ITX8062
Information Systems Mass Attacks and Defence
Main lecturers
Jaan Priisalu, Swedbank
Rain Ottis, CCD COE
Schedule
NB! Check the schedule for updates before each lesson.
1. 31.08.2010
Lecturer(s): Ottis, Priisalu
Theme: cyber security and Estonia
Topics covered: administrative issues; introduction to the course; why do we care about large scale cyber attacks; relevant terminology; the development of cyber security in Estonia from the 1990’s to today; overview of the 2007 cyber attacks against Estonia.
2. 07.09.2010
Lecturer(s): Priisalu
Theme: cyber crime
Topics covered: criminal attacks, experiences from the banking sector, attack methods, motives, cooperation.
3. 14.09.2010
Lecturer(s): Priisalu, Ottis, guest lecturer
Theme: CIIP
Topics covered: CIIP overall, CIIP in Estonia, crisis management.
Estonian Cyber Security Strategy
4. 21.09.2010
Lecturer(s): Ottis
Theme: politically motivated attacks
Topics covered: hactivism, private hacking for political reasons, state sponsored cyber attacks, cyber espionage and terrorism, methods, motives, countermeasures.
Politically Motivated Cyber Attacks Farmers With Laptops Proactive Defense Estonian Case Study
5. 28.09.2010
Lecturer(s): Priisalu, guest lecturers
Theme: incident handling
Topics covered: CERT perspective, law enforcement perspective, incident handling process in Estonia.
6. 05.10.2010
Lecturer(s): Ottis, Priisalu
Theme: tabletop preparation
Topics covered: tabletop exercise introduction and preparation.
See the section at the bottom of the page
7. 12.10.2010
Lecturer(s): Priisalu
Theme: cyber security planning
Topics covered: cyber security planning.
8. 19.10.2010
Lecturer(s): Ottis, Priisalu
Theme: tabletop exercise
Topics covered: tabletop exercise execution, summary of the course.
See the section at the bottom of the page
Grade assignment
30% - Performance at the tabletop exercise
30% - Written assignment (research paper, 2000-4000 words)
40% - Oral exam
Tabletop Exercise
Lesson 6
The class will be divided into teams of 3-4. Each team will represent either an attacker (Red team) or a defender (Blue team) in an large cyber incident.
The Blue teams are: CERT (Lauri), ISP (Margus), Police (Uko), Bank (Mari-Liis). Think of them in the Estonian context and for the ISP and bank assume to be the largest one.
The Red team leaders (Kaspar, Arnis, Rasmus) will get their assignments when they contact the instructors via e-mail.
Lesson 7
Blue team leaders will e-mail the instructors a one page document that covers:
1. the role of the entity that the team represents in cyber defense (1 paragraph)
2. the key objectives for their team (maintain service availability, identify attackers etc.)
3. their generic plan for reaching their objectives in the case of large scale cyber incidents
Red team leaders will email the instructors a one page document that covers:
1. the nature of the attacker (for example, international organized crime group that specializes in ...; 1 paragraph)
2. the objectives of their team (for example, deny basic services to citizens for three days)
3. their generic plan for reaching their objectives (including types of actions taken, tools used, how targets are identified, etc.)
Unless otherwise specified, the tactics, tools and systems referred to must be observed in real life or at least plausible.
Lesson 8
The instructors lead the exercise and play NPCs (for example, home users).
Each Red team gets to run their scenario. All Blue teams will be engaged in every scenario.
EXAM
Exam times
Fr 05.11 1800 (written assignment due 29.10) - Meet in front of VI-224
CANCELLED - Fr 03.12 1800 (written assignment due 26.11)
Tu 04.01 1800 (written assignment due 15.12)
Tu 11.01 1800 (written assignment due 15.12)
NB! Send in your exam time preference at least two days before the exam date!
Check this wiki for updates on the location of the exam.