Developing and executing plans for detecting and responding to security breaches.
About this course
In NETW 5360, you learn how to build and execute plans for detecting and responding to security breaches. You move beyond basic network defence to focus on the structured management of a crisis. The course covers the full lifecycle of an incident, from initial detection and triage through to containment, eradication, recovery, and post-incident review.
You will work through real-world scenarios where time and accuracy are critical. The curriculum emphasises the legal and ethical considerations of handling digital evidence, ensuring that your response actions are defensible and compliant with privacy laws. By the end of the term, you will have a portfolio-ready incident response plan and the practical skills to lead a response team under pressure.
Who takes this course
Credits: 3 · Hours: 45
Prerequisites
None
Learning outcomes
- Outline the phases of an incident response lifecycle and define roles within a response team.
- Develop a formal incident response plan tailored to the technical infrastructure of an organisation.
- Apply techniques for digital evidence collection and preservation that meet legal standards.
- Analyse simulated security incidents to prioritise containment, eradication, and recovery actions.
- Draft post-incident reports and recommend improvements based on lessons learned.
Evaluation
| Component | Weight (%) |
| Incident Response Plan Project | 30 |
| Mid-term Case Study Analysis | 20 |
| Live Simulation Exercise | 30 |
| Final Exam | 20 |