IT405 Computer Forensics and Incident Response (3 cr.)

Prerequisite(s): IT400  
This course introduces the principles and best practices for incident response, along with an overview of digital forensics. The goals of incident response, preparation and response to information security incidents, and understanding how incidents occur are covered. Computer and digital media resources are used to explore basic digital forensic investigation techniques. 

Upon completion of this course, students are expected to be able to do the following:

1. Implement the basics of evidence collection and documentation, reporting, investigative techniques, digital forensics tools, and procedures.
2. Identify the implications of data location in responding to security incidents.
3. Conduct incident management through all stages of a breach with knowledge of detection, response, mitigation, reporting, recovery, and remediation.
4. Adjust preventative measures in response to security incidents.     
5. Implement recovery strategies such as backup, recovery sites, multiple processing sites and system resilience via high availability, Quality of Service (QoS), and fault tolerance.