Cyber Incident Handling

Triage and basic incident handling Creating incident handling procedures and testing Large scale incident handling Cooperation with Law Enforcement agencies Identifying and handling cyber-crime traces Incident handling and cooperation during phishing campaign Law enforcement view of computer security incidents Law enforcement needs for evidence analysis Role of (tabletop) exercises in developing incident handling capability

NB! This course will take place in spring semester 2024/2025 which starts on 3rd of February and ends on 16th of June (you can find that information under Start date section). The real course start and end dates will be announced at the beginning of February at the latest.

After completing this course, the student:

• is able to establish incident handling team and typical team designs;
• manages cyber incidents, preserving needed evidence and chain of evidence;
• builds incident management system and manages cooperation between law enforcement and incident handlers;
• establishes procedures for evidence and incident management.

Final assessment can consist of one test/assignment or several smaller assignments completed during the whole course. After declaring a course the student can re-sit the exam/assessment once. Assessment can be graded or non-graded. For specific information about the assessment process please get in touch with the contact person of this course. For specific information about grade transfer please contact your home university

Thursdays 18:00 - 21:00

• Kursuse Moodle'i lehel. // On the course Moodle page. Link in the extended syllabus.
• Kui te ei ole küberkaitse magistriõppe üliõpilane, palun võtke parooli saamiseks ühendust õppejõuga. // If you are not a Cyber Security MSc student, please contact the professor for the password.

lectures, exercises