Education and qualification degree: MASTER
Form of education: FULL-TIME, PART-TIME
Training duration: 2 year, 1 year
Area of higher education: 5. TECHNICAL SCIENCES
Professional Field: 5.3. COMMUNICATION AND COMPUTER TECHNOLOGY
Qualification: MASTER ENGINEER OF COMMUNICATION NETWORKS AND CYBERCRIME INVESTIGATION
Credits according to ECTS: 120, 60
I. SPECIALTY PROFILE
The one-year Master’s program in “Communication Networks and Cybercrime Investigation” corresponds to a professional field 5.3.”Communication and Computer Technology”. The Master’s program is designed for bachelors in the professional fields 5.3.”Communication and Computer Technology” and 4.6 “Informatics and Computer Science”. It is offered in full-time and part-time forms of training. The Master’s program duration is one academic year (2 semesters). Graduates are trained in the credit system, which allows quality training in compliance with EU requirements and directives.
The two-year Master’s program in “Communication Networks and Cybercrime Investigation” corresponds to a professional field 5.3.”Communication and Computer Technology”. The program is designed for professional bachelors in the professional field 5.3. Communication and computer technology and for bachelors from other professional fields.
The Master’s program is offered in full-time and part-time forms of training. The Master’s program duration is two academic years (4 semesters). The third and fourth semesters correspond to those studied in the one-year master’s program in “Communication networks and cybercrime investigation”. The first two semesters are preparatory and aim to cover preliminary knowledge. The Curriculum courses are only compulsory. Graduates are trained in the credit system, which allows quality training in compliance with EU requirements and directives.
Communication Networks and Cybercrime Investigation Master degree gives an opportunity to those who has a previous knowledge in Cyber Security, to obtain knowledge and practical skills in the field of cybercrime investigation. The program designed for students who seek to work in the forensics field of Cyber security, mainly in Police and other relevant force structures who are responsible in fighting cyber-crime but also in private sector of Security Operations Centers (SOCs) with its main demand at the financial sector organizations and critical infrastructure facilities. The main accents at the course on such necessary knowledge for event investigation specialist as reverse engineering, real-time investigation versus ex-post investigation, recovery of information and data, evidential preservation, relevant tools (including recovery tools) and writing an inspection report summarizes. The course labs include training on Cyber Range Simulator for the relevant attacks with follow analysis.
II. GOALS AND TASKS OF THE SPECIALTY
Objectives of the speciality “Communication Networks and Cybercrime Investigation” for Master’s degree is to meet the global challenges in Cyber Forensics by acquiring in-depth knowledge of modern IT technologies and mechanisms for cyber-attacks, cyber defences and cybercrime investigations and building practical skills for individual or team problem-solving in the field of electronic data protection, communications and server-based services.
The main goal of the speciality “Communication Networks and Cybercrime Investigation” is to create appropriate conditions for professional training of engineers in the field of communication networks and cybercrime investigations, contributing to the acquisition of competencies that will allow students to obtain successful professional implementation in supporting the security of IT infrastructures, delivery of secure online services, offering solutions for secure communications, investigation and detection of cybercrime.
Additional goals of the training in the speciality “Communication Networks and Cybercrime Investigation” are building skills for creative thinking, independence in problem-solving, ability to work in a team.
Tasks:
1. Acquiring modern knowledge, skills and competencies that are relevant to the new trends in the field of cybercrime attacks and cyber investigations.
2. Creating appropriate conditions for an educational environment that motivates students to develop skills for independent problem solving through research and applying scientific methods, tools and platforms.
3. Stimulating creative attitude to the set tasks by tolerating non-standard thinking and using alternative approaches.
4. Supporting team-building skills by stimulating the implementation of joint role-based projects.
5. Building skills for self-acquisition of knowledge and skills following the rapidly changing requirements of the labour market.
III. QUALIFICATION STANDARD
III.1. Structure and organization of the learning process
The study content is block-structured in semesters. The studied courses are compulsory and aim to build in-depth knowledge and skills of performing software analysis and tracking in order to conduct cyber investigations in network communications and delivery of server services. The study content is created with attention to the guidelines of the “National Policy of the Cyber Protection Professions in the State of Israel” of the Israel National Cyber Directorate (INCD). The curriculum is enriched with a significant amount of practical tasks aimed at deepening knowledge and building skills for solving practical problems. Extracurricular activities are provided for the studied courses, during which students develop their skills for independent problem solving, initiative and creativity.
