CTCH 635 at the University of Maryland Global Campus is a graduate course about targeted cyberattacks, including advanced persistent threats (APTs), and how to stop them.
UMGC describes the aim as learning to plan and prepare for, respond to and recover from targeted attacks. The focus is on the phases of an attack and the methods attackers use in each phase, with prevention, mitigation and response as the core topics.
The course sits after CTCH 605 and CTCH 615, which UMGC lists as prerequisites. Students find it demanding because a strong answer must connect attacker behavior to specific, prioritized defenses, not just list security controls.
Course at a Glance
| Item | Details |
|---|---|
| University | University of Maryland Global Campus (UMGC) |
| Course code | CTCH 635 |
| Level | Graduate, 3 credits |
| Prerequisites | CTCH 605 and CTCH 615 |
| Credit overlap | Credit for only one of CST 620 or CTCH 635 |
| Typical work | Scenario analyses, prevention and response plans, written reports for leadership |
What CTCH 635 Covers
| Topic | In plain language |
|---|---|
| Targeted attacks and APTs | Well-resourced attackers who pick a specific victim and stay hidden for long periods |
| Phases of an attack | The steps from reconnaissance to the attacker achieving their goal |
| Attacker methods per phase | The techniques used at each step, such as phishing for initial access |
| Prevention | Controls that stop or slow an attack before damage occurs |
| Mitigation and response | Limiting harm once an attack is under way, then restoring operations |
| Recovery planning | Preparing in advance so the organization can return to normal quickly |
Key Concepts Explained
Attack Phase Models
Phase models give you a structure for analysis. The Lockheed Martin Cyber Kill Chain lists seven steps: reconnaissance, weaponisation, delivery, exploitation, installation, command and control, and actions on objectives. MITRE ATT&CK goes further, cataloguing real adversary tactics and techniques.
The point of a phase model is that every phase is a chance to break the chain. Defenders do not need to win everywhere, only somewhere early enough.
Example: A phishing email delivers a malicious attachment. Email filtering can stop delivery; application allow-listing can stop installation; egress filtering can block command and control. A good CTCH 635 answer names a control for several phases, explains why, and notes which one is most cost-effective for that organization.
Defense in Depth
No single control stops an APT. Layered defenses (people, process and technology) mean an attacker who passes one layer meets another. Your plans should show the layers and how they overlap.
Prepare, Respond, Recover
Prevention is only part of the course aim. Expect to show how detection and response work once prevention fails, and how backups, playbooks and communication plans support recovery.
Typical Assignments and How to Approach Them
| Assignment type | What it tests | How to approach it |
|---|---|---|
| Attack scenario analysis | Mapping attacker actions to phases | Build a timeline, then label each event with its phase and technique |
| Prevention strategy | Choosing and justifying controls | Tie each control to a phase and a specific risk |
| Response and recovery plan | Readiness when prevention fails | Define roles, triggers, containment steps and restore order |
| Report to leadership | Clear, non-technical communication | Lead with risk and cost, keep detail in appendices |
Prioritizing Controls Within a Budget
Graduate assignments rarely give you unlimited money. A recommendation is stronger when it shows you weighed risk reduction against cost and disruption.
A simple approach is to score each candidate control on three points: which attack phases it disrupts, how much it reduces the most likely risk in the scenario, and what it costs to run.
Controls that break the chain early and cheaply, such as phishing-resistant multi-factor authentication or prompt patching of internet-facing systems, usually rise to the top.
Example: A mid-sized law firm can afford two new measures this year. Multi-factor authentication blocks credential reuse at initial access and lateral movement. Centralized logging does not prevent anything but makes detection and recovery far faster. Recommending both, with a short note on why a full security operations center is out of scope, shows mature judgment.
Close the section with residual risk: what remains after your plan, and how the organization will watch it.
Where Students Get Stuck
- Generic control lists. "Use a firewall and antivirus" earns little. Name the attack step each control disrupts.
- Ignoring the organization. A hospital and a bank face different attackers. Use the scenario's details.
- Stopping at prevention. Plans that assume prevention always works miss half the course aim.
- Outdated sources. Threat details change fast. Cite current guidance such as NIST, CISA and MITRE ATT&CK.
Study Tips for CTCH 635
- Keep one table of attack phases with example techniques and controls; reuse it across assignments.
- Read real APT case write-ups from government advisories to see how phases appear in practice.
- Write every plan for a named audience: the security team, or executives.
- Check that each recommendation answers "which phase, which risk, what cost".
How We Help with CTCH 635
Send the assignment prompt, the scenario, the rubric and any earlier feedback. A writer with a cybersecurity background can tutor you through attack phase mapping, prepare a custom analysis or plan for reference, or review your own draft for gaps in logic and structure.
GradeEssays is independent of the University of Maryland Global Campus. Our work is a study aid: use it to understand the reasoning, then write and submit your own work under UMGC's academic integrity policy. Every order is written from scratch, includes free revisions within the scope of your original request, and is refunded in full if it is late.
Get Your CTCH 635 Analysis on Track
Share the case, the instructions and any feedback. A cybersecurity writer prepares a custom analysis you can study and compare with your own.
Start My CTCH 635 HelpFree revisions · Full refund if late · Written from scratch for your order
Frequently Asked Questions
UMGC lists CTCH 605 and CTCH 615 as prerequisites, so you should already know core security concepts and threat analysis.
UMGC states that students may receive credit for only one of CST 620 or CTCH 635.
An attacker, often well funded, who targets a specific organization and stays hidden inside its network for a long time to steal data or cause harm.
The Cyber Kill Chain and MITRE ATT&CK are both widely used. Follow your assignment instructions if one is specified.
No. UMGC's description covers preparing for, responding to and recovering from targeted attacks, so response and recovery matter too.
No. We provide tutoring, custom answers for reference and editing feedback, so you can write and submit your own work.