Hands-on Cyber Forensics

3 Credits · Level: Graduate

This course will provide students with an introduction to network intrusions investigations through network and host forensic methodologies. The bulk of this course, however, will be a hands-on practical implementation of the methodologies. Students will apply our understanding of these methodologies to conduct multiple investigations that portray real-world events. During the semester we will gain a deeper understanding of attack techniques, forensic tools, and process, including but not limited to: The cyclical incident handling process Different malicious program types Detecting malicious applications and network activity Common attack techniques that compromise hosts Detecting and analyzing host and network vulnerabilities Continuous process improvement by discovering the root causes of incidents This course will rely on practical in-class labs. We will use open-source tools to collect and analyze forensic artifact data in order to understand how malicious activity occurred, the malicious activities end result, and how to mitigate these events from occurring in the future. We will also review data from previously disclosed incidents and present our critiques of existing analysis of these incidents. Students will be graded on the following: - participation in classroom and homework exercises - one in-class presentation - a final write up of the forensic investigation