Section 24.231 Incident Response Training and Testing

Question 1

Incident Response Training and Testing

Training

Answer 1

Education to ensure employees and staff understand incident response processes, procedures, and priorities

■ Training should be tailored to different roles (e.g first responders, managers, executives, end users) with specific needs:
● End user training includes teaching them how to report incidents and remedial training for those who make mistakes

■ Capture and incorporate lessons learned from previous incidents into training to prevent their recurrence

■ Soft skills and relationship building are important in high-functioning incident response teams

Question 2

Incident Response Training and Testing

Testing

Answer 2

Practical exercise of incident response procedures to ensure the practical
application of knowledge

■ Testing helps assess the effectiveness of your response procedures

■ It can be costly, complex, and resource-intensive, depending on the scenario

Question 3

Tabletop Exercise (TTX)

Answer 3

A theoretical exercise that presents an incident response scenario

■ Discussion based
■ Participants discuss and role-play their response actions
■ Cost-effective but lacks hands-on experience
■ Useful for exploring decision-making and response planning

Question 4

Penetration Test (Pen Test)

Answer 4

A red team (attacker) attempts network intrusion based on a specific threat
modeling scenario

■ Rules of engagement and clear methodology are established beforehand

■ Popular tools and operating systems:
● Metasploit
● Cobalt Strike
● Kali Linux
● ParrotOS
● Commando OS

Awareness of these tools is crucial, as they can be used by both penetration testers and attackers

Question 5

Simulation

Answer 5

Goes beyond tabletop discussions, involving realistic, hands-on scenarios

■ Mimics actual incidents

● Simple: ○ Phishing attacks, Ransomware infections

● Complex: ○ Multi-stage attacks, Data breaches in coordination with external parties

■ Tests technical skills, decision-making under pressure, and effective communication

■ Align simulations with the organisations threat landscape and risk profile

■ Identifies gaps in incident response plans, improves team coordination, and
ensures role clarity during real incidents

■ Regularly incorporating simulations improves an organization’s readiness for
cybersecurity incidents