Traditional forms of cyber security education mainly focus on knowledge transmission, which means that knowledge is perceived as a tangible object being transferred from an expert (i.e., the teacher) to a beginner. When practiced well, the learner may acquire such knowledge, but not the resilience to apply it in various contexts [1], [2]. This is especially troubling for the cyber security domain, given the dynamic and constantly changing nature of the field and the environments in which it is required. We therefore need forms of education that aim at understanding the interdisciplinary nature of the field of cyber security as well as at the development of joint action in context: being able to quickly analyse and understand evolving and possibly previously unseen situations and take collaborative action to prevent, detect and recover from incidents.

Digital forensics are becoming increasingly important for the investigation of computer-related crimes, white-collar crimes and massive hacker attacks. After an incident has been detected an appropriate incident response is usually initiated with the aim to mitigate the attack and ensure the recovery of the IT systems. Digital Forensics pursues the goal of acquiring evidence that will stand up in court for sentencing and sometimes opposes contradicting objectives of incident response approaches. The concept presented here provides a solution to strengthen the credibility of digital evidence during actions related to incident response. It adapts an approach for data provenance to accurately track the transformation of digital evidence. For this purpose, the affected system and the incident response systems are equipped with a whole system data provenance capturing mechanism and then data provenance is captured simultaneously during an incident response. Context information about the incident response is also documented. An adapted algorithm for sub-graph detection is used to identify similarities between two provenance graphs. By applying the proposed concept to a use case, the advantages are demonstrated and possibilities for further development are presented.

The goal of the project described in this paper is to describe a GDPR compliance checking model and tool for supporting the information exchange between CERTs. The paper first motivates the project, and then briefly discusses major aspects of GDPR, before presenting the developed model and the implemented prototype. A discussion and an outlook conclude the paper.