1. HiG
  2. Studiehåndbok
  3. Studiehåndbøker
  4. 2016-2017
  5. Emner 2016-2017
  6. Avdeling for informatikk og medieteknikk
  7. IMT4142 Information Security Economics 1

Information Security Economics 1
2016-2017 - IMT4142 - 5sp

Anbefalt forkunnskap

IMT 4762 Risk Management 1

Forventet læringsutbytte

Knowledge

  • The candidate possesses advanced knowledge about the challenges and current practices in security decision making
  • The candidate possesses thorough knowledge in financial models and security metrics
  • The candidate is capable of applying his/her knowledge in financial models to support security decision making

Skills

  • The candidate is able to analyze financial models and theory and apply these to security decision making situations
  • The candidate is able to carry out an limited and focused security decision making process under supervision
  • The candidate is able to carry out critical analysis of various literature sources on security economics and evaluate the practical implication on security decision making

General competence

  • The candidate is capable of analyzing relevant professional and research results and experiences in security economics, particularly financial models for security decision making
  • The candidate is capable of applying his/her knowledge and skills in financial models to security decision making processes
  • The candidate can work independently and is familiar with the challenges and current practices in security decision making
  • The candidate is capable of discussing professional problems, analyses and conclusions in the field of security decision maiing, both with specialists and with general audience
  • The candidate is capable of contributing to innovation and innovation processes

Emnets temaer

  1. European Unions (EU) view on information security economics
  2. Current industrial practices in information security economics
  3. Decision making in information security risk management
  4. Financial models
  5. Application of financial models as information security decision support

Pedagogiske metoder

Forelesninger
Prosjektarbeid

Pedagogiske metoder (fritekst)

Students are recommended to work in groups with the project. Every group must have no more than 3 members. It is also possible to complete the project individually. To ensure fairness, course deliverable grading will depend on deliverable quantity, quality and the number of contributing students.

The course will be made accessible for both campus and remote students. Every student is free to choose the pedagogic arrangement form that is best fitted for her/his own requirement. The lectures in the course will be given on campus and are open for both categories of students. All the lectures will also be available on Internet through GUC’s learning management system (ClassFronter).

Vurderingsformer

Muntlig, individuelt
Vurdering av prosjekt(er)

Vurderingsformer

  • Project – 49%
  • Oral exam (individual) – 51%
  • Both parts must be passed

Karakterskala

Bokstavkarakterer, A (best) - F (ikke bestått)

Sensorordning

Evaluated by external and internal examiner.

Utsatt eksamen (tidl. kontinuasjon)

For the oral exam: Re-sit examination in August.

Tillatte hjelpemidler (gjelder kun skriftlig eksamen)

None

Obligatoriske arbeidskrav

None

Læremidler

Books, articles and WEB resources such as

ENSIA (2008): Security Economics and the Internal Market, 114 pages. Downloadable from: http://www.enisa.europa.eu/act/sr/reports/econ-sec/economics-sec/at_download/fullReport

Anderson, R. (2001): Why Information Security is Hard - An Economic Perspective. In: ACSAC 2001: Proc. 17th Annual Computer Security Applications Conference, pages. 358–365. IEEE Press, Los Alamitos. Downloadable from: http://www.acsac.org/2001/papers/110.pdf

Cavusoglu, H., Cavusoglu, H. and Raghunathan, S. (2004): Economics of IT Security Management: Four Improvements to Current Security Practices. Communications of the Association for Information Systems 14, pages 65–75.

Anderson, R. J. and Moore, T. W. (2007): Information security economics – and beyond. Advances in Cryptology – Crypto 2007, LNCS 4622, Springer Verlag, Berlin Heidelberg, 68–91. Downloadable from: http://www.cl.cam.ac.uk/∼rja14/Papers/econ crypto.pdf

Selected parts from: Herrmann, D. S. (2007). Complete guide to security and privacy metrics: Measuring regulatory compliance, operational resilience, and ROI. CRC Press.

Su, X. (2006). An overview of economic approaches to information security management. Downloadable from: http://eprints.eemcs.utwente.nl/5693/01/00000177.pdf

Daneva, M. (2006): Applying Real Options Thinking to Information Security in Networked Organizations. Tech. Rep. TR-CTIT-06-11, Centre for Telematics and Information Technology, University of Twente, Enschede. Downloadable from the website of University of Twente, NL.

Benaroch, M. and Kauffman, R.J. (1999): A Case for Using Real Options Pricing Analysis to Evaluate Information Technology Project Investment. Information Systems Research 10(1), pages 70–86.

Berthold, S. and Böhme, R. (2010): Valuating Privacy with Option Pricing Theory. In: Economics of Information Security and Privacy, pp. 187–209. Springer, Heidelberg.

Sonnenreich, W., Albanese, J., and Stout, B. (2006). Return on security investment (ROSI)-A practical quantitative model. Journal of Research and Practice in Information Technology, 38(1), pages 45-56. Downloadable from: http://www.infosecwriters.com/text_resources/pdf/ROSI-Practical_Model.pdf

IANS and RedSeal Networks (2011). The ROS of RedSeal. – Practical example from the industry. Downloadable from: http://go.redsealnetworks.com/Reports_LP-IANS_ROS.html

LockStep and Australian Government Chief Information Office (GCIO) (2004). A Guide for Government Agencies Calculating Return on Security Investment. Downloadable from: http://lockstep.com.au