The concept of the IACIS intrusion investigation course was born when one of the instructors retired from law enforcement and started working Incident Response consulting. He quickly realized that there were gaps in his forensic knowledge that hindered his ability to quickly and accurately support corporate clients who were victims of a cyber intrusion (“imaging a shutdown Windows system is easy, but what’s ESXi and how do I get an image out of it?”). These gaps were further highlighted when LE peers asked for advice or recommendations for training or skill development. A list of primary functional skills was developed and provided to peers wanting to update or improve their skills in the IR arena. Unfortunately, there wasn’t any single course that covered most of these skills, much less all of them. So, it was decided to develop a one-week course, which quickly turned into a two-week course that focused on providing investigative functionality in most of these skill areas. This course became the IACIS Cyber Incident Forensic Response (CIFR) course, which focuses on teaching the combined lists of investigation concepts. While the course doesn’t make a student an expert in all these areas, the level of training is deep and broad enough so the student understands the concepts and processes and can competently apply them to an investigation. The intent is to provide “a 12-inch deep and a mile wide” approach to a broad range of investigation skills, vs. having to spend many thousands of dollars for 5 days on an “inch wide and an unnecessary mile deep” single topic, then many thousands of dollars for 5 days on yet another single topic.
CIFR uses a real network environment in the classroom to simulate a corporate network, integrating actual network and domain architecture into the instruction to increase realism. Students interact with Windows and Linux VMs in the class and are shown how their actions are presented at the local, domain, and SIEM logging levels. The course has a large number of labs, based on a belief the student learns better by doing the task vs reading about the task in bullets on a slide presentation.
The typical course attendees include:
- LE conducting or supporting intrusion investigations
- LE who have completed many other classes and are looking for something to grow their skillset
- Corporate IT security
- Corporate IT admins
- Academia
