ITX8062

Main lecturers

Jaan Priisalu, Swedbank

Rain Ottis, CCD COE

Schedule

NB! Check the schedule for updates before each lesson.

1. 31.08.2010

Lecturer(s): Ottis, Priisalu

Theme: cyber security and Estonia

Topics covered: administrative issues; introduction to the course; why do we care about large scale cyber attacks; relevant terminology; the development of cyber security in Estonia from the 1990’s to today; overview of the 2007 cyber attacks against Estonia.

Introduction

2. 07.09.2010

Lecturer(s): Priisalu

Theme: cyber crime

Topics covered: criminal attacks, experiences from the banking sector, attack methods, motives, cooperation.

3. 14.09.2010

Lecturer(s): Priisalu, Ottis, guest lecturer

Theme: CIIP

Topics covered: CIIP overall, CIIP in Estonia, crisis management.

Estonian Cyber Security Strategy

4. 21.09.2010

Lecturer(s): Ottis

Theme: politically motivated attacks

Topics covered: hactivism, private hacking for political reasons, state sponsored cyber attacks, cyber espionage and terrorism, methods, motives, countermeasures.

Politically Motivated Cyber Attacks Farmers With Laptops Proactive Defense Estonian Case Study

5. 28.09.2010

Lecturer(s): Priisalu, guest lecturers

Theme: incident handling

Topics covered: CERT perspective, law enforcement perspective, incident handling process in Estonia.

6. 05.10.2010

Lecturer(s): Ottis, Priisalu

Theme: tabletop preparation

Topics covered: tabletop exercise introduction and preparation.

See the section at the bottom of the page

7. 12.10.2010

Lecturer(s): Priisalu

Theme: cyber security planning

Topics covered: cyber security planning.

8. 19.10.2010

Lecturer(s): Ottis, Priisalu

Theme: tabletop exercise

Topics covered: tabletop exercise execution, summary of the course.

See the section at the bottom of the page

Grade assignment

30% - Performance at the tabletop exercise

30% - Written assignment (research paper, 2000-4000 words)

40% - Oral exam

Tabletop Exercise

Lesson 6

The class will be divided into teams of 3-4. Each team will represent either an attacker (Red team) or a defender (Blue team) in an large cyber incident.

The Blue teams are: CERT (Lauri), ISP (Margus), Police (Uko), Bank (Mari-Liis). Think of them in the Estonian context and for the ISP and bank assume to be the largest one.

The Red team leaders (Kaspar, Arnis, Rasmus) will get their assignments when they contact the instructors via e-mail.

Lesson 7

Blue team leaders will e-mail the instructors a one page document that covers:

1. the role of the entity that the team represents in cyber defense (1 paragraph)

2. the key objectives for their team (maintain service availability, identify attackers etc.)

3. their generic plan for reaching their objectives in the case of large scale cyber incidents

Red team leaders will email the instructors a one page document that covers:

1. the nature of the attacker (for example, international organized crime group that specializes in ...; 1 paragraph)

2. the objectives of their team (for example, deny basic services to citizens for three days)

3. their generic plan for reaching their objectives (including types of actions taken, tools used, how targets are identified, etc.)

Unless otherwise specified, the tactics, tools and systems referred to must be observed in real life or at least plausible.

Lesson 8

The instructors lead the exercise and play NPCs (for example, home users).

Each Red team gets to run their scenario. All Blue teams will be engaged in every scenario.

EXAM

Exam times

Fr 05.11 1800 (written assignment due 29.10) - Meet in front of VI-224

Fr 03.12 1800 (written assignment due 26.11)

Tu 04.01 1800 (written assignment due 15.12)

Tu 11.01 1800 (written assignment due 15.12)

NB! Send in your exam time preference at least two days before the exam date!

Check this wiki for updates on the location of the exam.