Cybersecurity & Business Risk

This course will examine cybersecurity and threats in cyberspace as a business risk: that is, the potential and consequent magnitude of loss or liability arising from conducting business connected to the Internet. Many organizations have traditionally viewed cybersecurity as a technology problem, “owned” by the Information Technology department. However, doing business connected to the Internet can create non-technical problems: legal, regulatory, financial, logistical, brand or reputational, even health or public safety problems. Increasingly, organizations are treating cybersecurity and cyber threats in a broader manner, viewing cyber as a risk to be managed, and owned ultimately by the most senior ranks of corporate governance. An example might be a bank managing cyber operational risk similarly to managing credit and market risk. However, organizations continue to face challenges as they try to translate, measure, manage, and report a risk that is highly technical, and still somewhat foreign to most risk managers. The objective of this course will be to introduce you to basic concepts of cybersecurity and threats in cyberspace, and enable you to apply them to tools, techniques, and processes for business risk management. It assumes no technical knowledge of cybersecurity, nor a deep understanding of risk management. Students will learn about the basic principles of cybersecurity, the main actors in the business and regulatory spheres, and approaches to business risk management: how to understand, describe, measure, and report risk in a cybersecurity context. Students will also understand different models and approaches used by leading institutions in various industries, including the financial services sector, critical infrastructure providers, high-technology companies, and governments.