course-details-portlet

IIKG3020 - Introduction to incident response

About

Examination arrangement

Examination arrangement: Aggregate score
Grade: Letter grades

Evaluation Weighting Duration Grade deviation Examination aids
Home examination 40/100 2 hours
Assignment 60/100

Course content

  • Incident response planning: preparation, organization, building and running a CSIRT, operational issues, hiring and training of personnel
  • Incident response: prevention, detection, notification, reaction, recovery, maintenance
  • Advanced computer network defence: vulnerability and threat management, threat intelligence and situational awareness, tools and processes, frameworks (ATT&CK, Cyber Kill Chain, etc.), threat hunting, information sharing
  • Planning and running incident response team exercises

Learning outcome

Knowledge

  • The student understands cyber incident response and its components.
  • The student has a good overview of known frameworks and tools for incident response.
  • The student has general knowledge of planning for incident response readiness and managing the operational aspects of the incident response team.
  • The student has general knowledge of how to perform incident response for various types of adverse incidents, including intrusions from advanced threat actors.

Skills

  • The student can plan for and handle larger and smaller cyber incidents.
  • The student can organize an incident response team in a manner that ensures good handling of incidents while also making sure staff burnout is avoided.

General Competence

  • The student has broad knowledge of cyber incident response and is able to communicate this to others.

Learning methods and activities

  • Online lectures
  • Laboratory work
  • Group project work

Project and lab assignments will be facilitated across Trondheim and Gjøvik campuses.

Further on evaluation

  • Digital home examination counts for 40%
  • The project counts for 60%
  • Both parts must be passed.

Re-sit examination in August. Re-sit examination can be changed from digital home exam to oral exam. No re-sit for the project, the project work has to be redone next course dates.

Retake can be carried out for some partial assessments without all partial assessments having to be taken up again.

Specific conditions

Admission to a programme of study is required:
Digital Infrastructure and Cyber Security (BDIGSEC)

Required previous knowledge

None

Course materials

Eleven Strategies of a World-Class Cybersecurity Operations Center, Kathryn Knerler, Ingrid Parker, Carson Zimmermann, The MITRE Corporation, 2022. Free e-book available from:

https://www.mitre.org/sites/default/files/2022-04/11-strategies-of-a-world-class-cybersecurity-operations-center.pdf

Other course material will be made available via the learning portal.

Credit reductions

Course code Reduction From To
IMT3004 5.0 AUTUMN 2021
IMT3521 7.5 AUTUMN 2021
IMT4841 7.5 AUTUMN 2021
More on the course

No

Facts

Version: 1
Credits:  7.5 SP
Study level: Third-year courses, level III

Coursework

Term no.: 1
Teaching semester:  AUTUMN 2023

Language of instruction: Norwegian

Location: Gjøvik , Trondheim

Subject area(s)
  • Information Security
Contact information
Course coordinator:

Department with academic responsibility
Department of Information Security and Communication Technology

Timetable

List view
Calendar view

Examination

Examination arrangement: Aggregate score

Term Status code Evaluation Weighting Examination aids Date Time Examination system Room *
Autumn ORD Home examination 40/100

Release
2023-12-12

Submission
2023-12-12


09:00


11:00

INSPERA
Room Building Number of candidates
Autumn ORD Assignment 60/100

Release
2023-09-15

Submission
2023-11-10


10:00


14:00

INSPERA
Room Building Number of candidates
Summer UTS Home examination 40/100 INSPERA
Room Building Number of candidates
  • * The location (room) for a written examination is published 3 days before examination date. If more than one room is listed, you will find your room at Studentweb.
Examination

For more information regarding registration for examination and examination procedures, see "Innsida - Exams"

More on examinations at NTNU