{"id":345,"date":"2026-05-27T20:56:38","date_gmt":"2026-05-27T20:56:38","guid":{"rendered":"https:\/\/www.enders.lu\/?page_id=345"},"modified":"2026-05-27T21:27:27","modified_gmt":"2026-05-27T21:27:27","slug":"modules-gestion-des-incidents-de-securite-inc","status":"publish","type":"page","link":"https:\/\/www.enders.lu\/?page_id=345","title":{"rendered":"Modules – Gestion des incidents de s\u00e9curit\u00e9 (INC)\u00a0"},"content":{"rendered":"\n
\n

Le\u00a0th\u00e8me\u00a0\u201cGestion des incidents de s\u00e9curit\u00e9 (INC)\u201d\u00a0couvre\u00a0la\u00a0r\u00e9action\u00a0pragmatique\u00a0d\u2019une\u00a0PME face \u00e0\u00a0une\u00a0situation\u00a0suspecte\u00a0ou\u00a0av\u00e9r\u00e9e\u00a0touchant\u00a0la\u00a0cybers\u00e9curit\u00e9, les donn\u00e9es,\u00a0l\u2019information, les\u00a0acc\u00e8s, les\u00a0appareils\u00a0ou\u00a0la\u00a0confidentialit\u00e9.\u00a0<\/p>\n<\/blockquote>\n\n\n\n

Fondamentaux<\/h2>\n\n\n\n
\n\n\n\n
\n

Gestion des incidents de s\u00e9curit\u00e9 \u2013\u00a0fondamentaux\u00a0(PME)\u00a0<\/h3>\n\n\n\n

Comprendre\u00a0ce\u00a0qu\u2019est\u00a0un incident de s\u00e9curit\u00e9\u00a0en\u00a0PME :\u00a0cyber, donn\u00e9es, information,\u00a0acc\u00e8s,\u00a0appareil\u00a0ou\u00a0confidentialit\u00e9.\u00a0Distinguer\u00a0ces\u00a0incidents des\u00a0probl\u00e8mes\u00a0op\u00e9rationnels\u00a0classiques.\u00a0Introduire\u00a0les principes\u00a0simples :\u00a0signaler\u00a0vite, limiter\u00a0l\u2019impact,\u00a0garder\u00a0les\u00a0\u00e9l\u00e9ments\u00a0utiles,\u00a0communiquer\u00a0correctement.\u00a0<\/p>\n\n\n\n

MODCODE: MODSECINC001\u00a0<\/p>\n\n\n\n

Dur\u00e9e indicative : 1 heure<\/p>\n\n\n\n

Pr\u00e9-requis : Aucun<\/p>\n\n\n\n

\u00c0 l\u2019issue du module, le participant est capable de : <\/p>\n\n\n\n

    \n
  • Expliquer\u00a0ce\u00a0qu\u2019est\u00a0un incident de s\u00e9curit\u00e9\u00a0en\u00a0PME.\u00a0<\/li>\n\n\n\n
  • Distinguer\u00a0incident de s\u00e9curit\u00e9, incident\u00a0op\u00e9rationnel, doute,\u00a0erreur,\u00a0probl\u00e8me,\u00a0risque\u00a0et urgence.\u00a0<\/li>\n\n\n\n
  • Identifier\u00a0les situations qui\u00a0rel\u00e8vent\u00a0du\u00a0th\u00e8me\u00a0INC :\u00a0cyber, donn\u00e9es, information,\u00a0acc\u00e8s,\u00a0appareil,\u00a0confidentialit\u00e9.\u00a0<\/li>\n\n\n\n
  • Reconna\u00eetre\u00a0les situations qui\u00a0rel\u00e8vent\u00a0plut\u00f4t\u00a0de la\u00a0qualit\u00e9, du service client, de la\u00a0logistique, de la production\u00a0ou\u00a0des processus.\u00a0<\/li>\n\n\n\n
  • Appliquer\u00a0les principes de\u00a0base :\u00a0signaler\u00a0vite, limiter\u00a0l\u2019impact,\u00a0garder\u00a0les\u00a0\u00e9l\u00e9ments\u00a0utiles,\u00a0communiquer\u00a0factuellement.\u00a0<\/li>\n\n\n\n
  • Respecter\u00a0les\u00a0fronti\u00e8res\u00a0du\u00a0module :\u00a0pas de\u00a0traitement\u00a0juridique, forensic, technique\u00a0avanc\u00e9,\u00a0qualit\u00e9\u00a0op\u00e9rationnelle\u00a0ou\u00a0gestion\u00a0compl\u00e8te\u00a0de crise.\u00a0<\/li>\n<\/ul>\n\n\n\n
    \n<\/div>\n\n\n\n
    \n

