CSDO-6 Security Operations and Incident Response
CSDO-6 Security Operations and Incident Response
- Course description
- Course CodeCSDO-6
- Level of Study5.2
- Program of StudyCyber Security, Defence and Operations
- Credits15
- Study Plan CoordinatorJustine Moodley
The course provides knowledge of how a security operations centre (SOC) detects and responds to threats, and skills to monitor systems, handle incidents, and recover from them. It introduces the work of a SOC analyst, from alert triage and threat hunting to incident response.
Students learn how attackers operate, how systems are hardened against known attacks, and how MITRE ATT&CK, SIEM and intrusion detection are used in a SOC. They set up monitoring and detection, write detections, use threat intelligence and triage alerts, and learn when to trust suggestions from AI assistants. The course also covers how AI workloads are secured, how ransomware and email fraud have shaped the way organisations defend themselves, and how security responses are automated. Students handle incidents from detection to containment and recovery, alone and as part of a team, and assess their own incident handling against reporting obligations.
The candidate:
- has knowledge of how attackers operate and use social engineering, and of how MITRE ATT&CK, SIEM and IDS/IPS are used in a SOC to detect and respond to threats
- has knowledge of how AI and automation are used in a SOC to triage alerts and respond to incidents, and of how AI workloads are secured
- can assess their own incident handling in relation to reporting obligations and requirements for containment and recovery
- is familiar with the work of a SOC analyst, from alert triage and threat hunting to incident response
- can update their knowledge of current threats and attacker methods through threat intelligence
- is familiar with how ransomware and email fraud have shaped the way organisations defend themselves
The candidate:
- can explain their choices when writing detections and triaging alerts, including when to trust AI suggestions
- can reflect over how they handled an incident and adjust their approach under guidance
- can find and refer to threat intelligence and assess its relevance to an incident
- can assess a system's configuration and logs, and harden it against known attacks
The candidate:
- can set up monitoring and detection in a SIEM, and detect, contain and recover from ransomware and other incidents, alone and as part of a team
- can discuss threats and detections with other analysts, and use AI assistants critically in that work
- can contribute to organisational development by automating security responses and improving detection
Students use a combination of written content, videos and practical learning activities designed to help them achieve the course learning outcomes.
Industry Relevance
Course content, learning activities and tools reflect industry standards and are developed in collaboration with industry partners and experts from the field.
Practical Work
The course includes regular practical activities where students apply their knowledge and practise relevant skills.
Collaboration
Collaboration is facilitated through the LMS and Teams, and students are encouraged to work together for peer support and shared learning.
Guidance
Teachers are available for guidance at scheduled times. Students are encouraged to share work in progress and use feedback from teachers and fellow students to develop their work further.
This course has one coursework requirement, graded Approved / Not Approved.
| Form of assessment | Grading scale | Grouping | Duration of assessment |
|---|---|---|---|
Course Assignment | Grade A-F | Individual | 1 Week(s) |