JAWAHARLAL NEHRU TECHNOLOGICAL UNIVERSITY HYDERABAD

Course Objectives:

• To know the real world incidents
• To make a pre incident preparation
• To understand about incident detection and characterization

UNIT - I

Real-World Incidents: What Constitutes an Incident?, What Is Incident Response?, Where We Are Now, Why Should You Care About Incident Response?, Concept of the Attack Lifecycle, IR Management Handbook: What Is a Computer Security Incident?, What Are the Goals of Incident Response?, Who Is Involved in the IR Process?, The Incident Response Process: Initial Response, Investigation, Remediation, Tracking of Significant Investigative Information, Reporting.

UNIT - II

Pre-Incident Preparation: Preparing the Organization for Incident Response, Identifying Risk, Policies That Promote a Successful IR, Working with Outsourced IT, Thoughts on Global Infrastructure Issues, Educating Users on Host-Based Security, Preparing the IR Team, Preparing the Infrastructure for Incident Response, Computing Device Configuration, Network Configuration.

UNIT - III

Incident Detection and Characterization: Collecting Initial Facts, Checklists, Maintenance of Case Notes, Building an Attack Timeline, Understanding Investigative Priorities, What Are Elements of Proof?, Setting Expectations with Management, Initial Development of Leads, Defining Leads of Value, Acting on Leads, Turning Leads into Indicators, The Lifecycle of Indicator Generation, Resolving Internal Leads, Resolving External Leads.

UNIT - IV

Data Collection: Live Data Collection, When to Perform a Live Response, Selecting a Live Response Tool, What to Collect, Live Data Collection on Microsoft Windows Systems, Prebuilt Toolkits, Do It Yourself, Memory Collection, Live Data Collection on Unix-Based Systems, Live Response Toolkits, Memory Collection.

UNIT - V

Forensic Duplication: Forensic Image Formats, Complete Disk Image, Partition Image, Logical Image, Image Integrity, Traditional Duplication, Hardware Write Blockers, Image Creation Tools, Live System Duplication, Duplication of Enterprise Assets, Duplication of Virtual Machines.

TEXT BOOK:

• 1. “ Incident Response and Computer Forensics”, Kevin Mandia, Mathew Pepe, Jason Luttgens, 3rd Edition, McGraw-Hill Osborne Media, 2014.

REFERENCES:

• 1. "Handbook Computer Crime Investigation's Forensic Tools and Technology", Eoghan Casey, Academic Press.
• 2. “A Step-by-Step Guide to Computer Attacks and Effective Defenses”, Skoudis. E., Perlman. R. Counter Hack, Prentice Hall Professional Technical Reference.
• 3. “Disk Detective: Secret You Must Know to Recover Information From a Computer”, Norbert Zaenglein, Paladin Press.
• 4. “Guide to computer forensics and investigations”, Bill Nelson, Amelia Philips and Christopher Steuart, Cengage Learning. M.Tech - I Year – II Semester (Cyber Forensics /Cyber Security & Information Security)