Cyber Incident Response and Penetration Testing

Catalog description

This course will discuss detection, management, and recovery from different types of incidents. Detecting and responding to security incidents are important parts of managing information security in an organization. Despite the best security infrastructure and policies in place, security incidents are inevitable. Each type of incident requires a specific handling process. Students will learn to identify the data sources, e.g. log files, and how to process the data into a meaningful analysis format. The class will cover analysis of individual files, as well as techniques to correlate information across multiple log sources to build a chain of evidence across those log files. Students will perform hands-on work during the tutorial using data sets that are representative of real life incidents. By the end of class, students will understand and be able to perform full scale cyber incident response. Prerequisite(s): B FOR 204, B FOR 206, and B FOR 305.