==Information Systems Mass Attacks and Defence (fall 2013) ==

Weeks 1-8 of the Fall Semester

Tuesdays 17:45-21:00

Room ICT-A1 (new IT building at Akadeemia 15a, second floor)

==Instructors==

[http://www.linkedin.com/in/rainottis Rain Ottis], PhD, Associate Professor at TUT

Jaan Priisalu, Director General, [http://www.ria.ee Estonian Information System's Authority]

Practice led by Tiit Hallas

Contact: rain dot ottis at ttu dot ee

==Schedule==

 NB! Check the schedule for updates before each lesson. 

====Lesson 1====
03.09.2013

Introduction (Priisalu, Hallas)

Research paper topic assignment (Priisalu, Hallas)

====Lesson 2====
10.09.2013

Review of research paper requirements (Ottis)

'''Lecture:''' cyber conflict and espionage (Ottis)

Topics covered: Estonia 2007 and Georgia 2008 cyber conflicts, StuxNet, PRISM, discussion.

'''Practice''' (Hallas)

Topics covered: overview of exercises, introduction of tabletop exercises in the context of this course, explaining the need for processes based on the real life examples.

====Lesson 3====
17.09.2013

'''Lecture:''' cyber crime (Ottis, Priisalu)

Topics covered: criminal attacks, experiences from the banking sector, attack methods, motives, cooperation.

'''Practice''' (Hallas)

Topics covered: Creating teams, assigning team roles, introducing scenarios and injects, playing the first game.

====Lesson 4====
24.09.2013

'''Lecture:''' politically motivated attacks (Ottis)

Topics covered: hactivism, private hacking for political reasons, state sponsored cyber attacks, cyber espionage and terrorism, methods, motives, countermeasures.

'''Practice''' (Hallas)

Topics covered: Analysing the last game, playing by scenarios and with injects

====Lesson 5====
01.10.2013

'''Lecture:''' cyber security planning (Priisalu)

Topics covered: cyber security planning.

'''Practice''' (Hallas)

Topics covered: Explaining “the final game”, discussing self-written scenarios.

====Lesson 6====
08.10.2013

'''Lecture:''' incident handling and CIIP (Priisalu)

Topics covered: CIIP overall, CIIP in Estonia, crisis management, CERT perspective, law enforcement perspective, incident handling process in Estonia.

====Lesson 7====
15.10.2013

'''Practice''' (Hallas, Ottis, Priisalu)

Tabletop exercise

====Lesson 8====
22.09.2013

Course summary and feedback (Ottis, Priisalu, Hallas)

==Grade assignment==

30% - Performance at the tabletop exercises

30% - Written assignment (research paper, 2000-4000 words)

40% - Oral exam

==Tabletop Exercise (practice component)==

It's game time! In this part of the course we will learn about war games. We will discuss their importance and practical applications in the real world and see how those games are organized. We will not only talk about them, but we will try them out as well.

The goal of this is to analyse the importance of communication processes and to understand the need to test those processes using tabletop exercises. We will create different teams with different tasks that will fall into two main categories: Red teams and Blue teams.

To the blue teams we will show that you might not have the full understanding of the situation, not enough information and resources.

To the red teams we will show that even though you might have a perfect plan, things will not go as you would want them to go.

===Agenda===
====Lesson 2====
Introduction

Processes and testing

Examples of different exercises and games from real life

====Lesson 3====
Creating teams, assigning roles

Introducing scenarios and injects

Playing the first game to understand what we are doing

====Lesson 4====
Playing the first game with scenarios and injects

Analysing the game and reports

====Lesson 5====
Discussing self-written scenarios and injects

Explaining the "final game" and the methods

====Lesson 7====
Final game

====Lesson 8====
Feedback

===General information===
Red teams will get to do less during the class exercises. However - their performance during the last exercise will be watched and graded with more detail. It requires much more independent work from the team to prepare.

If you have questions, comments or ideas about the topic then you can contact me via e-mail hallas at ut dot ee.

2013-02-26T16:57:44Z

Ottis: /* Schedule */

2013-02-22T12:33:35Z

Ottis: /* Schedule */

ITX8045

2013-02-19T15:56:42Z

Ottis: /* Schedule */

ITX8045

2013-02-18T22:27:38Z

Ottis: /* Schedule */

ITX8045

2013-02-18T17:14:45Z

Ottis: /* Cyber Security Seminar */

ITX8045

2013-02-18T17:14:29Z

Ottis: /* Schedule */

== Cyber Security Seminar ==

Instructor: [http://ee.linkedin.com/in/rainottis/ Rain Ottis, PhD]

Contact: rain at cs.ttu.ee

== Schedule ==

Students are advised to check this wiki for changes in schedule, location, etc.

1. 18.02.2013 : 1600-1900 at IT-137A.

2. 25.02.2013 : time TBD. Preparation: one page summary of thesis research question, method and timeline.

3. 11.03.2013

4. 25.03.2013

5. 01.04.2013

6. 15.04.2013

7. 06.05.2013

8. 13.05.2013

== Content ==

During the seminar the students will research, write, present and discuss advanced topics in cyber security.

