Information Security Risk Management (5 cr)

Evaluation scale

H-5

Content scheduling

After completing the course the student can:

- explain basic principles of ISO/IEC27005:2008 -standard based information security risk assessment and risk management
- explain the basic principles of information security risk assessment and risk management
- list the phases of information security risk management process
- classify information security risks by applying different approaches
- give examples of different information security risk assessment methods
- organize and conduct information security risk assessment to an SME sector enterprise or similar size organization
- analyze the results of information security risk assessment
- give justified improvement proposals to mitigate information security risks.
- Understands information security risk management as part of continuity planning and preparedness

Objective

After completing the course the student can:
- explain the basic principles of information security risk assessment and risk management
- list the phases of information security risk management process
- classify information security risks by applying different approaches
- give examples of different information security risk assessment methods
- organize and conduct information security risk assessment to an SME sector enterprise or similar size organization
- analyze the results of information security risk assessment
- give justified improvement proposals to mitigate information security risks.

Content

- The basic principles of information security risk assessment and risk management
- Information security risk management standard ISO/IEC 27005:2008
- Information security risk assessment methods and best practices
- Practical work

Materials

Material will be published in Itslearning.

Teaching methods

- Lectures, assignments and practical work

Exam schedules

Course has an exam.

Student workload

Lectures
Assignments and practical work/group work

Evaluation methods and criteria

The grade is based on the group assignment, peer assessment, exam, attendance, as well as group and individual self-assessment. The assessment criteria are presented at the beginning of the course and may differ from those outlined here.

The group assignment carries the highest weight in the evaluation. More than 50% absence from in-person classes will result in failing the course. Absences must be discussed with the instructor separately.

Failed (0)

<50% of assignment and exam points.
More than 50% absence from in-person classes

Assessment criteria, satisfactory (1-2)

>=50% of the homework assignments are completed, and 50% of the points are from the exam. Each part must get a passing grade.

Assessment criteria, good (3-4)

>=70% of the homework assignments are completed, and 70% of the points from the exam. Each part must get a passing grade.

Assessment criteria, excellent (5)

>=90% of assignment and exam points. Each part must get a passing grade.