ITX8062

Information Systems Mass Attacks and Defence

Weeks 1-8 of the Fall Semester

Tuesdays 1815-2130

Room III-311

Main lecturers

Jaan Priisalu, Director General, Estonian Information System's Authority

Rain Ottis, PhD, Scientist/Senior Analyst, Cooperative Cyber Defence Centre of Excellence

Contact: ottis.rain@gmail.com

Schedule

NB! Check the schedule for updates before each lesson.

1. 04.09.2011

Lecturer(s): Ottis, Priisalu

Theme: cyber security and Estonia

Topics covered: administrative issues; introduction to the course; why do we care about large scale cyber attacks; assignment of research topics.

Course Introduction

2. 11.09.2011

Lecturer(s): Ottis

Theme: cyber conflict

Topics covered: Estonia 2007 and Georgia 2008 cyber conflicts, StuxNet, discussion.

Estonia 2007 and Georgia 2008 - Case Study

3. 18.09.2011

Lecturer(s): Priisalu

Theme: cyber crime

Topics covered: criminal attacks, experiences from the banking sector, attack methods, motives, cooperation.

4. 25.09.2011

Lecturer(s): Priisalu, guest lecturers

Theme: incident handling, CIIP

Topics covered: CIIP overall, CIIP in Estonia, crisis management, CERT perspective, law enforcement perspective, incident handling process in Estonia.

Estonian Cyber Security Strategy

5. 02.10.2011

Lecturer(s): Ottis

Theme: politically motivated attacks

Topics covered: hactivism, private hacking for political reasons, state sponsored cyber attacks, cyber espionage and terrorism, methods, motives, countermeasures.

Politically Motivated Cyber Attacks Farmers With Laptops Proactive Defense

6. 09.10.2011

Lecturer(s): Ottis, Priisalu

Theme: tabletop preparation

Topics covered: tabletop exercise introduction and preparation.

See the section at the bottom of the page

7. 16.10.2011

Lecturer(s): Priisalu

Theme: cyber security planning

Topics covered: cyber security planning.

8. 23.10.2011

Lecturer(s): Ottis, Priisalu

Theme: tabletop exercise

Topics covered: tabletop exercise execution, summary of the course.

See the section at the bottom of the page

Grade assignment

30% - Performance at the tabletop exercise

30% - Written assignment (research paper, 2000-4000 words)

40% - Oral exam

Tabletop Exercise

Lesson 6

The class will be divided into teams of 3-4 people. Each team will represent either an attacker (Red team) or a defender (Blue team) in a large cyber incident.

Lesson 7

Blue team leaders will e-mail the instructors a one page document that covers:

1. the role of the entity that the team represents in cyber defense (1 paragraph)

2. the key objectives for their team (maintain service availability, identify attackers etc.)

3. their generic plan for reaching their objectives in the case of large scale cyber incidents

4. a threat assessment.

Red team leaders will email the instructors a one page document that covers:

1. the nature of the attacker (for example, international organized crime group that specializes in ...; 1 paragraph)

2. the objectives of their team (for example, deny basic services to citizens for three days)

3. their generic plan for reaching their objectives (including types of actions taken, tools used, how targets are identified, etc.)

4. a short risk assessment.

Unless otherwise specified, the tactics, tools and systems referred to must be observed in real life or at least plausible.

Lesson 8

The instructors lead the exercise and play NPCs (for example, home users).

Each Red team gets to run their scenario. All Blue teams will be engaged in every scenario.

EXAM

Exam times

- 18.12.2012 1800-2100 room III-302
- 03.01.2013 1800-2100 room III-311
- 10.01.2013 1800-2100 room III-308
- 17.01.2013 1800-2100 room III-311

- Send in your exam time preference and paper at least one week before the exam date!
- Be present at the beginning of the exam!
- You are allowed to use your computer during the exam.

Check this wiki for updates on the location of the exam.