In addition, the seminar will be used to assist in developing a useful Master thesis topic. During April and May, students will present their thesis progress, in order to get feedback from peers and to improve the quality of the final thesis.

== Admin notes ==

The course will be free of charge if you have a tuition free status (RE). You can ignore the warning in OIS that you have to pay for the course in this case.

Cyber security 2012 second year

2013-02-18T14:59:58Z

Ottis: /* Formal Requirements and recommendations */

== News ==

=== IT Academy Scholarships ===
There are special [http://www.arengufond.ee/foresight/ita IT-Academy] scholarships available for Cybersecurity students starting from this semester. The scholarships are awarded based on the study results in the previous semesters. The main condition is that you have 30 EAP/semester in total and the rank is based on your average grade. The [http://www.ttu.ee/infotehnoloogia-teaduskond/infotehnoloogia-teaduskond-1/it-tudengile/teated-uliopilastele/ annoncement and statute of the scholarship] is available on the faculty web site (in Estonian only). You don't have to apply for the scholarship. You will be announce when you will get it. You should consider the scholarship conditions in planning your studies this semester.

[http://www.ttu.ee/studying/masters/academic-calendar-4/ Academic Calendar]

== Courses ==

* '''ITX8080''' Simulation of Attacks and Defense will start on week 2

* '''ITV8060''' Computer Network Security (4 EAP) is available and free on Fall for cybersecurity 2. year students:
** Lectures on Tuesday (even weeks) at 14.00 (room will be announced soon)
** Labs on Tuesday (even weeks) at 16.00 ITC Cisco lab room 415
** It is basically a CCNA Security course for Cybersecurity program
** It is suitable for students with some networking background and command-line experience
** Can be moved to Specialization module

* '''ITX8071''' Cyber Defense Monitoring Solutions replaces the course ITX8070 Log Mining and Disc Forensics.
* '''ITX8040''' Cyberdefence seminar will take place on Tuesdays (and not on Wednesdays as shown in your timetable)

* '''ITX8042''' [http://lambda.ee/w/index.php?title=Malware:ITX8042:2012 Malware]

* '''ITX8042''' [http://lambda.ee/w/index.php?title=Malware:ITX8060:2012 Malware II]

* '''ITX8045''' [http://www.lambda.ee/wiki/ITX8045 Cyber Security Seminar]

* '''ITX8063''' [http://lambda.ee/wiki/ITX8063_2012 IT Systems Hacking Attacks and Defence 2012]

The courses are free to cybersecurity RE students (the invoices are cancelled) and can be moved to Specialization module after you get a grade.

The [http://lambda.ee/index.php/Cyber_security_2012_first_year information for first year students] may be relevant for you also.

== Writing a Thesis ==

=== Topic and advisor ===
Almost any professor and lecturer you have met in your curricula can act as an advisor of you thesis. Some of them have some open problems suitable for doing research and writing a thesis, but many don't have a topic to offer. It is usually more helpful to have an initial idea of a topic of your thesis and ask someone with interests in the related field to advise you. You can have an advisor not related to the university, but he can act only as a co-advisor and you need to agree to somebody related to the curricula or the [http://www.ttu.ee/department-of-computer-science|leading institute] of the curricula to be an official advisor.

[[Cyber_security_thesis_topics | More potential advisors and topics]]

=== Formal Requirements and recommendations ===
There are no strict rules on formatting your thesis. Some general advices that are good to follow for a master thesis:
* a title page, an author declaration, an annotation in english and estonian, a list of contents, and references are required in the thesis
* around 50 pages + appendixes if needed
* Times New Roman (or similar), font size 12, 1.5 spacing used for the ordinary text
* headings are numbered and no more than 3 levels used
* 2 copies are submitted, you will get one back afterwards.

'''The [http://www.lambda.ee/wiki/ITX8045 Cyber Security Seminar] is designed to provide advice on the thesis requirements and writing process to Cyber Security Master's students.

=== Dates (2012) ===
* May 28 deadline for application of defending the thesis
* June 1, 12.00, submission of the thesis (two copies to IT-225)
* June 11 (and June 8 if needed) defenses of the thesis (presentation 15-20 minutes + discussion)
* After defense, please, visit Dean's Office for more information about final formalities
* June 20-22 final ceremony
* [http://lab.cs.ttu.ee/theses Upload your thesis if you would like to have it public]
Your advisor may have different suggestions, but if they don't say anything then you should plan to have a first draft ready by the end of April.

=== Links ===
[http://www.cs.ut.ee/sites/default/files/EN_Guide%20to%20the%20writing%20and%20defense.pdf Some advises and requirements for writing a thesis in UT]

[http://www.ttu.ee/arvutiteaduse-instituut/oppetoo/loputood/ Some advises and requirements for writing a thesis in TTU (in Estonian)]

[http://www.lib.ttu.ee/dbs/abaasid.asp Databases, books, research papers accessible from the TTU network]

Cyber security 2012 second year

2013-02-18T14:53:53Z

Ottis: /* Courses */

== News ==

=== IT Academy Scholarships ===
There are special [http://www.arengufond.ee/foresight/ita IT-Academy] scholarships available for Cybersecurity students starting from this semester. The scholarships are awarded based on the study results in the previous semesters. The main condition is that you have 30 EAP/semester in total and the rank is based on your average grade. The [http://www.ttu.ee/infotehnoloogia-teaduskond/infotehnoloogia-teaduskond-1/it-tudengile/teated-uliopilastele/ annoncement and statute of the scholarship] is available on the faculty web site (in Estonian only). You don't have to apply for the scholarship. You will be announce when you will get it. You should consider the scholarship conditions in planning your studies this semester.

