firewall and IDS/IPS logs Cloud forensic investigations Email and web forensics
• Digital Forensic Tools and Technologies Autopsy FTK Imager Volatility Wireshark Magnet AXIOM Cellebrite Microsoft Defender XDR Splunk
• Incident Documentation and Reporting Investigation documentation Executive and technical reports Evidence presentation Legal reporting requirements
• Building an Organizational Incident Response Capability Incident response plans Incident response playbooks Team roles and communication Tabletop exercises and simulations Continuous improvement and cyber resilience
• Hands-on Digital Forensics and Incident Response Labs Investigating phishing attacks Responding to ransomware incidents Malware analysis Insider threat investigations Data breach investigations End-to-end incident response simulation

General notes

• Training materials, practical lab files, sample evidence, and reference resources will be provided.
• A certificate of completion will be awarded to participants who successfully complete the course requirements.
• No advanced programming knowledge is required; however, a basic understanding of computer systems, networking, and cybersecurity concepts is recommended.
• The course combines theory with practical, hands-on exercises using industry-standard digital forensic and incident response tools.
• Participants will work through realistic cyberattack scenarios to develop investigation and incident handling skills.
• Practical sessions include evidence collection, forensic analysis, incident containment, recovery, and reporting.
• Emphasis is placed on maintaining the integrity of digital evidence through proper documentation and chain of custody procedures.
• Participants are encouraged to bring a laptop capable of running virtual machines and forensic tools for lab exercises.
• The skills gained are applicable across government, private sector, financial services, healthcare, education, law enforcement, and other organizations responsible for protecting digital assets and responding to cyber incidents.

Frequently asked questions