|
|
| (ei näidata sama kasutaja 15 vahepealset redaktsiooni) |
| 1. rida: |
1. rida: |
| ==Information Systems Mass Attacks and Defence (fall 2014) ==
| | Information Systems Mass Attacks and Defence wiki has [http://courses.cs.ttu.ee/pages/ITX8062 moved to a new location]. |
| | |
| Weeks 1-8 of the Fall Semester
| |
| | |
| Tuesdays 17:45-21:00
| |
| | |
| Room ICT-A1 (new IT building at Akadeemia 15a, second floor)
| |
| | |
| ==Main lecturers==
| |
| | |
| Rain Ottis, PhD, Associate Professor at TUT
| |
| | |
| Jaan Priisalu, Director General, [http://www.ria.ee Estonian Information System's Authority]
| |
| | |
| Practice led by Tiit Hallas
| |
| | |
| | |
| Contact: rain dot ottis at ttu dot ee
| |
| | |
| ==Schedule==
| |
| | |
| <b> NB! Check the schedule for updates before each lesson. </b>
| |
| | |
| | |
| 1. '''04.09.2011'''
| |
| | |
| Lecturer(s): Ottis, Priisalu
| |
| | |
| Theme: cyber security and Estonia
| |
| | |
| Topics covered: administrative issues; introduction to the course; why do we care about large scale cyber attacks; assignment of research topics.
| |
| | |
| [https://docs.google.com/open?id=0B7yq33Gize8yRWZwaVJCQ2tUUFk Course Introduction]
| |
| | |
| | |
| 2. '''11.09.2011'''
| |
| | |
| Lecturer(s): Ottis
| |
| | |
| Theme: cyber conflict
| |
| | |
| Topics covered: Estonia 2007 and Georgia 2008 cyber conflicts, StuxNet, discussion.
| |
| | |
| [https://docs.google.com/viewer?a=v&pid=explorer&chrome=true&srcid=0B7yq33Gize8yZTJjNmM5ZjgtMTllYi00Njk2LTgyZGItY2Y0Yzg4MDA4MWJh&hl=en_US Estonia 2007 and Georgia 2008 - Case Study]
| |
| | |
| | |
| 3. '''18.09.2011'''
| |
| | |
| Lecturer(s): Priisalu
| |
| | |
| Theme: cyber crime
| |
| | |
| Topics covered: criminal attacks, experiences from the banking sector, attack methods, motives, cooperation.
| |
| | |
| | |
| 4. '''25.09.2011'''
| |
| | |
| Lecturer(s): Priisalu, guest lecturers
| |
| | |
| Theme: incident handling, CIIP
| |
| | |
| Topics covered: CIIP overall, CIIP in Estonia, crisis management, CERT perspective, law enforcement perspective, incident handling process in Estonia.
| |
| | |
| [http://www.mod.gov.ee/files/kmin/img/files/Kuberjulgeoleku_strateegia_2008-2013_ENG.pdf Estonian Cyber Security Strategy]
| |
| | |
| | |
| 5. '''02.10.2011'''
| |
| | |
| Lecturer(s): Ottis
| |
| | |
| Theme: politically motivated attacks
| |
| | |
| Topics covered: hactivism, private hacking for political reasons, state sponsored cyber attacks, cyber espionage and terrorism, methods, motives, countermeasures.
| |
| | |
| [https://docs.google.com/viewer?a=v&pid=explorer&chrome=true&srcid=0B7yq33Gize8yNTQxNDg4YjgtNjliMy00N2JjLWEyZDYtMTY2MTNhMmJjYWNh&hl=en_US Politically Motivated Cyber Attacks]
| |
| [https://docs.google.com/fileview?id=0B7yq33Gize8yZWU3OWMxMzctNjYwNC00NWI0LWJiNzYtZTY2NjA1N2I4OTJl&hl=en&authkey=CM3KnbsH Farmers With Laptops]
| |
| [https://docs.google.com/fileview?id=0B7yq33Gize8yOGRjM2RjMzAtYjAzMy00M2YwLWIzZjYtODEwZjYzMjkxNGM2&hl=en&authkey=CPWakuYP Proactive Defense]
| |
| | |
| | |
| 6. '''09.10.2011'''
| |
| | |
| Lecturer(s): Ottis, Priisalu
| |
| | |
| Theme: tabletop preparation
| |
| | |
| Topics covered: tabletop exercise introduction and preparation.
| |
| | |
| <b> See the section at the bottom of the page </b>
| |
| | |
| | |
| 7. '''16.10.2011'''
| |
| | |
| Lecturer(s): Priisalu
| |
| | |
| Theme: cyber security planning
| |
| | |
| Topics covered: cyber security planning.
| |
| | |
| | |
| 8. '''23.10.2011'''
| |
| | |
| Lecturer(s): Ottis, Priisalu
| |
| | |
| Theme: tabletop exercise
| |
| | |
| Topics covered: tabletop exercise execution, summary of the course.
| |
| | |
| <b> See the section at the bottom of the page </b>
| |
| | |
| ==Grade assignment==
| |
| | |
| 30% - Performance at the tabletop exercise
| |
| | |
| 30% - Written assignment (research paper, 2000-4000 words)
| |
| | |
| 40% - Oral exam
| |
| | |
| | |
| ==Tabletop Exercise==
| |
| | |
| ===Lesson 6===
| |
| | |
| The class will be divided into teams of 3-4 people. Each team will represent either an attacker (Red team) or a defender (Blue team) in a large cyber incident.
| |
| | |
| ===Lesson 7===
| |
| | |
| <b>Blue team</b> leaders will e-mail the instructors a one page document that covers:
| |
| | |
| 1. the role of the entity that the team represents in cyber defense (1 paragraph)
| |
| | |
| 2. the key objectives for their team (maintain service availability, identify attackers etc.)
| |
| | |
| 3. their generic plan for reaching their objectives in the case of large scale cyber incidents
| |
| | |
| 4. a threat assessment.
| |
| | |
| | |
| <b>Red team</b> leaders will email the instructors a one page document that covers:
| |
| | |
| 1. the nature of the attacker (for example, international organized crime group that specializes in ...; 1 paragraph)
| |
| | |
| 2. the objectives of their team (for example, deny basic services to citizens for three days)
| |
| | |
| 3. their generic plan for reaching their objectives (including types of actions taken, tools used, how targets are identified, etc.)
| |
| | |
| 4. a short risk assessment.
| |
| | |
| | |
| Unless otherwise specified, the tactics, tools and systems referred to must be observed in real life or at least plausible.
| |
| | |
| ===Lesson 8===
| |
| | |
| The instructors lead the exercise and play NPCs (for example, home users).
| |
| | |
| Each Red team gets to run their scenario. All Blue teams will be engaged in every scenario.
| |
| | |
| | |
| | |
| ==EXAM==
| |
| | |
| ===Exam times===
| |
| | |
| <b>
| |
| - 18.12.2012 1800-2100 room III-302
| |
| - 03.01.2013 1800-2100 room III-311
| |
| - 10.01.2013 1800-2100 room III-308
| |
| - 17.01.2013 1800-2100 room III-311
| |
| | |
| - Send in your exam time preference and paper at least one week before the exam date!
| |
| - Be present at the beginning of the exam!
| |
| - You are allowed to use your computer during the exam.
| |
| </b>
| |
| | |
| Check this wiki for updates on the location of the exam.
| |