Featuring a comprehensive set of paper-based exercises, the workshop provides hands-on experience in both detecting and responding to typical real-life incidents.

Participants are provided with a brief introduction that sets the context for the incident, a generic incident handling process and an incident report template. In addition, they are provided with a set of artefacts that include real-world indicators of compromise that they must analyse to identify and respond to a set of incidents.

Participants must then follow the process provided to analyse the information and filter the “noise” from what is meaningful and useful. They will be expected to perform incident handling activities including detection, triage, analysis, containment, eradication and recovery, while communicating and escalating issues to management and relevant stakeholders (represented by the workshop facilitators).

The workshop has been specifically developed to ensure that participants go through all the incident handling steps and do not get stuck in the incident detection phase. The timeline of the workshop is designed to provide participants with hints and prompts to ensure they detect the incidents before the allocated time expires.