The methodology of teaching, learning and assessment is in line with the European forms and directives for quality training and lifelong learning. The study program is methodologically structured and provides theoretical knowledge, methods and tools for detecting, identifying, deciphering and recovering events; data analysis, data cross-referencing and correlation between data to assemble a complete picture followed by examples from the real life and continues with solving tasks/issues by the students, analyzing the results and solutions followed by conclusions and lecturer’s recommendations. During the course, the students receives a source of mandatory professional literature which they obliged to study. Multimedia technologies, web-based platforms for e-learning, use of simulation environments, assignment of individual and group tasks are widely used. At the end of each course students will have an exam. In the assessment, various forms are used in order to improve the motivation of students and minimize the subjective factor.
III.2. Acquired knowledge, skills and competencies
Area and scope of knowledge
The program will allow to the students to receive knowledge in the field of cybercrime investigation including:
• Recovery of information and data, including the following components:
◦ Event Decoding;
◦ Reverse Engineering;
• Evidential preservation;
• Real-time investigation versus EX-Post investigation;
• Knowledge of tools;
• Legal aspect (basic):
• Familiarity with relevant investigative bodies in Bulgaria and their powers.
Area and scope of skills
The program will allow to the students to receive practical professional skills in the field of cybercrime investigation including:
• Recovery of information and data, including the following components:
◦ Event Decoding;
◦ Reverse Engineering;
• Evidential preservation;
• Real-time investigation;
• Using different specialized tools;
• Writing an inspection report summarizes.
Competencies:
○ Communicative and social competencies:
◦ communicative and empathic skills for working with people;
◦ management of investigation teams and resources;
◦ a proper vocabulary of communication with colleagues, partners and stakeholders, including the use of a foreign language at a good level;
◦ accurate and accessible presentation of ideas for solving professional problems;
○ Professional competencies:
The program will allow to the students to obtain the following professionals competencies:
• To do a digital investigation using advanced technologies;
• To respond quickly to an attack;
• To reveals unusual online behavior and tries to predict future cybercrime;
• To do an investigation including data collection, drawing the profile of the suspects, reconstructing the incident, preserving evidence;
• To reveals if the attack originates from inside or outside the organization and even represents the organization in the conduct of the investigation before the law enforcement authorities;
IV. MAIN LEARNING OUTCOMES
Graduates in Communication Networks and Cyber Crime Investigation have the necessary knowledge, skills and competencies for successful professional implementation in the field of designing secure networks and secure network services, monitoring and auditing network security, detecting and tracking attacks in cyberspace, expert and consulting services, etc. They have a solid theoretical basis that allows them to continue their scientific and educational development in PhD programs.
V. STANDARD CONDITIONS AND REQUIREMENTS FOR ADMISSION AND PROCEDURE FOR RECOGNITION OF PREVIOUS TRAINING.
In the course of training (after successfully passing exams), students of the speciality can transfer to another higher school or be admitted by one in the country and abroad as the courses in which they have been trained are equated as compulsory (or similar), according to the curriculum Plan.
The conditions and requirements for admission and procedure for recognition of previous training are regulated based on National regulations and European directives, internal regulations of VUTP, Rules for the structure and operation of VUTP, Ordinance on educational activities in VUTP.
VI. GRADUATION REQUIREMENTS
The whole course of study ends with a complex state exam in the speciality. Students who complete the full course of study in the speciality “Communication Networks and Cybercrime Investigation” receive a Master’s degree in the professional field 5.3. “Communication and Computer Equipment” and a professional qualification “Engineer in Communication Networks and Cybercrime Investigation” in compliance with the National Classification of Higher Education and Professional Areas, and the State Requirements for Higher Education in the Republic of Bulgaria.
STUDENT IMPLEMENTATION OPPORTUNITIES
After passing successfully the program and the exams, the graduate will have enough knowledge and skills that allow them to serve as a Cyber Forensics Professional in police and force structures, as well as in SOC at the relevant position, both in governmental and private institutions.