Course Overview

Cybersecurity incidents can disrupt operations, damage reputations, and expose organisations to significant financial and regulatory risks. To effectively manage these threats, organisations need structured incident detection, response, and recovery capabilities aligned with recognised cybersecurity frameworks and industry best practices.

The CyberSec First Responder (CFR) Programme by Transformentors Academy provides participants with the knowledge and practical skills required to identify, analyse, contain, investigate, and respond to cybersecurity incidents across modern IT environments. The programme follows internationally recognised standards and frameworks, including NIST SP 800-61r2, NIST SP 800-171r2, the US-CERT National Cyber Incident Response Plan (NCIRP), and PPD-41 Cyber Incident Coordination principles.

Participants will explore network defence techniques, threat detection methodologies, incident handling procedures, cybersecurity risk management, security monitoring, threat intelligence, and incident reporting processes. Through practical exercises and real-world scenarios, they will learn how to respond effectively to security events while supporting organisational resilience and business continuity.

By the end of the programme, participants will be equipped to monitor security incidents, apply structured response procedures, support forensic investigations, and contribute to the protection of organisational information systems. The programme also supports preparation for the CertNexus CyberSec First Responder (CFR-410) certification and aligns with key cybersecurity workforce roles.

Agenda

Day — 1

Lesson 1: Assessing Cybersecurity Risk

• Understanding the importance of cybersecurity risk management in protecting organisational assets.
• Identifying key risk management principles and frameworks.
• Assessing cyber risks, threats, vulnerabilities, and business impacts.
• Applying risk assessment techniques to evaluate security exposures.
• Exploring risk mitigation strategies and security controls.
• Understanding risk treatment options and decision-making processes.
• Integrating policies, procedures, and documentation into risk management activities.
• Maintaining accurate risk records to support governance, compliance, and continuous improvement.

Day — 2

Lesson 2: Analysing the Threat Landscape

• Classifying cybersecurity threats, threat actors, and attack methods.
• Understanding the impact of emerging threats on organisational security.
• Analysing trends that influence security posture and cyber risk.
• Identifying evolving attack techniques and threat patterns.

Lesson 3: Analysing Reconnaissance Threats to Computing and Network Environments

• Understanding threat modelling concepts and methodologies.
• Applying threat modelling techniques to identify potential attack paths.
• Assessing the impact of reconnaissance activities on systems and networks.
• Identifying information gathering techniques used by threat actors.
• Understanding social engineering attacks and their business impact.
• Assessing risks associated with phishing, impersonation, and other social engineering techniques.
• Applying controls to reduce reconnaissance and social engineering risks.

Day — 3

Lesson 4: Analysing Attacks on Computing and Network Environments

• Understanding common attacks targeting computing and network environments.
• Assessing the impact of system hacking techniques on organisational security.
• Identifying vulnerabilities commonly exploited in systems and networks.
• Understanding web-based attacks and their effects on applications and services.
• Assessing risks associated with web application vulnerabilities and exploits.
• Understanding different types of malware and their attack methods.
• Assessing the impact of malware on systems, networks, and business operations.
• Identifying security controls and countermeasures to reduce attack risks.

Day — 4

Continued Lesson 4: Analysing Attacks on Computing and Network Environments

• Assessing the impact of session hijacking and impersonation attacks.
• Understanding techniques used to compromise user identities and sessions.
• Identifying controls to prevent unauthorised access and identity misuse.
• Assessing the impact of Denial of Service (DoS) and Distributed Denial of Service (DDoS) incidents.
• Understanding how service disruption attacks affect business operations and availability.
• Identifying threats targeting mobile devices, applications, and mobile users.
• Assessing mobile security risks and appropriate protection measures.
• Understanding common cloud security threats and vulnerabilities.
• Assessing risks associated with cloud environments, services, and data storage.
• Applying security controls to strengthen mobile and cloud security posture.

Day — 5

Lesson 5: Analysing Post-Attack Techniques

• Understanding post-attack activities used by threat actors after initial compromise.
• Assessing command and control (C2) techniques used to maintain communication with compromised systems.
• Identifying persistence mechanisms used to retain long-term access.
• Understanding lateral movement and pivoting techniques within compromised networks.
• Assessing the risks associated with unauthorised access expansion across systems.
• Identifying common data exfiltration methods used to steal sensitive information.
• Understanding the impact of data loss and information leakage incidents.
• Assessing anti-forensics techniques used to conceal malicious activities and evade detection.
• Applying detection and monitoring strategies to identify post-attack behaviours.

