Cybersecurity Operations and Incident Response 7,5 Credits
Course Contents
Cybersecurity operations are crucial to protecting an organisation’s assets’ confidentiality, integrity, and availability. The course starts with discussing key standards and frameworks for cybersecurity operations and incident response. The course includes technical concepts of network security, intrusion detection, as well as security monitoring, and digital forensics. During the course, students will gain hands-on experience of common tools and applications used for security monitoring, digital forensics, and intrusion detection.The course includes the following elements:
- Key standards and frameworks for cybersecurity operations, Security Operations Centre (SOC) concepts, blue teaming, etc.
- Key standards and frameworks for incident response (e.g., NIST SP800-61), different phases in the incident response plan, and handling of cybersecurity incidents
- Different phases of a cyberattack (e.g., Cyber Kill Chain, MITRE ATT&CK, attack trees, threat intelligence, etc.)
- Network security concepts including intrusion detection/prevention, firewalls, network admission control, virtual private networks, etc.
- Digital forensics and digital evidence, including computer and network forensics
- Security monitoring, intrusion data analysis, security information, and event management (SIEM)
Prerequisites
Passed courses at least 90 credits within the major subject in Computer Science, Informatics, Information Systems, Computer Engineering, or the equivalent, and taken course Ethical Hacking and Penetration Testing, 7,5 credits or the equivalent. Proof of English proficiency is required.Level of Education: Master
Course code/Ladok code: TCOS25
The course is conducted at: School of Engineering
