The number of successful cyberattacks has grown tremendously over the past years; often it is only a matter of time when a company, government or institute is hacked. As it is almost impossible to prevent attacks and breaches, it is important to have a strategy and personal that react properly after a successful attack. This will decrease the impact on the company and help preserving evidence. Consequently, industry and public sector is investing in incident response teams and incident response plans. While it is an important topic and relies on many technical skills and planning, there is barely any freely accessible material or University courses that offer training in this domain. Most of the current offerings are from industry or institutes, e.g., the SANS Institute. This project aims to form a Digital Forensics Incident Response (DFIR) Alliance who can serve as experts in the domain but more importantly will develop an update to date curricula. First, the alliance will analyze the most needed skills jointly with other experts in the field (e.g., law enforcement agencies) which will result in a skillmap. This skillmap will be shared so that cybersecurity / digital forensic programs can adjust their curriculum accordingly. Second, this project will develop course material -- theoretical as well as hands on -- which will be shared with the public and utilized by the partnering institutions. The resulting material may be as a semester long course or a 1-week intense seminar. In summary, there are three major objectives: - Build a network of DFIR experts that can be utilized when needed (e.g., supporting law enforcement, deliver modules or provide training). - Create a ranked skillmap for DFIR specialists (i.e., identify / rank most needed skills that can also be delivered in the given time frame). - Develop DFIR course materials (theory / hands on) including evaluating and testing of the developed materials. To ensure that the developed curriculum will address the needs of industry and public sector, this project will involve an interdisciplinary consortium that has expertise in various areas of cybersecurity and digital forensics: - University of Liechtenstein (Mobile forensics, hashing and machine learning), - University Albstadt-Sigmaringen (traditional digital forensics, cybercrime and open source intelligence), - Waterford Institute of Technology (small device forensics, network and online investigations, and data mining), and - Brno University of Technology (Network security and forensics). Additionally, some consortium members have / had collaboration with law enforcement agencies and worked jointly on projects. This project will generate impact on higher education and help reducing the shortage of skilled incident response personal. Since we will disseminate the outcomes of this project across our networks, and share our findings and insights on various online platforms, we expect that this project will be taken up by other universities (either as a whole curriculum, or parts of it).
The project aimed to counteract the shortage of trained specialists in the DFIR domain by developing an up to date and freely available curricula. This curricula consisted of theoretical materials, practical exercises and two case studies featuring real world cyberattacks frequently encountered in the industry. As well as training new specialists, the project was also focused on upskilling industry practitioners. An example of this was the discovery that currently people working in the field felt they were lacking skills in cloud forensics and this formed a considerable part of the direction of the project. Another aim of the project was to make sure that the materials remained available to the public after the project ends. This has been done through the use of an open source educational platform that will allow the materials to be accessible after the end of the project. In order to make the academic and industry communities aware of the project and the training materials, a journal paper was presented at DFRWS USA and attendees had the opportunity to participate in using the training materials at workshops such as DFRWS EU 2022 held at Oxford University, DFRWS EU 2023 held at the University of Bonn and ARES 2023 held at the University of Sannio in Benevento Italy.
The growth in cyberattacks across the globe has led to an increase in the demand for cybersecurity specialists, particularly in the area of incident response. As well as the shortage of specialists, the fast moving pace of technology means that those already working in the area also need to upgrade their skillset on a frequent basis. This project aimed to address these needs through the development of an up to date Digital Forensics and Incident Response (DFIR) curricula that would be made freely available to academia and industry. To ensure that the developed curriculum addressed the needs of industry and public sector, the project consortium was chosen with interdisciplinary expertise in various areas of cybersecurity and digital forensics: - University of Liechtenstein (Mobile forensics, hashing and machine learning) - University Albstadt-Sigmaringen (traditional digital forensics, cybercrime and open source intelligence) - South East Technological University of Ireland (formerly Waterford Institute of Technology) (small device forensics, network and online investigations, and data mining) - Brno University of Technology (Network security and forensics)