Security & incident response

Attack vectors, crisis preparation, detection and recovery — plus practical work.

Live simulation

The class was split into two teams working the same incident. Every 15 minutes new information came in — sometimes as a simulated press call — and we had to decide the next steps with incomplete information.

TryHackMe

The Sakura room: tracking a threat actor through public information (OSINT).

What I learned

• Attackers often sit inside a network for a long time before anyone notices
• Preparation decides the outcome — improvising during a breach goes badly
• The human side (phishing, social engineering) is usually the weakest link