M6 -110 CCD II COURSE OVERVIEW Cyber Incident Handling & Disaster Recovery Course BACKGROUND The Cyber Security Incident Response & Recovery Course is the third of the four - course Cyber Security Certificate Programme offered by NATO School Oberammergau (NSO), in cooperation with Naval Postgraduate School (NPS), the United States Partnership and Education Training Center (US PTEC). The four cyber security courses (M6-108 Network Security, M6-109 Network Vulnerability Assessment and Risk Mitigation, M6-110 Cyber Incident Handling and Disaster Recovery, and M6-111 Network Traffic Analysis) can be taken individually or collectively, as desired. Though the courses can be taken in any order, Network Security is the ideal starting course, owing to the foundational principles that are established. The course fulfills the need for developing cyber security expertise and improving the defense of critical infrastructure within NATO/partner nations, as protection of Communications and Information Systems (CIS) became one of the major tasks for the Alliance, recognized in NATO’s Strategic Concept and 2014 Wales Summit Declaration. AIM The aim of this course is to define the nature and scope of cyber security incident handling services, including intrusion/incident detection, damage control, service continuity, forensic analysis, incident reporting, service/data restoration, disaster recovery, continuity of operations. 07 October 2014 – Version 6.0. NATO Unclassified Page 1/5 M6 -110 CCD II COURSE OVERVIEW LEARNING OBJECTIVES LO1 – Given lectures and quizzes, students will summarize typical Incident Handling and Response terminology and methodologies, in accordance with the model framework. LO2 – Based on lectures, online labs and quizzes, students will describe how to create, manage, staff and run a Computer Security Incident Response Team (CSIRT) at the local command level and Community Emergency Response Teams (CERT) on a National Level. LO3 – Given lectures, online labs and quizzes, students will be able create an Incident Response Policy, based on the organization’s structure, that methodically handles such incidents as Denial of Service (DOS), unauthorized access, inappropriate usage of the network, insider threats, and even multiple components incidents. LO4 – Based on lectures, online labs and quizzes, students will explain the principles of disaster recovery, including preparation of a disaster recovery plan, assessment of risks in the enterprise, development of policies, and procedures, and attentiveness to the roles and relationships of various members of an organization, implementation of the plan, and recovering from a disaster. LO5 – Given lectures, online labs, and quizzes, students should describe the fundamentals of system–level and data-level recovery tools and techniques, utilizing different recovery techniques, including back-up and recovery technologies and the use of virtualization. CONTACT Ms. Liliana Serban, ROU-CIV Course Director/Naval Postgraduate School (NPS) Liaison Officer Cooperative Security Department NATO SCHOOL Oberammergau 82487 Oberammergau – Germany, Am Rainenbichl 54 E-mail: [email protected] Tel. +49-8822-9481-2600 www.natoschool.nato.int 07 October 2014 – Version 6.0. NATO Unclassified Page 2/5 M6 -110 CCD II COURSE OVERVIEW COURSE PARTICIPANTS/TARGET AUDIENCE This is a technical course that requires a modicum of technical education and/or experience background. This is a technical course that requires a modicum of technical education and/or experience background. This course will significantly benefit incident handlers, risk assessment administrators, penetration testers, cyber forensic investigators, venerability assessment auditors, system administrators, system engineers, firewall administrators, network managers, IT managers, IT professionals and anyone who is interested in incident handling and response. No rank requirement.  LANGUAGE PROFICIENCY English IAW STANAG 6001 3333 CLASSIFICATION NATO Unclassified METHODOLOGY This ten-week course is a mix of lectures, classroom seminar-style discussions, question & answer (Q&A) assignments, videos, online discussions, labs, and quizzes. A final exam is required. The student's time will average 4 to 5 hours a week during the Distance Learning (DL) segment of the course. This will be spread across the following three tasks: 1) reading and CONTACT Ms. Liliana Serban, ROU-CIV Course Director/Naval Postgraduate School (NPS) Liaison Officer Cooperative Security Department NATO SCHOOL Oberammergau 82487 Oberammergau – Germany, Am Rainenbichl 54 E-mail: [email protected] Tel. +49-8822-9481-2600 www.natoschool.nato.int 07 October 2014 – Version 6.0. NATO Unclassified Page 3/5 M6 -110 CCD II COURSE OVERVIEW answering approximately one Question & Answer (Q&A) assignment each week; 2) taking one short (10-20 questions) online, multiple-choice, quiz every week, and 3) working though one lab assignment each week. ADDITIONAL INFORMATION: 1) PREREQUISITE The students will be expected to know some basic information on operating systems, programming, networking, and information assurance, preferable to be graduates of the Network Security Course. If not graduates of this course, applicants would need the consent of the NPS instructor to participate in the Cyber Incident Handling & Disaster Recovery Course. 2) COURSEWARE Majority of the resources used in the teaching of the course will be supplied via: 1) Textbooks available via SafariBooksOnline accounts; 2) Instructor materials posted to the course Sakai site, and 3) EC-Council materials required for their certification (included in the course fee) 3) STUDENT ASSESSMENT Students will be assessed based upon a combination of labs, quizzes, and two additional exams. The weight of these will be as follows: Submitted Labs: 30%; Quizzes: 30 %; EC-Council Disaster Recovery Professional (DRP) exam: 15%; and EC-Council Cyber Incident Handler (CIH) exam: 25% CONTACT Ms. Liliana Serban, ROU-CIV Course Director/Naval Postgraduate School (NPS) Liaison Officer Cooperative Security Department NATO SCHOOL Oberammergau 82487 Oberammergau – Germany, Am Rainenbichl 54 E-mail: [email protected] Tel. +49-8822-9481-2600 www.natoschool.nato.int 07 October 2014 – Version 6.0. NATO Unclassified Page 4/5 M6 -110 CCD II COURSE OVERVIEW 4) CERTIFICATION Successfully completion of this course is ¼ of the total (four courses) required to obtain the Cyber Security Certificate. Number of Iterations per Year: 2 Maximum number of students per Iteration: 30 Minimum number of students per Iteration: 25 CONTACT Ms. Liliana Serban, ROU-CIV Course Director/Naval Postgraduate School (NPS) Liaison Officer Cooperative Security Department NATO SCHOOL Oberammergau 82487 Oberammergau – Germany, Am Rainenbichl 54 E-mail: [email protected] Tel. +49-8822-9481-2600 www.natoschool.nato.int 07 October 2014 – Version 6.0. NATO Unclassified Page 5/5