|
|
| (ei näidata sama kasutaja 42 vahepealset redaktsiooni) |
| 1. rida: |
1. rida: |
| ==Information Systems Mass Attacks and Defence==
| | Information Systems Mass Attacks and Defence wiki has [http://courses.cs.ttu.ee/pages/ITX8062 moved to a new location]. |
| | |
| ==Main lecturers==
| |
| | |
| Jaan Priisalu, Riigi Infosüsteemi Amet
| |
| | |
| Rain Ottis, CCD COE
| |
| | |
| ==Schedule==
| |
| | |
| NB! This schedule will be updated to 2011 Fall session by 05 September 2011.
| |
| | |
| NB! Check the schedule for updates before each lesson.
| |
| | |
| | |
| 1. '''31.08.2010'''
| |
| | |
| Lecturer(s): Ottis, Priisalu
| |
| | |
| Theme: cyber security and Estonia
| |
| | |
| Topics covered: administrative issues; introduction to the course; why do we care about large scale cyber attacks; relevant terminology; the development of cyber security in Estonia
| |
| from the 1990’s to today; overview of the 2007 cyber attacks against Estonia.
| |
| | |
| [https://docs.google.com/fileview?id=0B7yq33Gize8yNTliNzAyMmMtZjE3OC00MDNmLTg0ZTctNmQwOWE2M2Q1ZjI2&hl=en&authkey=CI60nqQI Introduction]
| |
| | |
| 2. '''07.09.2010'''
| |
| | |
| Lecturer(s): Priisalu
| |
| | |
| Theme: cyber crime
| |
| | |
| Topics covered: criminal attacks, experiences from the banking sector, attack methods, motives, cooperation.
| |
| | |
| | |
| 3. '''14.09.2010'''
| |
| | |
| Lecturer(s): Priisalu, Ottis, guest lecturer
| |
| | |
| Theme: CIIP
| |
| | |
| Topics covered: CIIP overall, CIIP in Estonia, crisis management.
| |
| | |
| [http://www.mod.gov.ee/files/kmin/img/files/Kuberjulgeoleku_strateegia_2008-2013_ENG.pdf Estonian Cyber Security Strategy] | |
| | |
| | |
| 4. '''21.09.2010'''
| |
| | |
| Lecturer(s): Ottis
| |
| | |
| Theme: politically motivated attacks
| |
| | |
| Topics covered: hactivism, private hacking for political reasons, state sponsored cyber attacks, cyber espionage and terrorism, methods, motives, countermeasures.
| |
| | |
| [https://docs.google.com/fileview?id=0B7yq33Gize8yZDk0OTQ3MGYtY2E4NS00YTdiLTgxZDQtOGNlY2M5ZTZjNGI2&hl=en&authkey=CPLlrpUB Politically Motivated Cyber Attacks]
| |
| [https://docs.google.com/fileview?id=0B7yq33Gize8yZWU3OWMxMzctNjYwNC00NWI0LWJiNzYtZTY2NjA1N2I4OTJl&hl=en&authkey=CM3KnbsH Farmers With Laptops]
| |
| [https://docs.google.com/fileview?id=0B7yq33Gize8yOGRjM2RjMzAtYjAzMy00M2YwLWIzZjYtODEwZjYzMjkxNGM2&hl=en&authkey=CPWakuYP Proactive Defense]
| |
| [https://docs.google.com/fileview?id=0B7yq33Gize8yNjRjNWJjZDktNTEyYy00MmE5LTk5MjYtODFlZmYyMWI1MDMw&hl=en&authkey=CNbJsfAL Estonian Case Study]
| |
| | |
| | |
| 5. '''28.09.2010'''
| |
| | |
| Lecturer(s): Priisalu, guest lecturers
| |
| | |
| Theme: incident handling
| |
| | |
| Topics covered: CERT perspective, law enforcement perspective, incident handling process in Estonia.
| |
| | |
| | |
| 6. '''05.10.2010'''
| |
| | |
| Lecturer(s): Ottis, Priisalu
| |
| | |
| Theme: tabletop preparation
| |
| | |
| Topics covered: tabletop exercise introduction and preparation.
| |
| | |
| <b> See the section at the bottom of the page </b>
| |
| | |
| | |
| 7. '''12.10.2010'''
| |
| | |
| Lecturer(s): Priisalu
| |
| | |
| Theme: cyber security planning
| |
| | |
| Topics covered: cyber security planning.
| |
| | |
| | |
| 8. '''19.10.2010'''
| |
| | |
| Lecturer(s): Ottis, Priisalu
| |
| | |
| Theme: tabletop exercise
| |
| | |
| Topics covered: tabletop exercise execution, summary of the course.
| |
| | |
| <b> See the section at the bottom of the page </b>
| |
| | |
| ==Grade assignment==
| |
| | |
| 30% - Performance at the tabletop exercise
| |
| | |
| 30% - Written assignment (research paper, 2000-4000 words)
| |
| | |
| 40% - Oral exam
| |
| | |
| | |
| ==Tabletop Exercise==
| |
| | |
| ===Lesson 6===
| |
| | |
| The class will be divided into teams of 3-4. Each team will represent either an attacker (Red team) or a defender (Blue team) in an large cyber incident.
| |
| | |
| The Blue teams are: CERT (Lauri), ISP (Margus), Police (Uko), Bank (Mari-Liis). Think of them in the Estonian context and for the ISP and bank assume to be the largest one.
| |
| | |
| The Red team leaders (Kaspar, Arnis, Rasmus) will get their assignments when they contact the instructors via e-mail.
| |
| | |
| ===Lesson 7===
| |
| | |
| <b>Blue team</b> leaders will e-mail the instructors a one page document that covers:
| |
| | |
| 1. the role of the entity that the team represents in cyber defense (1 paragraph)
| |
| | |
| 2. the key objectives for their team (maintain service availability, identify attackers etc.)
| |
| | |
| 3. their generic plan for reaching their objectives in the case of large scale cyber incidents
| |
| | |
| | |
| <b>Red team</b> leaders will email the instructors a one page document that covers:
| |
| | |
| 1. the nature of the attacker (for example, international organized crime group that specializes in ...; 1 paragraph)
| |
| | |
| 2. the objectives of their team (for example, deny basic services to citizens for three days)
| |
| | |
| 3. their generic plan for reaching their objectives (including types of actions taken, tools used, how targets are identified, etc.)
| |
| | |
| | |
| Unless otherwise specified, the tactics, tools and systems referred to must be observed in real life or at least plausible.
| |
| | |
| | |
| ===Lesson 8===
| |
| | |
| The instructors lead the exercise and play NPCs (for example, home users).
| |
| | |
| Each Red team gets to run their scenario. All Blue teams will be engaged in every scenario.
| |
| | |
| | |
| | |
| ==EXAM==
| |
| | |
| ===Exam times===
| |
| Fr 05.11 1800 (written assignment due 29.10) - Meet in front of VI-224
| |
| | |
| <b>CANCELLED</b> - Fr 03.12 1800 (written assignment due 26.11)
| |
| | |
| Tu 04.01 1800 (written assignment due 15.12) - IT-137A
| |
| | |
| Tu 11.01 1800 (written assignment due 15.12) - IT-137A
| |
| | |
| | |
| <b>NB! Send in your exam time preference at least two days before the exam date!</b>
| |
| | |
| Check this wiki for updates on the location of the exam.
| |