• Kaspersky has added a new Windows Digital Forensics course to its Expert Training Portfolio.
• The course will teach participants how to detect traces of an attack’s development and reconstruct an incident scenario.
• The course was designed by Kaspersky’s Digital Forensics and Incident Response Group Manager, Ayman Shaaban.

When it comes to cybersecurity, prevention is often better than a cure and and knowing how an attack was executed can help prevent future attacks from taking place at all. Piecing together how an attack happened and gather more valuable information is the job of digital forensic investigators.

Digital forensics, is the core of a new cybersecurity course Kaspersky has added to its Expert Training Portfolio.

“The ‘Windows Digital Forensics’ course is designed to provide trainees with a fundamental understanding of digital forensics, offering them valuable insights and hands-on experience. The ability to detect digital traces of an attack’s development is one of the most valuable skills for cybersecurity professionals, as attacks can occur even if all prevention measures are in place,” says Kaspersky.

In this course, participants will learn how to obtain digital evidence, find traces of malicious actions and use Windows artifacts to reconstruct an incident scenario. Kaspersky will also teach participants how to analyse browser and email histories.

The course was designed by Kaspersky’s Digital Forensics and Incident Response Group Manager, Ayman Shaaban.

Once complete, those who have taken the course will be proficient in incident scoping, evidence acquisition, log file analysis, network analysis, creation of Indicators of Compromise, and memory forensics. Participants will also be able to apply their knowledge in a virtual lab so as to gain practical knowledge of what they have learned.

The course gives learners 100 hours of access to this virtual lab.

“To achieve cyber-resilience, organisations must be prepared for incidents by managing logs centrally, retaining them for extended periods, and safeguarding them against tampering, malicious access, or accidental loss. They also need the ability to conduct forensic investigations promptly when necessary. During this training course, you will get acquainting with digital forensics as an important part of the incident response process and will be equipped with useful knowledge that helps you to swiftly handle, contain, understand and recover from cyber-attacks and effectively minimise their impact in the quickest way possible,” says Shaaban.

For those interested in Windows digital forensics, you will need basic knowledge and general troubleshooting experience with Windows.

A familiarity with Linux commands is also a requirement. You will of course need a way to access the course but thankfully whether you are on a mobile, a tablet or a laptop/desktop, you can access the course material

Kaspersky says this course is best suited for Tier 2 Analysts with an intermediate skill level. The course costs $1 400 (~R25 000) per learner and should take around six months to complete.

You can find out more about this course here.