    D\u00e9tecter\u00a0et\u00a0reconna\u00eetre\u00a0un incident de s\u00e9curit\u00e9 \u2014\u00a0signaux\u00a0d\u2019alerte\u00a0<\/h3>\n\n\n\n

    Reconna\u00eetre\u00a0les\u00a0signaux\u00a0simples\u00a0pouvant\u00a0indiquer\u00a0un incident de\u00a0s\u00e9curit\u00e9 :\u00a0messages suspects,\u00a0comportements\u00a0anormaux,\u00a0erreurs\u00a0d\u2019acc\u00e8s,\u00a0fuite\u00a0potentielle\u00a0ou\u00a0exposition\u00a0d\u2019information.\u00a0Distinguer\u00a0situation\u00a0normale, doute, incident probable et urgence\u00a0r\u00e9elle, sans diagnostic technique.\u00a0<\/p>\n\n\n\n

    MODCODE: MODSECINC002\u00a0<\/p>\n\n\n\n

    Dur\u00e9e indicative\u00a0: 1,5 heures<\/p>\n\n\n\n

    Pr\u00e9-requis : MODSECINC001\u00a0<\/p>\n\n\n\n

    \u00c0 l\u2019issue du module, le participant est capable de : <\/p>\n\n\n\n

      \n
    • Identifier\u00a0des\u00a0signaux\u00a0simples\u00a0pouvant\u00a0indiquer\u00a0un incident de s\u00e9curit\u00e9.\u00a0<\/li>\n\n\n\n
    • Distinguer\u00a0une\u00a0situation\u00a0normale, un doute, un incident probable et\u00a0une\u00a0urgence\u00a0r\u00e9elle.\u00a0<\/li>\n\n\n\n
    • Reconna\u00eetre\u00a0des\u00a0signaux\u00a0li\u00e9s\u00a0aux messages suspects,\u00a0acc\u00e8s\u00a0anormaux,\u00a0fichiers,\u00a0appareils, donn\u00e9es\u00a0ou\u00a0informations\u00a0expos\u00e9es.\u00a0<\/li>\n\n\n\n
    • Qualifier\u00a0suffisamment\u00a0une\u00a0situation pour savoir\u00a0s\u2019il\u00a0faut\u00a0alerter, sans poser de diagnostic technique.\u00a0<\/li>\n\n\n\n
    • Appliquer\u00a0le\u00a0r\u00e9flexe\u00a0:\u00a0mieux\u00a0vaut\u00a0signaler un doute\u00a0t\u00f4t\u00a0que\u00a0cacher\u00a0une\u00a0erreur.\u00a0<\/li>\n\n\n\n
    • Respecter\u00a0les\u00a0fronti\u00e8res\u00a0du\u00a0module :\u00a0pas de phishing\u00a0complet, pas de\u00a0cha\u00eene\u00a0d\u2019alerte\u00a0d\u00e9taill\u00e9e, pas de premi\u00e8res actions techniques, pas de forensic.\u00a0<\/li>\n<\/ul>\n\n\n\n
      \n<\/div>\n\n\n\n
      \n

