• E4J University Module Series: Cybercrime

• Module 9: Cybersecurity and Cybercrime Prevention - Practical Applications and Measures

• Introduction and learning outcomes

• Key issues

  • Assets, vulnerabilities and threats
  • Risk
  • Vulnerability disclosure
  • Cybersecurity measures and usability
  • Situational crime prevention
  • Incident detection, response, recovery and preparedness
  • Conclusion
  • References

• Exercises

• Possible class structure

• Core reading

• Advanced reading

• Student assessment

• Additional teaching tools

•  

• First published in April 2019, updated in February 2020 
  

•  

 

  This module is a resource for lecturers  

 

Incident detection, response, recovery and preparedness

 

Incident detection is the process of identifying threats by actively monitoring assets and finding anomalous activity (NIST, 2018). Once a threat is detected, appropriate actions are taken to neutralize the threat (if it is an active threat at the time of the response) and investigate the incident. After responding to the incident, the first step in the recovery process is to restore access and availability of systems, networks, services and data to a pre-incident state (NIST, 2018).

Recovery also involves an element of planning that requires the identification, creation, and ultimate implementation of measures for resilience and to enable the restoration of systems, networks, services, and data that were unavailable, harmed, damaged, and/or compromised during the incident. An essential element in ensuring resilience is having an up-to-date business continuity plan or emergency management plan (Maras, 2014b), which outlines instructions to be followed and actions to be taken in the event of a cybersecurity incident. Put simply, this plan includes detailed information on the ways in which to respond to an incident and recover from it. All those involved in cybersecurity response and recovery should be informed about the emergency managementplan. Here, training is required that includes exercises designed to test the efficacy and efficiency of these plans. An example of this type of exercise is the US Department of Homeland Security's Cyber Storm exercises, which involves participants from national public and private agencies, as well as agencies from other countries (e.g., Australia, Canada, Denmark, Finland, France, Germany, Hungary, Italy, Japan, New Zealand, the Netherlands, Sweden, Switzerland, and the United Kingdom), in order to test current information sharing practices between these agencies, and their cybersecurity preparedness, protection, and response capabilities (DHS, n.d.).

 

Next: Conclusion

Back to top