Identifying Data 2018/19
Subject (*) Incident Management Code 614530015
Study programme
Máster Universitario en Ciberseguridade
Descriptors Cycle Period Year Type Credits
Official Master's Degree 2nd four-month period
 First Optional 3
Language
Spanish
Galician
Teaching method Face-to-face
Prerequisites
Department Computación
Coordinador
Dafonte Vazquez, Jose Carlos
 E-mail
carlos.dafonte@udc.es
Lecturers
Dafonte Vazquez, Jose Carlos
Gomez Garcia, Angel
 E-mail
carlos.dafonte@udc.es
angel.gomez@udc.es
Web http://www.munics.es
General description A xestión de incidentes de ciberseguridade céntrase no manexo da proactividade para previr e atenuar posibles consecuencias. Acadarase o coñecemento necesario sobre as ferramentas que poidan facilitar a xestión dos incidentes e as recuperacións, a xustificación dos plans propostos para a recuperación e resiliencia, a identificación e clasificación dos posibles incidentes e a definición das canles para a súa xestión e resolución.

Study programme competencies
Code Study programme competences
A3 CE3 - Knowledge of the legal and technical standards used in cybersecurity, their implications in systems design, in the use of security tools and in the protection of information
A9 CE9 - Ability to write clear, concise and motivated projects and work plans in the field of cybersecurity
A14 CE14 - Ability to develop a continuity business plan on the guidelines of commonly accepted norms and standards
A15 CE15 - Ability to identify the value of information for an institution, economic or of other sort; ability to identify the critical procedures in an institution, and the impact due to their disruption; ability to identify the internal and external requirements that guarantee readiness upon security attacks
A17 CE17 - Ability to plan a time schedule containing the detection periods of incidents or disasters, and their recovery
B2 CB2 - Students will be able to apply their knowledge and their problem-solving ability in new or less familiar situations, within a broader context (or in multi-discipline contexts) related to their field of specialization
B3 CB3 - Students will be able to integrate diverse knowledge areas, and address the complexity of making statements on the basis of information which, notwithstanding incomplete or limited, may include thoughts about the ethical and social responsibilities entailed to the application of their professional capabilities and judgements
B5 CB5 - Students will apprehend the learning skills enabling them to study in a style that will be selfdriven and autonomous to a large extent
B6 CG1 - To have skills for analysis and synthesis. To have ability to project, model, calculate and design solutions in the area of information, network or system security in every application area
B10 CG5 - Students will have ability to apply theoretical knowledge to practical situations, within the scope of infrastructures, equipment or specific application domains, and designed for precise operating requirements
C4 CT4 - Ability to ponder the importance of information security in the economic progress of society

Learning aims
Learning outcomes Study programme competences
Manage proactivity to prevent and mitigate possible security incidents AJ9
AJ14
AJ17
 BJ2
BJ3
BJ5
BJ6
BJ10
 CJ4
Obtain the necessary knowledge about tools that can facilitate the management of incidents and recoveries AJ3
AJ14
AJ17
 BJ2
BJ3
BJ5
BJ6
BJ10
Justify proposed plans for recovery and resilience AJ3
AJ9
AJ14
AJ15
 BJ2
BJ3
BJ5
BJ6
BJ10
 CJ4
Identify and classify possible incidents and define the channels for their management and resolution AJ3
AJ9
AJ17
 BJ2
BJ3
BJ5
BJ6
BJ10
 CJ4

Contents
Topic Sub-topic
1. Fundamentals: resilience and the value of information 1.1. Introduction
1.2. Fundamentals
2. Incident detection and response management 2.1. Detection and notification of incidents
2.2. Response management, containment and mitigation of impact
3. Standards: continuity and recovery plans 3.1. ISO / IEC standards
3.2. Guidelines for incident management
4. Disaster recovery 4.1. Mechanisms
4.2. Phases of recovery
4.3. Protection of critical infrastructures
5. Legislation 5.1. Specific legislation: National Security Scheme, National Cybersecurity Strategy

Planning
Methodologies / tests Competencies Ordinary class hours Student’s personal work hours Total hours
Laboratory practice A9 A14 A17 B2 B3 B10 11 27.5 38.5
Guest lecture / keynote speech A3 A14 A15 A17 B5 B6 C4 8 16 24
Supervised projects A3 A9 A14 A15 A17 B2 B3 B5 B6 B10 C4 1 9 10
Objective test A3 A9 A14 A15 A17 B2 B3 B5 B6 B10 C4 2.5 0 2.5
 
Personalized attention 0 0
 
(*)The information in the planning table is for guidance only and does not take into account the heterogeneity of the students.

