What to do in the first hour when there is no security team to escalate to.
It is being written. The outline below is what it will cover, and it is unlikely to change much. There is no enrolment and no date — when it is ready it will be on this page. Several of the lessons are built around tools on this site that already work, so you can practise the measurements today.
If you need this capability now rather than later, Incident response is the service that covers it, or talk to us.
IT staff at organisations without a security function, who will be the incident response team whether or not anyone has said so.
Practitioner. For people who administer these systems day to day.
No prerequisites. Nothing is assumed beyond using a computer at work.
3 modules, 10 lessons, 1 h 50 m of material. The times are the sum of the lessons rather than a round figure.
The preparation that takes an afternoon and saves the week.
Who to call, including the people whose systems you do not run — and a copy that survives the incident.
Retention windows, and discovering them now rather than on the day.
Deciding the thresholds in advance, when nobody is shouting.
Ordered so that the irreversible steps come after the reversible ones.
Triage, and the bias towards treating it as one.
Sessions, tokens, mail rules, and why a password reset alone is not containment.
Isolating rather than wiping, and what is lost by rebuilding too early.
What to collect before it rotates, and how not to contaminate it.
The part that is skipped, and the only part that changes the next one.
What they need, when, and in how much detail.
Where the duty to notify comes from, and why legal advice belongs early.
Timeline, cause, and two or three changes that are actually going to happen.
Format. Written lessons built around a worked scenario followed from alert to write-up. Delivery mechanism is not built yet.
These tools run the same checks the course teaches, and they work today. No account, and the ones marked as running in your browser send nothing anywhere.
A backup you have never restored is a hypothesis. This is how to test it.
Course outline ⟶The attacks that pass SPF, DKIM and DMARC, and the habits that catch them anyway.
Course outline ⟶Getting to an enforced policy without losing legitimate mail on the way.
Course outline ⟶This course exists because the work behind it is work we do. If you need the result rather than the skill, incident response is the service that covers it.