Cybersecurity Operations and Incident Response 7.5 credits

Cybersecurity operations are crucial to protecting an organisation’s assets’ confidentiality, integrity, and availability. The course starts with discussing key standards and frameworks for cybersecurity operations and incident response. The course includes technical concepts of network security, intrusion detection, as well as security monitoring, and digital forensics. During the course, students will gain hands-on experience of common tools and applications used for security monitoring, digital forensics, and intrusion detection. The course includes the following elements: - Key standards and frameworks for cybersecurity operations, Security Operations Centre (SOC) concepts, blue teaming, etc. - Key standards and frameworks for incident response (e.g., NIST SP800-61), different phases in the incident response plan, and handling of cybersecurity incidents - Different phases of a cyberattack (e.g., Cyber Kill Chain, MITRE ATT&CK, attack trees, threat intelligence, etc.) - Network security concepts including intrusion detection/prevention, firewalls, network admission control, virtual private networks, etc. - Digital forensics and digital evidence, including computer and network forensics - Security monitoring, intrusion data analysis, security information, and event management (SIEM)