Information Risk Management

The student will demonstrate an understanding of:

• The practice of risk management and describe how risk management practices are applied to information systems
• Familiarity with common risk management frameworks and how they may be applied to information systems risk management
• Common IT system components, their uses, and how they fit in the risk context process
• Key assets usually found in an IT system and the procedures used to inventory those assets, identify risks and common hazards
• Demonstrate the ability to apply risk and hazard frameworks to common cyber threats, as well as demonstrate mastery of the basic principles of information assurance
• Will describe methods that can be used to identify the symptoms of risk; how project variables impact risk; of how to assign value, criticality, and impact to key IT assets; risk quantification, the quantitative and qualitative methods of risk quantification, hazard likelihood, asset vulnerability, risk impact, risk prioritization, and risk tolerance
• ISO/IEC code of practice; demonstrate understanding of risk control mechanisms including methods for risk limitation, risk detection, risk recovery, and risk plan monitoring
• How to use these risk control strategies and other cyber security controls within an organization; organizational security policies as well as compliance with industrial standards such as FISMA, COBIT, and PCI; and to communicate the basics of business continuity.