Methodologies
Methodologies Description
Laboratory practice Sesións prácticas en computador asociadas a escenarios de incidencias e manexo de ferramentas para ciberincidentes. O objectivo é poñer en práctica os coñecementos das sesións maxistrais fomentando o aprendizase autónomo.
Guest lecture / keynote speech Docencia expositiva. Presentacións dos coñecementos teóricos dos temas da asignatura promovendo a interacción cos estudantes.
Supervised projects Traballo a desenvolver polo alumno sobre algunha das temáticas da asignatura a proposta do propio estudante ou do profesor. Este traballo terá seguimento por parte do profesorado e o estudante fará unha breve defensa presencial do mesmo.
Objective test Proba escrita para valorar os coñecementos adquiridos. Aínda que se centrará no material da docencia expositiva, poderá incorporar algunhas cuestións relacionadas coas sesións prácticas.

Personalized attention
Methodologies
Laboratory practice
Supervised projects
Description
A atención persoalizada está enfocada a apoiar ó alumno na comprensión das diferentes técnicas mediante o apoio nas titorías e a resolución de dúbidas que podan xurdir nas clases maxistrais.

Tamén se lle prestará axuda nas dúbidas que poidan xurdir durante a realización das prácticas e a aprendizaxe mediante traballos tutelados para un mellor aproveitamento e comprensión dos coñecementos acadados na clase.

Assessment
Methodologies Competencies Description Qualification
Laboratory practice A9 A14 A17 B2 B3 B10 Sesións prácticas en computador asociadas a escenarios de incidencias e manexo de ferramentas para ciberincidentes. O objectivo é poñer en práctica os coñecementos das sesións maxistrais fomentando o aprendizase autónomo. A avaliación será contínua perante as sesións. NOTA: Será posible utilizar algunha das sesións presenciais para realizar algún taller dunha entidade colaboradora. 30
Supervised projects A3 A9 A14 A15 A17 B2 B3 B5 B6 B10 C4 Traballo a desenvolver polo alumno sobre algunha das temáticas da asignatura a proposta do propio estudante ou do profesor. Este traballo terá seguimento por parte do profesorado e o estudante fará unha breve defensa presencial do mesmo. 20
Objective test A3 A9 A14 A15 A17 B2 B3 B5 B6 B10 C4 Proba escrita para valorar os coñecementos adquiridos. Aínda que se centrará no material da docencia expositiva, poderá incorporar algunhas cuestións relacionadas coas sesións prácticas. 50
 
Assessment comments
Para superar a materia, será preciso obter un mínimo de 5 sobre 10 tanto na prueba obxectiva como nos traballos prácticos. En caso contrario, a nota máxima que se poderá obter será de 4.5.

ESTUDANTES CON MATRÍCULA A TEMPO PARCIAL OU CON DISPENSA ACADÉMICA DE EXENCIÓN DE DOCENCIA: Deberán poñerse en contacto cos profesores da asignatura para posibilitar a realización das tarefas fóra da organización habitual de materia.

Sources of information
Basic

- ISO/IEC 27035:2016 - Information technology - Security techniques - Information security incident management. http://www.iso27001security.com/html/27035.html

- Gestión de incidentes de seguridad informática, Álvaro Gómez Vieites, 978-84-92650-77-4, RA-MA Editorial, 2014

- Gestión de incidentes de seguridad informática (MF0488_3), Ester Chicano Tejada, 978-84-16351-70-1, IC Editorial, 2014

- Cómo implantar un SGSI según UNE-EN ISO/IEC 27001 y su aplicación en el Esquema Nacional de Seguridad, Luis Gómez Fernández y Pedro Pablo Fernández Rivero, 978-84-81439-63-2 AENOR, 2018

- Sistema de Información para gestionar un SGSI basado en ISO 27001:2013: Cómo tener trazabilidad de un Sistema de Gestión de Seguridad de la información a través de una herramienta Informática, Lorena Mahecha Guzmán y Gabriel Coello F., 978-620-2-25000-9, EAE, 2017

- Implementing the ISO/IEC 27001 ISMS Standard 2016 (Information Security), Edward Humphreys, 978-1-60807-930-8, Artech House Publishers, 2016

- Infosec Management Fundamentals, Henry Dalziel, 978-0-12-804187-1, Syngress, 2015

- Information Security Incident Management: A Methodology, Neil Hare-Brown, 978-0-580-50720-5, BSI Standards, 2007
Complementary


Recommendations
Subjects that it is recommended to have taken before

Subjects that are recommended to be taken simultaneously

Subjects that continue the syllabus

Other comments

The student is recommended, for an optimal use of the subject, an active monitoring of the classes as well as participating in the different activities and the use of personalized attention for the resolution of doubts or questions that may arise.


(*)The teaching guide is the document in which the URV publishes the information about all its courses. It is a public document and cannot be modified. Only in exceptional cases can it be revised by the competent agent or duly revised so that it is in line with current legislation.