      Cha\u00eene\u00a0d\u2019alerte\u00a0\u2014 qui\u00a0contacter\u00a0et comment signaler\u00a0<\/h3>\n\n\n\n

      D\u00e9finir\u00a0une\u00a0cha\u00eene\u00a0d\u2019alerte\u00a0simple et\u00a0maintenable\u00a0en\u00a0PME :\u00a0qui\u00a0contacter, dans\u00a0quel\u00a0ordre, par\u00a0quel\u00a0canal et avec\u00a0quelles\u00a0informations\u00a0minimales. Savoir signaler un doute\u00a0ou\u00a0incident sans\u00a0attendre\u00a0un diagnostic\u00a0complet, sans\u00a0pr\u00e9venir\u00a0trop\u00a0largement\u00a0et sans\u00a0aggraver\u00a0la situation.\u00a0<\/p>\n\n\n\n

      MODCODE: MODSECINC003<\/p>\n\n\n\n

      Dur\u00e9e indicative\u00a0: 1,5 heures<\/p>\n\n\n\n

      Pr\u00e9-requis : MODSECINC001 + MODSECINC002\u00a0<\/p>\n\n\n\n

      \u00c0 l\u2019issue du module, le participant est capable de : <\/p>\n\n\n\n

        \n
      • Expliquer\u00a0l\u2019utilit\u00e9\u00a0d\u2019une\u00a0cha\u00eene\u00a0d\u2019alerte\u00a0simple\u00a0en\u00a0cas\u00a0d\u2019incident\u00a0de s\u00e9curit\u00e9.\u00a0<\/li>\n\n\n\n
      • Identifier\u00a0qui\u00a0contacter\u00a0selon\u00a0le\u00a0contexte\u00a0PME :\u00a0responsable,\u00a0r\u00e9f\u00e9rent, IT, direction, support externe\u00a0ou\u00a0autre\u00a0point de contact\u00a0d\u00e9sign\u00e9.\u00a0<\/li>\n\n\n\n
      • Distinguer\u00a0alerte\u00a0cibl\u00e9e, communication large, escalade et\u00a0demande\u00a0d\u2019aide.\u00a0<\/li>\n\n\n\n
      • R\u00e9diger\u00a0un message\u00a0d\u2019alerte\u00a0court avec les\u00a0informations\u00a0minimales\u00a0utiles.\u00a0<\/li>\n\n\n\n
      • Appliquer\u00a0une\u00a0r\u00e8gle\u00a0simple :\u00a0alerter\u00a0t\u00f4t,\u00a0m\u00eame\u00a0si\u00a0le diagnostic\u00a0n\u2019est\u00a0pas\u00a0complet.\u00a0<\/li>\n\n\n\n
      • \u00c9viter\u00a0les\u00a0erreurs\u00a0fr\u00e9quentes\u00a0:\u00a0attendre\u00a0trop\u00a0longtemps,\u00a0pr\u00e9venir\u00a0trop de monde, effacer des\u00a0\u00e9l\u00e9ments,\u00a0minimiser\u00a0ou\u00a0improviser.\u00a0<\/li>\n<\/ul>\n\n\n\n
        \n<\/div>\n\n\n\n
        \n\n\n\n

        Mise en \u0153uvre<\/h2>\n\n\n\n
        \n\n\n\n
        \n

        Premi\u00e8res actions \u2014\u00a0contenir\u00a0l\u2019incident\u00a0sans\u00a0aggraver\u00a0<\/h3>\n\n\n\n

