COURSE 016 · Rapid course
Incident response and cyber resilience
Free cybersecurity education for anyone who wants to protect people and technology. Study published lessons, examples and exercises without creating an account.
Loading this course…
Published lessons in this course
Each link opens the complete lesson on its own permanent page. New manuscript edits appear there after publication.
EN · 20 daily lessons · 4 full chapters
Lesson 1: Lesson 01 — Evidence readiness and the first case questionLesson 2: Lesson 02 — Booking invariants and behavioral baselinesLesson 3: Lesson 03 — Service paths, dependencies and degraded modesLesson 4: Lesson 04 — Authority, delegation and pre-incident rehearsalLesson 5: Lesson 05 — Scope, case record and bounded first decisionLesson 6: Lesson 06 — A bounded triage question and revisable priorityLesson 7: Lesson 07 — Preservation, timestamps and package integrityLesson 8: Lesson 08 — A source hold is a separate lifecycleLesson 9: Lesson 09 — Correlation, quiet queries and reviewer handoffLesson 10: Lesson 10 — Impact bounds, denominators and privacyLesson 11: Lesson 11 — Containment options and their service costLesson 12: Lesson 12 — Cause-specific correction and initial recovery gatesLesson 13: Lesson 13 — Backup provenance, freshness and recovery objectivesLesson 14: Lesson 14 — Evidence-linked recovery decision recordsLesson 15: Lesson 15 — Queue reconciliation before return to serviceLesson 16: Lesson 16 — Release-aware tabletop and scored handoffLesson 17: Lesson 17 — After-action review and unavailable-approver branchLesson 18: Lesson 18 — Frozen evidence, communication and improvement closureLesson 19: Lesson 19 — Message delivery and read-back as separate gatesLesson 20: Lesson 20 — Blind handoff and independent reconstructionChapter 1: Chapter 01 — Incident readiness, roles and authorized scopeChapter 2: Chapter 02 — Alert triage and evidence preservationChapter 3: Chapter 03 — Containment, eradication and recovery decisionsChapter 4: Chapter 04 — Guided incident simulation and after-action review
COURSE 016
Incident response and cyber resilience
Loading the current book and lesson guide…
View worked answers
YOUR PROGRESS · OPTIONAL
Save this lesson
Reading is open without an account. Saving progress with optional sign-in will be added later.