Course Description
This course will focus on incident detection and response. Topics will include: defining a security incident and explaining the incident response lifecycle, including the roles and responsibilities of incident response teams, analyzing and interpreting network communications to detect security incidents using packet sniffing tools. It will also explore the incident investigation and response processes and procedures and the use of Intrusion Detection Systems (IDS) and Security Information Event Management (SIEM) tools. (3 credits)
Prerequisite
- CSS 101: Cybersecurity Fundamentals
Student Learning Outcomes (SLOs)
Upon completion of the course, the students will be able to:
- Explain the lifecycle of an incident.
- Describe the tools used in documentation, detection, and management of incidents.
- Illustrate and explain fundamental architectures of networks and the Internet, as well as their underlying principles.
- Analyze packets to interpret network communications.
- Identify and critically assess issues and concepts related to the protection of information and information systems.
- Perform artifact investigations to analyze and verify security incidents.
- Use risk management principles to assess threats, vulnerabilities, countermeasures, and impact contributions at risk in information systems.
- Identify the steps to contain, eradicate, and recover from an incident.
- Determine when and how to escalate a security incident.
- Determine how to read and analyze logs during incident investigation.
- Interpret the basic syntax and components of signatures and logs in Intrusion Detection Systems (IDS) and Network Intrusion Detection Systems (NIDS) tools.
- Perform queries in Security Information and Event Management (SIEM) tools to investigate an event.
- Communicate sensitive information with care and confidentiality.
- Engage with the cybersecurity community.
Course Activities and Grading
| Assignments | Weight |
|---|---|
Discussion (Weeks 1-8) | 16% |
Assignments (Weeks 1-8) | 84% |
Total | 100% |
Required Textbooks
This course uses Open Educational Resources (OER). OER are openly licensed, educational resources that can be used for teaching, learning and research. OER may consist of a variety of resources such as textbooks, videos and software that are no cost for students.
Course Schedule
Week | SLOs | Readings and Exercises | Assignments |
1 | 1,2 | Topics: Introduction to Detection and Incident Response
|
|
2 | 3,4 | Topic: Network Monitoring and Analysis
|
|
3 | 5,10 | Topic: Incident Investigation and Response
|
|
4 | 11,12 | Topic: Network Traffic and Logs Using IDS and SIEM Tools
|
|
5 | 6,7 | Topic: Protect Data and Communicate Incidents
|
|
6 | 8,9 | Topic: Escalate Incidents
|
|
7 | 13 | Topics: Communicate Effectively
|
|
8 | 14 | Topics: Engage with the Cybersecurity Community
|
|
COSC Accessibility Statement
Charter Oak State College encourages students with disabilities, including non-visible disabilities such as chronic diseases, learning disabilities, head injury, attention deficit/hyperactive disorder, or psychiatric disabilities, to discuss appropriate accommodations with the Office of Accessibility Services at OAS@charteroak.edu.
COSC Policies, Course Policies, Academic Support Services and Resources
Students are responsible for knowing all Charter Oak State College (COSC) institutional policies, course-specific policies, procedures, and available academic support services and resources. Please see COSC Policies for COSC institutional policies, and see also specific policies related to this course. See COSC Resources for information regarding available academic support services and resources.