Practical Cybersecurity

This course will teach theoretical and in-depth practical skills in operative cybersecurity. It addresses security testing and defensive as well as offensive techniques in securing networked information systems against security threats. You will learn about the legal background and limitations of such activities, about professional ethics in cybersecurity, learn about information collection (reconnaissance), practical vulnerability testing and intrusion detection and participate in exercises such as capture-the-flag and red-blue-teaming, and you will learn to use tools for practical cybersecurity work.

Language of Instruction: English

ACIT4280 Privacy by Design

ACIT4050 Applied Computer and Network Security

No formal requirements over and above the admission requirements.

After completing this course, the students have the following learning outcomes, defined in terms of knowledge, skills and general competence:

Knowledge

On successful completion of this course the student has:

• an understanding of the theoretical foundations of operative cybersecurity

• knowledge of offensive and defensive cybersecurity measures
• awareness of reference databases for vulnerabilities, exploits and information security advisories
• knowledge of professional ethics in cybersecurity and penetration testing
• knowledge of legal limitations for cybersecurity activities
• familiarity with international, national and sectorial crisis response and cybersecurity authorities

Skills

On successful completion of this course the student can:

• gather information (reconnaissance) about target systems and target organizations, identify vulnerabilities and choose targets for penetration testing
• run penetration testing with practical attacks against systems, software and users
• detect and identify intrusion to systems and execute countermeasures

• retrieve current intelligence about vulnerabilities, security patches and attack methods
• distinguish risk-based approach to cybersecurity operations from ad hoc cybersecurity operations
• configure intrusion detection or endpoint detection and response (EDR) agents
• configure and collect logs
• detect and monitor intrusions
• recover and secure evidence from log files and other resources for analysis of events
• find, exploit and mitigate vulnerabilities in networked information systems.

General competence

On successful completion of this course the student can:

• organize cybersecurity operations

• use relevant tools for cybersecurity operations
• use relevant tools for passive and active cybersecurity operations
• apply their knowledge of general incident management

• Online course material for preparatory reading (flipped classroom approach)
• Lectures
• Group tutorials with live demonstrations
• Group exercises applying tools and techniques for attack, testing and defense
• Home assignments (written and practical, e.g. attacking or securing virtual machines)

• Blue-Red-team competitions in defender and attacker roles

The following required coursework must be approved before exams can be taken:

• 5 individual assignments

Individual oral examinations covering the course content (30 minutes) and the five individual assignments.

The oral examination cannot be appealed.

New/postponed exam: In case of failed exam or legal absence, the student may apply for a new or postponed exam. New or postponed exams are offered within a reasonable time span following the regular exam. The student is responsible for registering for a new/postponed exam within the time limits set by OsloMet. The Regulations for new or postponed examinations are available in Regulations relating to studies and examinations at OsloMet.

All aids are permitted, provided the rules for plagiarism and source referencing are complied with.

A-F

Two internal examiners. External examiners are used regularly.

Lothar Fritsch