Introductory description

This module comprises two related but distinct themes: cyber incident response and digital forensics. The focus of the module is on investigations that respond to incidents in corporate environments, while it sets the scene on examining potential evidence based on the principles that have been established by the digital forensics community.

The cyber incident response theme concentrates on enabling an organisation to support its critical services in the face of a cyber incident. The incident response lifecycle is covered from preparation, through monitoring, detection, containment, eradication, restoration and post incident review.

The digital forensics part of the module concentrates on preserving and forensically analysing potential evidence as part of the incident response process. It sets the requirements for digital forensics within the incident response process and explores the techniques that should be followed by a digital forensics investigator.

Module aims

Outline syllabus

This is an indicative module outline only to give an indication of the sort of topics that may be covered. Actual sessions held may differ.

The content of this module will be taught from a cyber security perspective.

Planning for cyber incidents

• Incident detection
• Intrusion response: Intrusion management
• Incident handling: Intrusion analysis, monitoring and logging

Digital Forensics

• Collecting, processing and preserving digital evidence
• Host forensics
• Memory forensics
• Network collection and analysis
• Remediation and Reporting

This is an indicative module outline and actual sessions held may differ.

Learning outcomes

By the end of the module, students should be able to:

• Critically evaluate the operation of a cyber incident response plan.
• Develop an incident response plan for a given context
• Investigate digital artefacts against a realistic brief, preserving, analysing, interpreting and reporting significant material.
• Critically evaluate the significant characteristics of relevant tools and techniques.

Indicative reading list

Reading lists can be found in Talis

Specific reading list for the module

Interdisciplinary

There is some interdisciplinary element relevant to the nature of the digital forensics part of the module. It involves
relevant law elements.

Subject specific skills

Incident response lifecycle and practices, investigation principles, evaluation of a cyber security incident, host based
analysis, network based analysis

Transferable skills

Critical thinking, problem solving, communication, technical literacy