Incident Response and Business Continuity

3 units

This course focuses on the end-to-end process and methods to deal with cybersecurity incidents. Using recent examples of cyber breaches and incidents, students explore how CISOs react and respond to these incidents and learn best practices for doing so. Topics include developing an incident response plan, organizing an incident response team, leveraging cyber intelligence and external partners to aid in response, handling public and private communications about the incident, and post-breach restoration. Particular attention will be paid to establishing a strong understanding of cybersecurity indicators and motives for espionage activities from both an external and rogue insider's perspective. Students will learn about host-based and network incident response tools and digital forensic tools, including techniques and tactics for their effective use. This section of the course includes key hands-on activities that are typically used in post-breach analysis and investigations, such as the forensic analysis of network storage, hard drives, and memory. Students will also become familiar with post-breach report construction and examine the proper drafting and use of such reports for submission to legal counsel, the courts, and organizational leaders.