Cyber Incident Handling

Triage and basic incident handling Creating incident handling procedures and testing Large scale incident handling Cooperation with Law Enforcement agencies Identifying and handling cyber-crime traces Incident handling and cooperation during phishing campaign Law enforcement view of computer security incidents Law enforcement needs for evidence analysis Role of (tabletop) exercises in developing incident handling capability

NB! This course will take place in autumn semester 2025/2026 which starts on 1st of September and ends on 25th of January (you can find that information under Start date section). TalTech's timetables for Autumn semester 2025 will be published at the end of June via tunniplaan.taltech.ee. Switch the page to English and use "Search" and "Open detailed search" to find your course. NB! Some courses are taught by several lecturers during the same semester. Make sure that the course name and lecturer/teacher infromation of your course match with the information given in the Course Catalogue.

After completing this course, the student:

• is able to establish incident handling team and typical team designs;
• manages cyber incidents, preserving needed evidence and chain of evidence;
• builds incident management system and manages cooperation between law enforcement and incident handlers;
• establishes procedures for evidence and incident management.

Final assessment can consist of one test/assignment or several smaller assignments completed during the whole course. After declaring a course the student can re-sit the exam/assessment once. Assessment can be graded or non-graded. For specific information about the assessment process please get in touch with the contact person of this course. For specific information about grade transfer please contact your home university

Thursdays 18:00 - 21:00 (Tallinn time)

• Kursuse Moodle'i lehel. // On the course Moodle page. Link in the extended syllabus.
• Kui te ei ole küberkaitse magistriõppe üliõpilane, palun võtke parooli saamiseks ühendust õppejõuga. // If you are not a Cyber Security MSc student, please contact the professor for the password.

lectures, exercises