Course content
Over the last years we have become used to learning in the news about a major company being hacked at least once a week. Even the largest companies struggle to keep up with the everchanging threat from cyber criminals and state hackers. In smaller companies and organizations board members and executives often feel overwhelmed by the complexity of the cyber threat and the emerging regulatory landscape. This is why business leaders consistently rank cyber security as one of their biggest worries in risk surveys yet only a minority of companies is confident they have appropriate strategies in place to deal with the escalating threat from ransomware and other cyber attacks. However, given the huge impact a cyber attack can have on business performance and continuity the status quo is increasingly seen as unacceptable.
This course will cut through the complexity of cybersecurity and look at how companies can achieve the right balance of security, cost and usability of their IT systems. We will establish what questions business leaders in large or medium-sized companies should ask their IT department, and how effective cyber security can be achieved in a small company or organization. Students will learn about the interplay of technical, commercial, organizational and legal considerations that have to be balanced to develop an appropriate company strategy to deal with cyber risk. This involves setting up an organization in a way that minimizes the risk of experiencing a cyber attack and ensures it is prepared to mitigate the damage and recover quickly if systems are breached. In addition, the course will cover new EU cybersecurity regulation that will require many companies to step up their efforts considerably – just as GDPR did for data protection. We will investigate what changes are coming, how they might be implemented and how the supply chain relationships between large and small companies will develop.
Students who complete this course will be able to assess the cyber security needs of any company and develop appropriate risk management strategies and policy guidelines. These skills are in high demand among employers who struggle to find candidates who have any understanding of cyber risk.
The course will use pre-recorded video lectures to introduce the subject matter and we will explore the topics in more depth in classroom discussions. The seminars will rely on active learning methods such as simulations and role-play to facilitate a good discussion, culminating in an incident response cyber war game. In addition, guest lecturers will provide insights on how leading Danish and international companies deal with the cyber risk to their IT systems and supply chains.
Students from all eligible programmes at CBS can sign up for this elective, and there are no formal prerequisites for this course.
Course structure:
- Cyber threat assessment: what is going on out there, and how dangerous is it?
Methods used by state hackers and cyber criminals
Risks faced by business or organisations
The scale of the damage suffered by companies each year
- Cyber defence
What measures can companies take to defend their networks against Cyberthreats?
What are NIST security controls, and which ones should companies implement?
- Understanding and managing company cyber risk
What does good company cyber risk management look like?
What stakeholders are involved?
How should boards handle cyber risk?
What is the role of the IT department, and what does a CISO do?
4 Preparing and managing Incident response
How do you prepare for a network breach, and how do you practice your response?
What do you do when you have been breached, who do you call, what are your legal duties, who are your stakeholders?
Is it smarter to just pay the ransom and move on?
5. Cybersecurity Culture, Awareness and role-based training
Who does staff awareness training, what is good practice and how do we know it works?
What is cybersecurity culture, and does every company need it?
Is spear-phishing your own employees a good idea or not?
Should an IT department be trusted or feared?
6. Measuring company cyber risk: risk monitoring, standards and insurance
Do companies need cybersecurity insurance, and how does it work?
How can cyber risk be measured and quantified?
Cyber risk supply chain monitoring
The physical side of cyber security
What IT security standards exist, and should my company seek certification?
7. Cyber Security Risk management for SMEs and startups
How is cyber security risk management done in small companies?
What do they need to improve (and remain in supply chains)?
What level of cybersecurity does a startup need at the point of launching?
8. EU cybersecurity regulation
Discussion of NIS 2 Directive and the role of ENISA
What EU or national regulation exists in which sectors, what do companies have to do to comply?
NIS 2 and the expansion of ‘critical infrastructure’ and ‘essential services’
Explaining the scale of the changes this new regulation and its cybersecurity requirements will mean for hundreds of thousands of businesses in the EU
.
9.Implementing NIS 2
What do companies have to do in practice to implement the requirements of the new Directive, and why do they struggle so often?
What does a good implementation plan look like, and how can you make sure that the entire company cooperates in this endeavour?
10. Supply Chain cybersecurity
Why has supply chain cybersecurity become such a hot topic in recent years?
How do criminals and state hackers exploit the supply chain to infiltrate well-protected targets?
How can companies manage these risks, especially if they have hundreds of suppliers?
11.. Cyber War Game
Tabletop exercise simulating a cyber attack and the response to it
See course description in course catalogue