Introductory description

A cyber security incident can have a significant impact on the operational efficiency of a business. There are essential mechanisms and skillset that can be utilised to allow a potential attack against infrastructure to be effectively identified, managed and mitigated in a timely manner.
This module aspires to equip students with these skills and consists of two main parts. First, it explores the principles of responding to a cyber security incident and the incident response lifecycle. Second, it focuses on familiarising the students with the scientific techniques utilised for the technical analysis of the systems involved in a cyber security incident.

Module aims

Outline syllabus

This is an indicative module outline only to give an indication of the sort of topics that may be covered. Actual sessions held may differ.

The module follows the incident response lifecycle:

• Preparation for responding to a cyber security incident and forensic readiness
• Understanding a threat - threat hunting
• Identification of a cyber security incident - detection methods, first response and management
• Intrusion analysis, monitoring and logging
• Digital forensics process in incident response - collection and preservation
• Investigation techniques
• Host forensics
• Network collection and analysis - log analysis
• Malware handling
• Cyber security incident remediation
• The future of cyber incident response

This is an indicative module outline and actual sessions held may differ.

Learning outcomes

By the end of the module, students should be able to:

• Comprehensively identify the different phases comprising the incident response lifecycle
• Critically evaluate the principles of cyber incident management across diverse scenarios
• Demonstrate the ability to analyse an individual approach of responding to a cyber security incident with the application of relevant techniques
• Evaluate and provide sound reasoning for suitable responses to identified cyber security incidents

Indicative reading list

Reading lists can be found in Talis

Specific reading list for the module

Interdisciplinary

There is some interdisciplinary element relevant to the nature of the digital forensics part of the module. It involves relevant law elements.

Subject specific skills

Incident response lifecycle and practices, investigation principles, evaluation of a cyber security incident, host based analysis, network based analysis

Transferable skills

Problem solving, critical thinking, digital literacy, information literacy, ethical values, communication.