Forensics, Cybercrime, and Incident Response 7.5 credits

The course starts with discussing key standards and frameworks for incident response, key concepts relating to cybercrime, and digital elements in crime. The course includes technical concepts of network security, intrusion detection, security monitoring, and digital forensics. The course will also discuss digital evidence and the process of lawful evidence collection and elaborate on how forensic principles can aid the incident response process. During the course, students will gain hands-on experience with common tools and applications used for security monitoring, digital forensics, and intrusion detection. The course includes the following elements: - Key standards and frameworks for incident response (e.g., NIST SP800-61), different phases in the incident response plan, and handling of cybersecurity incidents - Categories of cybercrime and cybercriminals - Digital forensics and digital evidence, with emphasis on memory forensics - Security monitoring, intrusion data analysis, security information, and event management (SIEM)