[http://www.ttu.ee/studying/masters/academic-calendar-4/ Academic Calendar]

== Courses ==

* '''ITX8080''' Simulation of Attacks and Defense will start on week 2

* '''ITV8060''' Computer Network Security (4 EAP) is available and free on Fall for cybersecurity 2. year students:
** Lectures on Tuesday (even weeks) at 14.00 (room will be announced soon)
** Labs on Tuesday (even weeks) at 16.00 ITC Cisco lab room 415
** It is basically a CCNA Security course for Cybersecurity program
** It is suitable for students with some networking background and command-line experience
** Can be moved to Specialization module

* '''ITX8071''' Cyber Defense Monitoring Solutions replaces the course ITX8070 Log Mining and Disc Forensics.
* '''ITX8040''' Cyberdefence seminar will take place on Tuesdays (and not on Wednesdays as shown in your timetable)

* '''ITX8042''' [http://lambda.ee/w/index.php?title=Malware:ITX8042:2012 Malware]

* '''ITX8042''' [http://lambda.ee/w/index.php?title=Malware:ITX8060:2012 Malware II]

* '''ITX8045''' [http://www.lambda.ee/wiki/ITX8045 Cyber Security Seminar]

* '''ITX8063''' [http://lambda.ee/wiki/ITX8063_2012 IT Systems Hacking Attacks and Defence 2012]

The courses are free to cybersecurity RE students (the invoices are cancelled) and can be moved to Specialization module after you get a grade.

The [http://lambda.ee/index.php/Cyber_security_2012_first_year information for first year students] may be relevant for you also.

== Writing a Thesis ==

=== Topic and advisor ===
Almost any professor and lecturer you have met in your curricula can act as an advisor of you thesis. Some of them have some open problems suitable for doing research and writing a thesis, but many don't have a topic to offer. It is usually more helpful to have an initial idea of a topic of your thesis and ask someone with interests in the related field to advise you. You can have an advisor not related to the university, but he can act only as a co-advisor and you need to agree to somebody related to the curricula or the [http://www.ttu.ee/department-of-computer-science|leading institute] of the curricula to be an official advisor.

[[Cyber_security_thesis_topics | More potential advisors and topics]]

=== Formal Requirements and recommendations ===
There are no strict rules on formatting your thesis. Some general advices that are good to follow for a master thesis:
* a title page, an author declaration, an annotation in english and estonian, a list of contents, and references are required in the thesis
* around 50 pages + appendixes if needed
* Times New Roman (or similar), font size 12, 1.5 spacing used for the ordinary text
* headings are numbered and no more than 3 levels used
* 2 copies are submitted, you will get one back afterwards.

=== Dates (2012) ===
* May 28 deadline for application of defending the thesis
* June 1, 12.00, submission of the thesis (two copies to IT-225)
* June 11 (and June 8 if needed) defenses of the thesis (presentation 15-20 minutes + discussion)
* After defense, please, visit Dean's Office for more information about final formalities
* June 20-22 final ceremony
* [http://lab.cs.ttu.ee/theses Upload your thesis if you would like to have it public]
Your advisor may have different suggestions, but if they don't say anything then you should plan to have a first draft ready by the end of April.

=== Links ===
[http://www.cs.ut.ee/sites/default/files/EN_Guide%20to%20the%20writing%20and%20defense.pdf Some advises and requirements for writing a thesis in UT]

[http://www.ttu.ee/arvutiteaduse-instituut/oppetoo/loputood/ Some advises and requirements for writing a thesis in TTU (in Estonian)]

[http://www.lib.ttu.ee/dbs/abaasid.asp Databases, books, research papers accessible from the TTU network]

ITX8045

2013-02-15T04:20:38Z

Ottis: /* Schedule */

== Cyber Security Seminar ==

Instructor: [http://ee.linkedin.com/in/rainottis/ Rain Ottis, PhD]

Contact: rain at cs.ttu.ee

== Schedule ==

Students are advised to check this wiki for changes in schedule, location, etc.

1. 18.02.2013 : 1600-1900 at IT-137A

2. 25.02.2013

3. 11.03.2013

4. 25.03.2013

5. 01.04.2013

6. 15.04.2013

7. 06.05.2013

8. 13.05.2013

== Content ==

During the seminar the students will research, write, present and discuss advanced topics in cyber security.

In addition, the seminar will be used to assist in developing a useful Master thesis topic. During April and May, students will present their thesis progress, in order to get feedback from peers and to improve the quality of the final thesis.

== Admin notes ==

The course will be free of charge if you have a tuition free status (RE). You can ignore the warning in OIS that you have to pay for the course in this case.