This course will provide students with an introduction to the principle of risk management and its three key elements: risk analysis, risk assessment and vulnerability assessment. Students will also learn the differences between quantitative and qualitative risk assessment, and details of how security metrics can be modeled/monitored/controlled and how various types of qualitative risk assessment can be applied to the overall assessment process. Several industry case studies will be studied and discussed. Students will work together in teams to conduct risk assessments based on selected case studies or hypothetical scenarios. Finally, they will write and present their risk assessment reports and findings.

This course explores Information Security Policy development and deployment as well as laws (US and International) that impact information security. Students in this class will develop policies and analyze how policy impacts an organization. Students will also determine how federal, state, and international laws impact the information security policies of an organization.