Threat management and incident response

Module title:

Threat management and incident response

Module overview:

The objective of this course is for students to acquire a comprehensive understanding of threat management and incident response in cybersecurity. The course is designed in collaboration with global cybersecurity experts, focusing on identifying and mitigating business risks by transforming unknown internal and external threats into known ones. Students will learn to apply a structured approach to build effective cybersecurity threat intelligence and incident response.
In this module students will learn:
the importance of threat intelligence in risk management and incident response.
various types of cybersecurity threats, threat actors, their motives, and objectives.
decoding the steps in incident resolution planning and the incident response program.
managing incidents, including recognizing signs and costs of an incident.
techniques for collecting threat data through various sources and methods.
gathering threat data using Open-Source Intelligence (OSINT), Human Intelligence (HUMINT), Cyber Counter-Intelligence (CCI), Indicators of Compromise (IoC), and malware analysis.
creating reports on cybersecurity threat intelligence.
skills for handling different types of security incidents.
applying appropriate techniques for various types of security incidents.

Literature:

Required readings:
1. Martinez, R. (2022) Incident Response with Threat Intelligence: Practical insights into developing an incident response capability through intelligence-based threat hunting. Birmingham: Packt Publishing Ltd.

Supplementary readings:
1. Palacín, V. (2021). Practical Threat Intelligence and Data-Driven Threat Hunting, Birmingham: Packt Publishing Ltd.
2. Cichonski, P. et al. (2012). Computer Security Incident Handling Guide, [s.l.]: NIST.