        Appliquer les premiers\u00a0gestes\u00a0s\u00fbrs\u00a0lorsqu\u2019un\u00a0incident de s\u00e9curit\u00e9 est\u00a0suspect\u00e9\u00a0ou\u00a0confirm\u00e9\u00a0: limiter\u00a0l\u2019impact,\u00a0arr\u00eater\u00a0une\u00a0action\u00a0risqu\u00e9e,\u00a0\u00e9viter\u00a0la diffusion, demander aide et ne pas\u00a0d\u00e9truire\u00a0d\u2019\u00e9l\u00e9ments\u00a0utiles.\u00a0Rester\u00a0simple, PME,\u00a0non technique\u00a0et sans forensic.\u00a0<\/p>\n\n\n\n

        MODCODE: MODSECINC004\u00a0\u00a0<\/p>\n\n\n\n

        Dur\u00e9e indicative : 1,5 heures<\/p>\n\n\n\n

        Pr\u00e9-requis : MODSECINC001 + MODSECINC002 + MODSECINC003\u00a0<\/p>\n\n\n\n

        \u00c0 l\u2019issue du module, le participant est capable de : <\/p>\n\n\n\n

          \n
        • Expliquer\u00a0pourquoi\u00a0les premi\u00e8res actions\u00a0peuvent\u00a0limiter\u00a0l\u2019impact\u00a0ou, au contraire,\u00a0aggraver\u00a0la situation.\u00a0<\/li>\n\n\n\n
        • Identifier\u00a0les\u00a0gestes\u00a0simples qui\u00a0peuvent\u00a0aider :\u00a0arr\u00eater\u00a0une\u00a0action\u00a0risqu\u00e9e,\u00a0isoler\u00a0prudemment,\u00a0\u00e9viter\u00a0de diffuser, demander aide.\u00a0<\/li>\n\n\n\n
        • Distinguer\u00a0action\u00a0imm\u00e9diate,\u00a0signalement, conservation\u00a0d\u2019\u00e9l\u00e9ments\u00a0utiles, communication et\u00a0d\u00e9cision\u00a0management.\u00a0<\/li>\n\n\n\n
        • Appliquer\u00a0une\u00a0checklist\u00a0courte\u00a0\u201c\u00e0 faire \/ \u00e0\u00a0\u00e9viter\u201d\u00a0selon\u00a0des\u00a0sc\u00e9narios\u00a0PME.\u00a0<\/li>\n\n\n\n
        • Reconna\u00eetre\u00a0les actions \u00e0 ne pas faire sans\u00a0instruction :\u00a0supprimer,\u00a0red\u00e9marrer,\u00a0r\u00e9pondre\u00a0\u00e0\u00a0l\u2019attaquant,\u00a0transf\u00e9rer\u00a0largement,\u00a0cacher.\u00a0<\/li>\n\n\n\n
        • Respecter\u00a0les\u00a0fronti\u00e8res\u00a0du\u00a0module :\u00a0pas de forensic, pas de\u00a0proc\u00e9dure\u00a0technique\u00a0avanc\u00e9e, pas de communication\u00a0d\u00e9taill\u00e9e, pas de\u00a0preuve\u00a0d\u00e9taill\u00e9e.\u00a0<\/li>\n<\/ul>\n\n\n\n
          \n<\/div>\n\n\n\n
          \n

          Preuves\u00a0minimales\u00a0utiles\u00a0\u2014 quoi conserver (PME)\u00a0<\/h3>\n\n\n\n

          Comprendre\u00a0quoi conserver\u00a0lors\u00a0d\u2019un incident de s\u00e9curit\u00e9\u00a0en\u00a0PME :\u00a0captures, emails, messages,\u00a0horodatage,\u00a0personnes\u00a0inform\u00e9es, actions\u00a0effectu\u00e9es\u00a0et\u00a0contexte\u00a0visible. Garder\u00a0juste\u00a0assez\u00a0de traces\u00a0utiles\u00a0pour\u00a0comprendre,\u00a0d\u00e9cider,\u00a0corriger,\u00a0communiquer\u00a0et\u00a0\u00e9ventuellement\u00a0transmettre\u00a0\u00e0 un expert, sans forensic\u00a0ni\u00a0proc\u00e9dure\u00a0juridique.\u00a0<\/p>\n\n\n\n

