Handbook

Every person, business, organisation and government around the world is investing in cyber security. Information is increasing in value, the growth of devices online is exponential, and the complexity of systems is driving increasing opportunity for their subversion. Both software and security vendors strive to design, build and distribute technologies to protect information, plug software holes, and detect malicious activity.

The Cyber domain is an active arms-race where the attacking side has the inherent advantage: attackers need only discover a single vulnerability within a target’s wilderness of code, architecture or configuration to successfully breach security. At the same time, defenders race to discover vulnerabilities and implement counter measures.

Combatting attacker tools using technical mitigation and detection measures is an incomplete strategy. New thinking in the realm of cyber security focusses more and more on defeating cyber threat actor behaviour rather than just their technology. Hack-back, active-defence, and infiltration of cyber threat actor networks, are examples of targeting the people behind the keyboard.

Essential to combating cyber threat actor behaviour is understanding it. The tactics, techniques and procedures (TTPs) employed by a cyber threat actor are also known as ‘tradecraft’. It is this tradecraft, which is the focus of this course.

Students will be walked through the various stages of the Cyber Kill Chain. The Cyber Kill Chain is an industry-accepted methodology for understanding how an attacker will conduct the activities necessary to cause harm to an organisation.