Category:C21 Incident response - Revision history

Vlariono: /* Introduction */

2017-03-03T10:04:22Z

Introduction

Vlariono at 10:00, 3 March 2017

2017-03-03T10:00:42Z

← Older revision		Revision as of 13:00, 3 March 2017
Line 1:		Line 1:
	~~=C21 Incident response=~~

	== Introduction ==		== Introduction ==

Vlariono at 09:59, 3 March 2017

2017-03-03T09:59:23Z

← Older revision		Revision as of 12:59, 3 March 2017
Line 41:		Line 41:
	<tr><td>April 14, 2017 - 16:00 - 19:30</td><td> Communcations.</td></tr>		<tr><td>April 14, 2017 - 16:00 - 19:30</td><td> Communcations.</td></tr>
	</table>		</table>

	~~[[Category:C21 Incident response]]~~

Vlariono at 09:59, 3 March 2017

2017-03-03T09:59:04Z

← Older revision		Revision as of 12:59, 3 March 2017
Line 41:		Line 41:
	<tr><td>April 14, 2017 - 16:00 - 19:30</td><td> Communcations.</td></tr>		<tr><td>April 14, 2017 - 16:00 - 19:30</td><td> Communcations.</td></tr>
	</table>		</table>

			[[Category:C21 Incident response]]

Vlariono at 09:54, 3 March 2017

2017-03-03T09:54:44Z

← Older revision		Revision as of 12:54, 3 March 2017
Line 1:		Line 1:
			=C21 Incident response=

	== Introduction ==		== Introduction ==

Vlariono: Vlariono moved page C21 Incident response to Category:C21 Incident response: Merging with common approach on ITK MediaWiki.

2017-03-03T09:49:21Z

Vlariono moved page C21 Incident response to Category:C21 Incident response: Merging with common approach on ITK MediaWiki.

← Older revision		Revision as of 12:49, 3 March 2017
(No difference)

Vlariono: /* Lectures plan */

2017-03-03T09:46:38Z

Lectures plan

← Older revision		Revision as of 12:46, 3 March 2017
Line 32:		Line 32:
	<tr><td>March 3, 2017 - 16:00 - 17:30</td><td>Course and lecturer introduction. Getting to know each other.</td></tr>		<tr><td>March 3, 2017 - 16:00 - 17:30</td><td>Course and lecturer introduction. Getting to know each other.</td></tr>
	<tr><td>March 3, 2017 - 18:00 - 19:30</td><td> Common threat landscape. Estonia and the world. Attack classifications. APT.</td></tr>		<tr><td>March 3, 2017 - 18:00 - 19:30</td><td> Common threat landscape. Estonia and the world. Attack classifications. APT.</td></tr>
	<tr><td>March 10, 2017 - 16:00 - 19:30</td><td> Monitoring, detection and reveal scenarios. Sources. Initial actions.</td></tr>		<tr><td>March 10, 2017 - 16:00 - 17:30</td><td> Hands-on session arrangements. Dividing into teams and initial briefing.</td></tr>
	<tr><td>March 17, 2017 - 16:00 - 19:30</td><td> Response coordination by threat classes. Common threat classes.</td></tr>		<tr><td>March 10, 2017 - 18:00 - 19:30</td><td> Monitoring, detection and reveal scenarios. Sources. Initial actions.</td></tr>
	<tr><td>March 24, 2017 - 16:00 - 19:30</td><td> Response coordination - APT.</td></tr>		<tr><td>March 17, 2017 - 16:00 - 19:30</td><td> Monitoring, detection and reveal scenarios. Sources. Initial actions. Part 2.</td></tr>
	<tr><td>~~March 31~~, 2017 - 16:00 - 19:30</td><td> Communcations.</td></tr>		<tr><td>March 24, 2017 - 16:00 - 19:30</td><td> Response coordination by threat classes. Common threat classes.</td></tr>
			<tr><td>March 31, 2017 - 16:00 - 19:30</td><td> Response coordination - APT.</td></tr>
			<tr><td colspan=2><center><b>NB! No lecture on April 7!</b></center></td></tr>
			<tr><td>April 14, 2017 - 16:00 - 19:30</td><td> Communcations.</td></tr>
	</table>		</table>

Vlariono: /* Lectures plan */

2017-03-03T09:43:41Z

Lectures plan

← Older revision		Revision as of 12:43, 3 March 2017
Line 29:		Line 29:

	== Lectures plan ==		== Lectures plan ==
	March 3, 2017 - 16:00 - 17:30 Course and lecturer introduction. Getting to know each other.		<table border=0>
	March 3, 2017 - 18:00 - 19:30 Common threat landscape. Estonia and the world. Attack classifications. APT.		<tr><td>March 3, 2017 - 16:00 - 17:30</td><td>Course and lecturer introduction. Getting to know each other.</td></tr>
	March 10, 2017 - 16:00 - 19:30 Monitoring, detection and reveal scenarios. Sources. Initial actions.		<tr><td>March 3, 2017 - 18:00 - 19:30</td><td> Common threat landscape. Estonia and the world. Attack classifications. APT.</td></tr>
	March 17, 2017 - 16:00 - 19:30 Response coordination by threat classes. Common threat classes.		<tr><td>March 10, 2017 - 16:00 - 19:30</td><td> Monitoring, detection and reveal scenarios. Sources. Initial actions.</td></tr>
	March 24, 2017 - 16:00 - 19:30 Response coordination - APT.		<tr><td>March 17, 2017 - 16:00 - 19:30</td><td> Response coordination by threat classes. Common threat classes.</td></tr>
	March 31, 2017 - 16:00 - 19:30 Communcations.		<tr><td>March 24, 2017 - 16:00 - 19:30</td><td> Response coordination - APT.</td></tr>
			<tr><td>March 31, 2017 - 16:00 - 19:30</td><td> Communcations.</td></tr>
			</table>

Vlariono at 09:41, 3 March 2017

2017-03-03T09:41:25Z

← Older revision		Revision as of 12:41, 3 March 2017
Line 26:		Line 26:
	- Evidence gathering and analysis<br>		- Evidence gathering and analysis<br>
	- Reverse engineering<br>		- Reverse engineering<br>


			== Lectures plan ==
			March 3, 2017 - 16:00 - 17:30 Course and lecturer introduction. Getting to know each other.
			March 3, 2017 - 18:00 - 19:30 Common threat landscape. Estonia and the world. Attack classifications. APT.
			March 10, 2017 - 16:00 - 19:30 Monitoring, detection and reveal scenarios. Sources. Initial actions.
			March 17, 2017 - 16:00 - 19:30 Response coordination by threat classes. Common threat classes.
			March 24, 2017 - 16:00 - 19:30 Response coordination - APT.
			March 31, 2017 - 16:00 - 19:30 Communcations.

Vlariono: /* Introduction */

2017-03-03T09:34:35Z

Introduction

← Older revision		Revision as of 12:34, 3 March 2017
Line 22:		Line 22:
	e) The most important - in real life situation, when an intrusion happens in student responsibility premises - student knows the actions needed to be undertaken, doesn't get lost or panic and is capable of acting fast and smart in the situation effectively communicating and collaborating with parties capable of assisting him/her.		e) The most important - in real life situation, when an intrusion happens in student responsibility premises - student knows the actions needed to be undertaken, doesn't get lost or panic and is capable of acting fast and smart in the situation effectively communicating and collaborating with parties capable of assisting him/her.

	Course is intended to provide the necessary basic input for such 3 semester courses like:		Course is intended to provide the necessary basic input for such 3 semester courses like:<br>
	- Logging and monitoring		- Logging and monitoring<br>
	- Evidence gathering and analysis		- Evidence gathering and analysis<br>
	- Reverse engineering		- Reverse engineering<br>

← Older revision		Revision as of 13:04, 3 March 2017
Line 13:		Line 13:
	Hands-on training part will take place throughout the entire course starting from Lecture 2, and will finish with a round table, where all parts, including the instructor will sit down to retro the training and discuss the results - what went wrong and what went right.		Hands-on training part will take place throughout the entire course starting from Lecture 2, and will finish with a round table, where all parts, including the instructor will sit down to retro the training and discuss the results - what went wrong and what went right.

	It is important to notice, that due to the lack of classical, or so to say conventional approaches to the topic - this course is more about common sense and obtaining the essential tactical understanding, that it is about anything else.		It is important to notice, that due to the lack of classical, or so to say conventional approaches to the topic - this course is more about common sense and obtaining the essential tactical understanding, that it is about anything else.<br>
	Ideally, in the end of this course a potential student:		Ideally, in the end of this course a potential student:<br>
	a) Understands well how a big, multinational organization works from the SoC and system engineering points of view.		a) Understands well how a big, multinational organization works from the SoC and system engineering points of view.<br>
	b) Knows and understands the general picture with threat landscape targeting common enterprise nowdays.		b) Knows and understands the general picture with threat landscape targeting common enterprise nowdays.<br>
	c) Knows and understands the action sequence and acting plans for intrusion response.		c) Knows and understands the action sequence and acting plans for intrusion response.<br>
	d) Is familiar with common communication guidelines and acting policies in case of intrusion.		d) Is familiar with common communication guidelines and acting policies in case of intrusion.<br>
	e) The most important - in real life situation, when an intrusion happens in student responsibility premises - student knows the actions needed to be undertaken, doesn't get lost or panic and is capable of acting fast and smart in the situation effectively communicating and collaborating with parties capable of assisting him/her.		e) The most important - in real life situation, when an intrusion happens in student responsibility premises - student knows the actions needed to be undertaken, doesn't get lost or panic and is capable of acting fast and smart in the situation effectively communicating and collaborating with parties capable of assisting him/her.<br>

	Course is intended to provide the necessary basic input for such 3 semester courses like:<br>		Course is intended to provide the necessary basic input for such 3 semester courses like:<br>
Line 25:		Line 25:
	- Evidence gathering and analysis<br>		- Evidence gathering and analysis<br>
	- Reverse engineering<br>		- Reverse engineering<br>


	== Lectures plan ==		== Lectures plan ==