Cyber Incident Handling

Triage and basic incident handling 

Creating incident handling procedures and testing Large scale incident handling Cooperation with Law Enforcement agencies Identifying and handling cyber-crime traces Incident handling and cooperation during phishing campaign Law enforcement view of computer security incidents Law enforcement needs for evidence analysis Role of (tabletop) exercises in developing incident handling capability

NB! This course will take place in autumn semester 2024/2025 which starts on 2nd of September and ends 26th of January (you can find that information under Start date section). The real course start and end dates will be announced at the beginning of September at the latest.

After completing this course, the student:

• is able to establish incident handling team and typical team designs;
• manages cyber incidents, preserving needed evidence and chain of evidence;
• builds incident management system and manages cooperation between law enforcement and incident handlers;
• establishes procedures for evidence and incident management.

Final assessment can consist of one test/assignment or several smaller assignments completed during the whole course. After declaring a course the student can re-sit the exam/assessment once. Assessment can be graded or non-graded. For specific information about the assessment process please get in touch with the contact person of this course. For specific information about grade transfer please contact your home university

Thursdays 18:00 - 21:00

• Kursuse Moodle'i lehel. // On the course Moodle page. Link in the extended syllabus.
• Kui te ei ole küberkaitse magistriõppe üliõpilane, palun võtke parooli saamiseks ühendust õppejõuga. // If you are not a Cyber Security MSc student, please contact the professor for the password.

lectures, exercises