Workshop on Security Incident Management and Investigations

Program Overview:

Security incident investigation is just a part of a holistic security response program and management process. The overall process begins when the security team is alerted to a breach or compromise in the security of a system.

Once the malicious activity has been identified, the security team will investigate the incident to determine the scope of the incident and formulate a containment and remediation strategy that attempts to minimize the damage.

A successful incident investigation uncovers the root causes that led to an infiltration of the network by nefarious means. More importantly, incident investigations can help security teams devise effective processes to prevent future attacks.

For Whom:

This course is suitable for security managers/supervisors and personnel, company investigators, human resource professionals, site managers, safety and incident response team members, business owners, and anyone involved in incident management and investigations.

Learning Objectives:

At the end of the programme, participants will be able to:

• explain and apply the principles of Incident Management to their workplace;
• apply Incident management methodology and create a plan to recover the business quickly from a threat or incident;
• explain the basic fundamentals of an investigation;
• demonstrate how to conduct a basic internal investigation within their organization; and
• conduct a complete crime scene preservation investigation from start to finish.

Course Outline:

Day 1: Introduction to Incident Management and Investigations

• Incident management.
• Differences between an Emergency, Incident and Accident
• Security incidents and safety incidents
• Managing an incident
• Incident response
• Business Continuity Management (BCM)
• Investigation case studies
• Evidence collection and continuity of evidence
• External and internal investigations
• Locard’s Exchange Principle

Day 2: The fundamentals of Incident Management

• Initial response
• Incident classification
• Reporting and escalation procedures
• Integrated Incident Management Response
• Site-specific emergency procedures
• 5 Priorities when responding to specific Incidents
• Incident management team requirements
• Conducting debriefs post-incident
• 5C’s to Incident Management

Day 3: Application of Incident Management Plan

• What is an Incident Management Plan?
• Constructing an Incident Management Plan for your organization
• Techniques required to implement the plan
• Implement the incident management plan

Day 4: Principles of Investigations

• Locard’s Exchange Principle
• Establishing an investigative mindset
• Observation skills
• Rules of Investigation
• Planning an investigation
• Decision making process
• Working with victims and suspects
• Priorities on attending the scene
• Principles and types of search
• Types, value and collection of evidence
• Crime scene preservation
• Crime typology and how it affects investigations
• Common Questions and Answers regarding

investigations

Day 5: Investigation Methodology

• Conducting an investigation
• Investigation evaluation
• How to deal with Evidence found at the scene
• Dealing with the authorities and Police
• Understanding the legal chain of evidence
• Questioning techniques
• How to conduct a professional Interview?

Training Methodology

Lectures, discussions, exercises, case studies, audio-visual aids will be used to reinforce these teaching/learning methods.