Cybersecurity Incident Management and Malware Analysis

TEACHING UNIT 1. INTRUSION DETECTION AND PREVENTION SYSTEMS (IDS/IPS) General concepts of incident management, intrusion detection, and prevention Identification and characterization of system operational data Most common IDS architectures List of different types of IDS/IPS by location and functionality Security criteria for determining the location of IDS/IPS systems TEACHING UNIT 2. IMPLEMENTATION AND DEPLOYMENT OF IDS/IPS SYSTEMS Preliminary analysis Definition of policies for blocking intrusion attempts in IDS/IPS systems Analysis of events logged by the IDS/IPS List of IDS/IPS audit logs Establishing the required levels of updating, monitoring, and testing for IDS/IPS TEACHING UNIT 3. MALWARE CONTROL Malware detection and containment systems Malware Control Tools Security Criteria for Configuring Malware Protection Tools Determining the Requirements and Techniques for Updating Malware Protection Tools List of Audit Logs for Malware Protection Tools Establishing Monitoring and Testing of Malware Protection Tools Malware Analysis Using Disassemblers and Controlled Execution Environments TEACHING UNIT 4. SECURITY INCIDENT RESPONSE Procedure for collecting information related to security incidents Overview of the various techniques and tools used for analyzing and correlating security information and events Intrusion verification process Nature and functions of national and international CERT-type incident management organizations LEARNING UNIT 5. NOTIFICATION AND MANAGEMENT PROCESS FOR INTRUSION ATTEMPTS Establishment of responsibilities Categorization of incidents resulting from intrusion attempts Establishment of the detection process and incident logging tools Establishing the required response level based on the anticipated impact Establishing the system resolution and recovery process Process for reporting the incident to third parties TEACHING UNIT 6. COMPUTER FORENSICS General concepts and objectives of forensic analysis Explanation of Lockard’s Principle Guidelines for collecting electronic evidence Guidelines for analyzing collected electronic evidence Guidelines for selecting forensic analysis tools