Incident Response Training (DFIR)

COURSE OVERVIEW

Digital Forensics and Incident Response (DFIR) is among the most demanding and most critical disciplines in modern cybersecurity. It requires the technical depth to understand attack techniques, the forensic rigour to preserve evidence while containing a live threat, the analytical skill to reconstruct what happened, and the composure to make consequential decisions under pressure — often in the middle of the night.

Our DFIR Training Programme builds these capabilities systematically — combining technical instruction with realistic scenario exercises that simulate the conditions of a real incident. Our trainers are practitioners who have managed real incidents: they bring authenticity to the classroom that classroom-only instructors cannot match.

WHY THIS TRAINING MATTERS

• IBM research shows that organisations without trained incident response teams suffer breaches that cost 58% more than organisations with tested IR capabilities.
• Nigerian regulators — including the CBN and NITDA — mandate incident response plans and trained response capability for regulated entities. Staff who have never been trained cannot execute these plans effectively.
• Law enforcement agencies increasingly need officers trained in DFIR to investigate cybercrime: the ability to respond to a compromise, preserve evidence, and hand off to forensic examiners is a core investigative skill.
• We have delivered DFIR training to NgCERT, NDFL, the Nigeria Joint Case Team for Cybercrime, and law enforcement agents in Liberia — making this programme battle-tested at the highest levels.

WHAT YOU WILL LEARN

Incident Response Fundamentals: The incident response lifecycle — preparation, identification, containment, eradication, recovery, and lessons learned — and the roles and responsibilities of an effective IR team.

Threat Identification and Triage: Rapidly assessing the nature and scope of an incident from initial indicators, prioritising response actions, and making containment decisions under time pressure.

Evidence Preservation During Active Response: The critical skill of containing an incident without destroying the evidence needed for investigation — chain-of-custody discipline in a live environment.

Malware Analysis Fundamentals: Identifying malicious code, understanding its behaviour, and determining the scope of its impact — the foundation of effective eradication.

Memory and Volatile Data Acquisition: Capturing live system state — running processes, network connections, and memory contents — before a system is taken offline.

Network Traffic Analysis in Incident Response: Using network data to trace attacker activity, identify exfiltration, and understand the full scope of a compromise.

Threat Eradication and Recovery: Removing attacker persistence, closing backdoors, and verifying the integrity of systems before they are returned to production.

Regulatory Notification and Reporting: Understanding notification obligations, preparing incident reports for management and regulators, and communicating effectively during and after an incident.

WHO SHOULD ATTEND

Cybersecurity analysts and engineers, IT managers, law enforcement investigators handling cybercrime, SOC personnel, compliance and risk officers in regulated industries, and anyone building or leading an incident response function.