Applied Cyber Defense: From Instrusion Analysis to Incident Response

About

How do today’s cybercriminals think, plan, and strike—and how can we stop them?
This course introduces a modern, intelligence-driven approach to incident response that helps defenders stay one step ahead of attackers.
You will explore how security teams analyse and respond to real-world IT security incidents, as well as how early detection and proactive defence can prevent attacks before they escalate. Instead of looking at incidents in isolation, you will learn to interpret them through the lens of attacker behaviour: the stages they move through, the decisions they make, and the techniques they rely on.
To make sense of complex intrusions, the course introduces widely-used analytical frameworks such as the Diamond Model, the Cyber Kill Chain, and attacker Tactics, Techniques, and Procedures (TTPs). These models will guide you in breaking down and understanding the structure of an attack from the first probing steps to the final objectives.
By the end of the course, you will be able to recognise how attackers operate, analyse the stages of an intrusion, and apply effective defensive measures to disrupt and mitigate their actions. This course equips future computer scientists and cybersecurity professionals worldwide with the mindset and tools needed for active, intelligence-driven defence in an evolving threat landscape.
The course includes one or two excursions.

Participants can participate in a varied cultural and social programme together with the partcipants from all summer school courses offered within the Ohm International Summer School.

Course leader

Prof. Dr. Tobias Schmidbauer; Contact: tobias.schmidbauer@th-nuernberg.de

Target group

Course is designed for: bachelor's students, master's students, PhD students and graduates

Fields of study: any field covering fundamental knowledge of computer science, such as network technology and operating systems

Fee info