Forensic Analysis

TEACHING UNIT 1. RESPONSE TO SECURITY INCIDENTS 1. Procedure for collecting information related to security incidents 2. Overview of the various techniques and tools used for analyzing and correlating security information and events 3. Intrusion verification process 4. Nature and functions of national and international CERT-type incident management organizations TEACHING UNIT 2. NOTIFICATION AND MANAGEMENT PROCESS FOR INTRUSION ATTEMPTS 1. Establishment of Responsibilities 2. Categorization of Incidents Resulting from Intrusion Attempts 3. Establishment of the Detection Process and Incident Logging Tools 4. Establishing the Required Level of Response Based on the Expected Impact 5. Establishing the Process for Resolving Incidents and Restoring Systems 6. Process for Reporting the Incident to Third Parties TEACHING UNIT 3. COMPUTER FORENSICS 1. General concepts and objectives of forensic analysis 2. Explanation of the Lockard Principle 3. Guidelines for collecting electronic evidence 4. Guidelines for analyzing collected electronic evidence 5. Guidelines for selecting forensic analysis tools TEACHING UNIT 4. DATA STORAGE MEDIA 1. Data Acquisition: Importance in Digital Forensic Analysis 2. Layered Model 3. Recovery of Deleted Files 4. File Analysis TEACHING UNIT 5. IT SECURITY AUDIT 1. General Criteria 2. Application of Personal Data Protection Regulations 3. Tools for System Auditing 4. Description of Firewall Considerations in Information System Audits 5. Guidelines for Carrying Out the Different Phases of an Information System Audit