Unit 1 Introduction, what is risk and risk management, risk assessment, monitoring and review,

• cyber system

Unit 2 What is cyber security, how does cyber security relate to information security, how does cyber

4 lecture hours

• security relate to critical infrastructure protection
• how does cyber security relate to safety
• What is cyber risk
• communication and consultation of cyber risk
• cyber risk assessment
• monitoring and review of cyber risk

Unit 3 Context establishment, context, goals and objectives, target of assessment, interface to cyberspace

2 lecture hours

• and attack surface
• focus and assumption
• scale and risk evaluation criteria

Unit 4 Risk identification techniques, malicious risks, non-malicious risks, risk analysis, threat analysis,

4 lecture hours

• vulnerability analysis
• likelihood of incidents
• consequences of incidents

Unit 5 Risk evaluation, consolidation of risk analysis results, evaluation of risk level, risk aggregation,

3 lecture hours

• risk grouping
• risk treatment identification
• risk acceptance

Unit 6 Two-factor measure, three-factor measure, many-factor measure, which measure to use for

3 lecture hours

• cyber risk?
• classification of scales
• qualitative versus quantitative risk assessment
• scale for likelihood
• scale for consequence
• what scale to use for cyber risk

Unit 9 Automating metric calculations and tools 5

• Subject Code: 3725902 w.e.f

Unit 10 What is an IT security assessment, what is an IT security audit, what is compliance, how does and

2 lecture hours

• audit differs from assessment
• case study: Enron
• TJX Credit Card Breach