Cyber Defense Incident Responder

• 470Coordinate and provide expert technical support to enterprise-wide cyber defense technicians to resolve cyber defense incidents.Core
• 478Correlate incident data to identify specific vulnerabilities and make recommendations that enable expeditious remediation.Additional
• 716AMonitor external data sources (e.g., cyber defense vendor sites, Computer Emergency Response Teams, Security Focus) to maintain currency of cyber defense threat condition and determine which security issues may have an impact on the enterprise.Core
• 738Perform analysis of log files from a variety of sources (e.g., individual host logs, network traffic logs, firewall logs, and intrusion detection system [IDS] logs) to identify possible threats to network security.Additional
• 741ACoordinate incident response functions.Core
• 743Perform cyber defense incident triage, to include determining scope, urgency, and potential impact; identifying the specific vulnerability; and making recommendations that enable expeditious remediation.Additional
• 745Perform cyber defense trend analysis and reporting.Core
• 755Perform initial, forensically sound collection of images and inspect to discern possible mitigation/remediation on enterprise systems.Core
• 762Perform real-time cyber defense incident handling (e.g., forensic collections, intrusion correlation and tracking, threat analysis, and direct system remediation) tasks to support deployable Incident Response Teams (IRTs).Additional
• 823Receive and analyze network alerts from various sources within the enterprise and determine possible causes of such alerts.Core
• 861Track and document cyber defense incidents from initial detection through final resolution.Additional
• 882Write and publish cyber defense techniques, guidance, and reports on incident findings to appropriate constituencies.Core
• 961Employ approved defense-in-depth principles and practices (e.g., defense-in-multiple places, layered defenses, security robustness).Additional
• 1030Collect intrusion artifacts (e.g., source code, malware, trojans) and use discovered data to enable mitigation of potential cyber defense incidents within the enterprise.Core
• 1031Serve as technical expert and liaison to law enforcement personnel and explain incident details as required.Additional
• 2179Coordinate with intelligence analysts to correlate threat assessment data.Additional
• 5670Write and publish after action reviews.Core

• 22* Knowledge of computer networking concepts and protocols, and network security methodologies.Core
• 29Knowledge of data backup, types of backups (e.g., full, incremental), and recovery concepts and tools.Additional
• 37Knowledge of disaster recovery continuity of operations plans.Core
• 49Knowledge of host/network access control mechanisms (e.g., access control list).Additional
• 50Knowledge of how network services and protocols interact to provide network communications.Core
• 60Knowledge of incident categories, incident responses, and timelines for responses.Core
• 61Knowledge of incident response and handling methodologies.Core
• 66Knowledge of intrusion detection methodologies and techniques for detecting host and network-based intrusions via intrusion detection technologies.Core
• 81AKnowledge of network protocols such as TCP/IP, Dynamic Host Configuration, Domain Name System (DNS), and directory services.Core
• 87Knowledge of network traffic analysis methods.Additional
• 93Knowledge of packet-level analysis.Additional
• 105Knowledge of system and application security threats and vulnerabilities (e.g., buffer overflow, mobile code, cross-site scripting, Procedural Language/Structured Query Language [PL/SQL] and injections, race conditions, covert channel, replay, return-oriented attacks, malicious code).Core
• 108* Knowledge of risk management processes (e.g., methods for assessing and mitigating risk).Core
• 150Knowledge of what constitutes a network attack and the relationship to both threats and vulnerabilities.Core
• 984Knowledge of cyber defense policies, procedures, and regulations.Core
• 991Knowledge of different classes of attacks (e.g., passive, active, insider, close-in, distribution).Core
• 992CKnowledge of threat environments (e.g., threat actors, threat activities).Core
• 1029AKnowledge of malware analysis concepts and methodologies.Core
• 1033Knowledge of basic system administration, network, and operating system hardening techniques.Core
• 1069Knowledge of general attack stages (e.g., foot printing and scanning, enumeration, gaining access, escalation of privileges, maintaining access, network exploitation, covering tracks).Core
• 1072Knowledge of network security architecture concepts including topology, protocols, components, and principles (e.g., application of defense-in-depth, Zero Trust).Core
• 1141AKnowledge of an organization's information classification program and procedures for information compromise.Additional
• 1157* Knowledge of national and international laws, regulations, policies, and ethics as they relate to cybersecurity.Core
• 1158* Knowledge of cybersecurity principles.Core
• 1159* Knowledge of cyber threats and vulnerabilities.Core
• 3362AKnowledge of key factors of the operational environment and related threats and vulnerabilities.Additional
• 3431Knowledge of OSI model and underlying network protocols (e.g., TCP/IP).Core
• 3561Knowledge of the common networking and routing protocols(e.g., TCP/IP), services (e.g., web, mail, DNS), and how they interact to provide network communications.Additional
• 6210Knowledge of cloud service models and possible limitations for an incident response.Core
• 6900* Knowledge of specific operational impacts of cybersecurity lapses.Core
• 6935* Knowledge of cloud computing service models Software as Service (SaaS), Infrastructure as a Service (IaaS), and Platform as a Service (PaaS).Core
• 6938* Knowledge of cloud computing deployment models in private, public, and hybrid environment and the difference between on-premises and off-premises environments.Core
• 7111* Knowledge of Zero Trust Security Model Principles.Core

• 153Skill of identifying, capturing, containing, and reporting malware.Core
• 217Skill in preserving evidence integrity according to standard operating procedures or national standards.Core
• 893Skill in securing network communications.Core
• 895Skill in recognizing and categorizing types of vulnerabilities and associated attacks.Core
• 896Skill in protecting a network against malware.Core
• 897Skill in performing damage assessments.Core
• 923ASkill in using security event correlation tools.Core

The DCWF Tool lists no abilities for this work role.