          MODCODE: MODSECINC005\u00a0\u00a0<\/p>\n\n\n\n

          Dur\u00e9e indicative : 1,5 heures<\/p>\n\n\n\n

          Pr\u00e9-requis : MODSECINC001 + MODSECINC002 + MODSECINC003 + MODSECINC004\u00a0\u00a0<\/p>\n\n\n\n

          \u00c0 l\u2019issue du module, le participant est capable de : <\/p>\n\n\n\n

            \n
          • Expliquer\u00a0pourquoi\u00a0conserver des\u00a0\u00e9l\u00e9ments\u00a0utiles\u00a0aide \u00e0\u00a0comprendre,\u00a0d\u00e9cider,\u00a0corriger,\u00a0communiquer\u00a0et\u00a0transmettre\u00a0\u00e0 un expert\u00a0si\u00a0n\u00e9cessaire.\u00a0<\/li>\n\n\n\n
          • Identifier\u00a0les traces\u00a0minimales\u00a0utiles\u00a0: captures, emails, messages, dates\/heures,\u00a0personnes\u00a0inform\u00e9es, actions\u00a0effectu\u00e9es\u00a0et\u00a0contexte\u00a0visible.\u00a0<\/li>\n\n\n\n
          • Distinguer\u00a0conservation\u00a0minimale\u00a0utile, documentation excessive, investigation technique et\u00a0preuve\u00a0juridique.\u00a0<\/li>\n\n\n\n
          • Appliquer\u00a0un\u00a0canevas\u00a0simple de journal incident PME.\u00a0<\/li>\n\n\n\n
          • \u00c9viter\u00a0les\u00a0mauvais\u00a0r\u00e9flexes\u00a0: modifier les\u00a0fichiers,\u00a0supprimer\u00a0les messages,\u00a0nettoyer\u00a0trop\u00a0vite, documenter de mani\u00e8re excessive\u00a0ou\u00a0mener\u00a0une\u00a0enqu\u00eate\u00a0personnelle.\u00a0<\/li>\n\n\n\n
          • Respecter\u00a0les\u00a0fronti\u00e8res\u00a0du\u00a0module :\u00a0non forensic, non\u00a0juridique,\u00a0non technique\u00a0avanc\u00e9, non\u00a0outil-d\u00e9pendant.\u00a0<\/li>\n<\/ul>\n\n\n\n
            \n<\/div>\n\n\n\n
            \n

            Communication\u00a0en\u00a0incident \u2014 interne, externe, clients\u00a0<\/h3>\n\n\n\n

            Communiquer\u00a0de mani\u00e8re\u00a0ma\u00eetris\u00e9e\u00a0pendant un incident de\u00a0s\u00e9curit\u00e9 :\u00a0qui\u00a0informe\u00a0qui, quoi dire, quoi\u00a0\u00e9viter, \u00e0 quelle\u00a0fr\u00e9quence\u00a0et avec\u00a0quel\u00a0ton.\u00a0Construire\u00a0des messages courts,\u00a0factuels\u00a0et\u00a0proportionn\u00e9s\u00a0pour les publics internes, management, clients,\u00a0partenaires\u00a0ou\u00a0support externe, sans communication de crise\u00a0lourde\u00a0ni\u00a0conseil\u00a0juridique.\u00a0<\/p>\n\n\n\n

            MODCODE: MODSECINC006\u00a0\u00a0<\/p>\n\n\n\n

            Dur\u00e9e indicative : 1,5 heures<\/p>\n\n\n\n

            Pr\u00e9-requis : MODSECINC001 + MODSECINC002 + MODSECINC003 + MODSECINC004 + MODSECINC005\u00a0<\/p>\n\n\n\n

            \u00c0 l\u2019issue du module, le participant est capable de : <\/p>\n\n\n\n