Day — 6

Lesson 6: Assessing the Organisation’s Security Posture

• Understanding the role of cybersecurity auditing in evaluating security effectiveness.
• Implementing cybersecurity audit processes and controls.
• Developing and maintaining a vulnerability management programme.
• Identifying, prioritising, and tracking security vulnerabilities.
• Assessing vulnerabilities across systems, networks, and applications.
• Understanding vulnerability assessment methodologies and reporting.
• Exploring penetration testing concepts, phases, and objectives.
• Conducting penetration testing activities to validate security controls and identify weaknesses.

Day — 7

Lesson 7: Collecting Cybersecurity Intelligence

• Understanding the role of cybersecurity intelligence in threat detection and response.
• Deploying security intelligence collection and analysis platforms.
• Collecting data from network-based intelligence sources.
• Collecting data from host-based intelligence sources.
• Correlating intelligence data to identify potential threats and security incidents.

Lesson 8: Analysing Log Data

• Understanding the importance of log analysis in cybersecurity operations.
• Using common tools to collect, review, and analyse log data.
• Identifying indicators of compromise and suspicious activities from logs.
• Using Security Information and Event Management (SIEM) tools for monitoring and analysis.
• Correlating events and alerts to support threat detection and incident investigation.

Day — 8

Lesson 9: Performing Active Asset and Network Analysis

• Understanding the role of active analysis in incident detection and investigation.
• Using Windows-based tools to analyse security incidents and system activity.
• Using Linux-based tools to investigate security events and network behaviour.
• Examining system, network, and endpoint data to identify suspicious activities.
• Identifying and analysing Indicators of Compromise (IoCs).
• Correlating evidence from multiple sources to support incident investigations.
• Applying analysis techniques to improve threat detection and response effectiveness.

Day — 9

Lesson 10: Responding to Cybersecurity Incidents

• Understanding incident handling and response frameworks.
• Deploying an incident response architecture and escalation process.
• Applying containment, eradication, and recovery procedures.
• Mitigating security incidents to minimise business impact.
• Coordinating response activities across teams and stakeholders.
• Documenting incident response actions and findings.
• Preparing and transferring incident information for forensic investigation.
• Supporting post-incident analysis and lessons learned activities.

Day — 10

Lesson 11: Investigating Cybersecurity Incidents

• Understanding the principles of digital forensic investigations.
• Applying a structured forensic investigation plan.
• Collecting and preserving electronic evidence securely.
• Analysing digital evidence to identify incident causes and impacts.
• Maintaining evidence integrity and chain of custody requirements.
• Documenting investigation findings and forensic results.
• Following up on investigation outcomes and corrective actions.
• Supporting continuous improvement through lessons learned and recommendations.

Learning Outcomes

By the end of this programme, participants will be able to:

• Assess cybersecurity risks and their impact on organisational operations.
• Analyse the current threat landscape and emerging cyber threats.
• Identify reconnaissance activities targeting computing and network environments.
• Analyse common attacks against systems, applications, and networks.
• Understand post-attack techniques used by threat actors.
• Assess security posture through auditing, vulnerability management, and penetration testing activities.
• Collect and interpret cybersecurity intelligence from network and host-based sources.
• Analyse security logs to identify threats, anomalies, and incidents.
• Perform asset and network analysis to support incident detection.
• Respond to cybersecurity incidents using containment, mitigation, and recovery techniques.
• Investigate cybersecurity incidents using digital forensic principles and methodologies.

Who Should Attend

This programme is designed for professionals involved in cybersecurity operations, cyber defence, and incident response, including:

• Cybersecurity Practitioners and Security Analysts.
• SOC Analysts and Security Operations Team Members.
• Incident Response and Cyber Defence Professionals.
• IT and Cybersecurity Staff responsible for monitoring and protecting information systems.
• Professionals involved in Defensive Cyber Operations (DCO) and incident handling activities.
• Team members seeking a structured understanding of cyber defence responsibilities.
• Professionals preparing for cybersecurity defence, monitoring, and incident response roles.

Prerequisites

Participants should ideally have:

• Basic experience or education in cybersecurity, network security, or a related field.
• An understanding of common cybersecurity threats, vulnerabilities, and risk management concepts.
• Familiarity with security technologies such as firewalls, IDS/IPS, VPNs, and anti-malware solutions.
• Basic knowledge of authentication, authorisation, and access control concepts.
• Working knowledge of common operating systems and computing environments.
• Foundational understanding of networking concepts, including routing and switching.
• Basic knowledge of TCP/IP networking protocols such as TCP, IP, UDP, DNS, HTTP, ARP, ICMP, and DHCP.