Cyber Risk: Data Management
Duration
- One Semester or equivalent
Contact hours
- 150 contact hours - Swinburne Online
On-campus unit delivery combines face-to-face and digital learning. For Online unit delivery, learning is conducted exclusively online.
2023 teaching periods
| Swinburne Online Teaching Period 1 |
Swinburne Online Teaching Period 3 | |
|---|---|---|
Dates: Results: Last self enrolment: Census: Last withdraw without fail: |
Dates: Results: Last self enrolment: Census: Last withdraw without fail: |
Prerequisites
50 Credit PointsAims and objectives
This unit provides insights into critical Information System (IS)/Information Technology (IT) & Information Security risk, as well as the corresponding security management issues facing business managers in the effective use of Information Technology in contemporary organisations. Students will develop a critical understanding of cyber risk issues that managers face when doing business, including consideration of impacts of new and emerging threats.
Students will develop a robust understanding of the skills required to adopt and implement, an effective Risk Management Strategy in line with the industry best practice taking into account the nexus between data governance, enterprise data management and cyber security.
Students will develop a robust understanding of the skills required to adopt and implement, an effective Risk Management Strategy in line with the industry best practice taking into account the nexus between data governance, enterprise data management and cyber security.
Unit Learning Outcomes (ULO)
Students who successfully complete this unit will be able to:
Students who successfully complete this unit will be able to:
1. Develop a risk management strategy for an organisation that is sufficiently agile to adapt to changing cyber threats.
2. Assess and apply information systems risk and security management standards and frameworks to real-word case based scenarios
3. Critically analyse major theories, concepts and methodologies for managing risks and assuring the integrity and security of information assets
4. Evaluate appropriate governance, assurance and internal control techniques for managing information risks and security
5. Communicate effectively as a professional and function as an effective leader or member of a diverse team
2. Assess and apply information systems risk and security management standards and frameworks to real-word case based scenarios
3. Critically analyse major theories, concepts and methodologies for managing risks and assuring the integrity and security of information assets
4. Evaluate appropriate governance, assurance and internal control techniques for managing information risks and security
5. Communicate effectively as a professional and function as an effective leader or member of a diverse team
Unit information in detail
- Teaching methods, assessment and content.
Teaching methods
Swinburne Online
Type | Hours per week | Number of Weeks | Total |
| Online Directed Online Learning and Independent Learning | 12.5 | 12 | 150 |
TOTAL | 150 hours |
Assessment
Types | Individual/Group Role | Weighting | Unit Learning Outcomes (ULOs) |
| Online Discussion | Individual | 10-20% | 1,2,3,4 |
| Assignment | Individual | 30-40% | 1,2,3,4 |
| Project | Group | 30-50% | 1,2,3,4,5 |
Content
• Introduction to basic principles and concepts of the risk management, pivoting quickly to risk within the context of cybersecurity
• Assessing the impact of a cyber-attack on an organisation
• Risk assessment and modelling, and minimising attack surfaces and managing threat vectors
• Importance of useable security; ensuring that security controls and processes are sufficiently agile to adapt to changing threats and are appropriate to, and do not overwhelm business priorities and performance
• Introduction and application of established frameworks for assessing and managing risks: eg Australian Signals Directorate’s (ASD) Australian Government Information Security Manual (ISM), the US National Institute of Standards and Technology’s Cybersecurity Framework and the UK government’s Cyber Essentials
• Understanding and planning for risk associated with human factors in particular insider threat
• Social engineering
• Data and operational risk
• Integrating enterprise risk and cyber risk
• Inherent, current and residual risk
• Asset classification – the identification of Security Controls need to protect assets including data
• Reporting and communicating risk, risk mitigation strategies to stakeholders.
• Risk sharing
• Research methods
• Assessing the impact of a cyber-attack on an organisation
• Risk assessment and modelling, and minimising attack surfaces and managing threat vectors
• Importance of useable security; ensuring that security controls and processes are sufficiently agile to adapt to changing threats and are appropriate to, and do not overwhelm business priorities and performance
• Introduction and application of established frameworks for assessing and managing risks: eg Australian Signals Directorate’s (ASD) Australian Government Information Security Manual (ISM), the US National Institute of Standards and Technology’s Cybersecurity Framework and the UK government’s Cyber Essentials
• Understanding and planning for risk associated with human factors in particular insider threat
• Social engineering
• Data and operational risk
• Integrating enterprise risk and cyber risk
• Inherent, current and residual risk
• Asset classification – the identification of Security Controls need to protect assets including data
• Reporting and communicating risk, risk mitigation strategies to stakeholders.
• Risk sharing
• Research methods
Study resources
- Reading materials.
Reading materials
A list of reading materials and/or required texts will be made available in the Unit Outline.