Knowledge

The student ...

can define and use the NIST Cybersecurity model with Identify, Protect, Detect, Respond, Recover
understands the role of patching in security, and is be able to explain how large attacks can often be traced back to missing patches
can assess different sources in investigations, which sources are important and how these are handled
can define and explain the defense of cloud solutions, as well as demonstrate knowledge of the different technologies and techniques used in cloud solutions
understands the principles behind establishing an Security Operations Center (SOC) at a company, and can assess necessary sensors and sources, and understand how data from these can be aggregated
understands the handling of evidence and evidence chains, and what evidence can be taken to court
can explain which Incident Response environments exist nationally and internationally, and how these can be used

Skills

The student ...

can perform Threat Hunting and Forensics of compromised systems
can use Security Information and Event Management (SIEM) tools for aggregation and analysis of log data
can perform event handling of compromised machines, as well as use endpoint agents to strengthen event handling
can conduct incident management and investigation of unfaithful servants (inside attackers)
can procedures for handling evidence and sensitive information, and to exchange it according to standards

General competence

The student ...

can perform event handling in a SIEM tool
can understand the operational part of security work and what role this has in a comprehensive security strategy

Subject description CYB2100

Cyber Defense