Course Overview
This course provides a foundation in cyber operations as it relates to industrial networks. Building on the concepts learned in the Industrial Network Security, Ethical Hacking and Penetration Testing, and Embedded Systems courses in term three, this course prepares students for the Culminating Project in the following five-week term. The concepts taught in this course relate closely with the concepts being taught concurrently in the Databases and Virtualization for Industrial Network Cybersecurity and ICS Cybersecurity Standards courses. Topics include performing a risk and network intrusion analysis, creating an incident response plan, assisting with a computer forensics instigation, and the Diamond Model of Intrusion Analysis.
Credits
6.0
- Not offered this term
- This course is not offered this term. Notify me to receive email notifications when the course opens for registration next term.
Learning Outcomes
Upon successful completion of this course, the student will be able to:
- Perform a risk assessment based on the CIA triad including threat modeling, attack vectors, complexity and scope, privileges, and user interaction. (4)
- Explain the steps involved with a computer forensics investigation including the role of attribution in a cybersecurity investigation, the use of digital evidence and chain of custody, and the fundamentals for Microsoft Windows and Linux forensics. (2)
- Interpret the output report of a malware analysis tool such as AMP, Threat Grid, or Cuckoo Sandbox. (4)
- Analyze security event data and packet captures for intrusion analysis using regular expressions. (4)
- Configure IPFIX and Netflow for a network device. (3)
- Create a basic incident response plan and process based on industry standard guidelines. (4)
- Normalize data generated by different sources and use the 5-tuple correlation to respond to security incidents. (3)
- Perform a retrospective analysis to reconstruct what happened after an attack has taken place. (4)
- Implement security tools to identify malicious files and map DNS, HTTP, and threat intelligence to identify an attack and respond accordingly. (3)
- Employ the Diamond Model of Intrusion to characterize, organize, and track threats and then develop counter measures. (4)
Effective as of Winter 2021
Related Programs
Cyber Operations (INCS 4310) is offered as a part of the following programs:
- Indicates programs accepting international students.
- Indicates programs eligible for students to apply for Post-graduation Work Permit (PGWP).
School of Energy
- Industrial Network Cybersecurity
Diploma Full-time
Programs and courses are subject to change without notice. Find out more about BCIT course cancellations.