Maturing Risk Management from Coursera

What's inside

Syllabus

Module 1: Participate in Change Management

An important function of the IT department is to maintain information systems and upgrade, enhance and revise those systems as necessary. Information systems are subject to many changes and modifications due to system patches, new technology or functionality, correction of process errors or system failures. The IT department must be able to manage change in order to support business operations and ensure the security of the systems.  The problem is that change poses a significant risk to the organization. Because of changes, systems may fail, functionality may be lost, security vulnerabilities may be introduced and data integrity may be compromised. This requires the development and implementation of a change management process that entails the documentation, testing and approval of all changes — and that thereby avoids business interruption. 

Module 2: Physical Security Considerations

Physical and environmental security are often the responsibilities of departments other than IT, such as the physical security department or the facilities management group. These departments play an important role in providing resilient and reliable information to other areas of the organization, including IT. The security professional may be required to work with these other departments to ensure that information systems are supported with electrical power, fire protection, physical access security, surveillance and protection from threats such as theft, vandalism and natural disasters.  It can even be said that physical security should be a higher priority than most other forms of security such as passwords, firewalls and procedures. If an adversary can gain physical access to a server room, then the adversary can bypass all of the other forms of control and circumvent the security defenses. An adversary in a server room or wiring closet can install a wireless device or sniffer, cut or re-route cables or disable equipment, among other things. 

Module 3: Collaborate in Security Awareness and Training

Experience shows that it’s relatively easy to establish and maintain a security education, awareness and training program for almost any organization. The difficulty with such a program is measurably demonstrating the program’s effectiveness.  Two major conflicts present themselves when the security team tries to engage with the end users at large. The first is rooted in the perception that security measures cost the end user time and effort to comply with. Work could get done so much more quickly and easily, this view argues, if all these extra security hurdles didn’t have to be jumped over all the time. The second reflects the users’ perception that most security training is an even further waste of their time. Both perceptions act to oppose the effective adoption of security controls by end users and discourage them from taking responsibility for their own learning and thus gaining the most value possible from the training that’s presented to them.  As with access control and identity management, it may be that it’s more than high time for a healthy dose of just-in-time learning for security. Security training consultants and specialist firms have made significant changes in their approaches to helping users learn what they need and when they need it. Microtraining, for example, breaks the training experience down into steps that might last less than one minute. In that minute, the microtraining engages the learner-user, has them take actions related to how they perform their normal jobs but is structured as part of the teaching and learning process.  Measuring the effectiveness of a training program has also been suffering from lack of innovation and maturation as well. This can change. User behavior modeling and analysis tools can gather data that highlights when individual users or groups of users are in need of specific refresher learning opportunities.  Let’s see how ideas like these can be put into practice and how we can assess their effectiveness. 

Module 4: Perform Security Assessment Activities

Security assessment determines whether the controls implemented to reduce risk have been implemented as designed, are operating as expected and are achieving the desired result.  This assurance can be the result of outside organizations evaluating the control environment or actions taken by the organization itself to evaluate the performance of the controls.  Security assessment is performed by conducting inspections, audits and tests.  Additionally, the results of investigations into anomalies and security incidents can also provide valuable insights into a security assessment process.  The assessment and testing processes must be performed consistently and the results communicated properly so that the organization’s management understands the risks they face.  Security or controls audits are formal assessments that are normally performed to assure external evaluators that an organization’s controls meet compliance expectations.  Ultimately, the results of audit, assessment and testing activities will allow the organization to identify control gaps and inefficiencies.  This information will be the starting point for continual process improvement activities.  The security professional should be familiar with the strategies, techniques and processes by which organizational expectations for control are set, evaluated and improved.  They should be able to explain the basic flow of audit and assessment activities and describe the tools and artifacts that support data-driven decision-making.  Collectively, this information should enable the security professional to develop an organizationally appropriate assessment program.  It is tempting to think that much of the burden of security assessment and testing takes place during the development phase of the lifecycle of a major software system. Two factors, however, show us that this would be an unwise and unsafe assumption for security professionals or systems owners to make.   The first is that many systems are turned over to operational users with inadequate functional testing having been completed. Experience shows that many systems development projects fall behind schedule, and since it’s the last tasks on the timeline that feel the pressure to cut corners, testing often is rushed, abbreviated or skipped.   The second is that many commercial systems are developed with a less robust view of the need for security, safety, resilience and data protection than are required to defend against today’s sophisticated threats.  Both factors mean that many organizations today are failing security assessments, audits and compliance reviews or are failing to win new business opportunities, as a result of building their business processes atop an insecure software and systems base.  It also means that security professionals are often confronted with deployed, in-use systems in need of a thorough security assessment, including testing, to meet evolving business needs and the changing threat landscape. This starts (as does this module) by first understanding the objectives of a security assessment, which lead to developing the strategy that will guide its accomplishment. This provides the framework for vulnerability assessments and the testing techniques used to perform it. This includes a deeper dive into wireless network security testing.  Ethical penetration testing can and should be a regular component in nearly every organization’s security assessment and operations plan. We’ll take a closer look at what makes this unique and valuable, and how the ethical penetration testers work with the organization’s leadership and its technical and security teams to preserve the integrity of the testing at minimal disruption to the daily business of the organization. Audits, both formal and informal, provide a structured way to review all of the control systems the organization has in place. Many of these are known as internal controls over financial reporting (ICOFR or ICFR); in this era of ransom attacks as big business, security professionals need to be far more conversant with how the flow of information about the flow of money must be protected. 

Module 5: Understand and Support the Business Continuity Plan (BCP) and Disaster Recovery Plan (DRP)

The incident triage process (described in module 1) may identify that a particular event or set of events needs more than just the incident response process to handle itself. Two specific types of plans are typically used to define these responses, prepare the organization and guide their teams in dealing with such events.  It’s an easy mistake to make to think that disaster recovery plans (DRPs) are broad and all-encompassing to deal with recovering from earthquakes, hurricanes, fires or major cyberattacks; in reality, the scope of DRPs is much narrower.  DRPs and their activities deal with the restoration of information and communications systems and technologies that support urgent business or organizational needs.  (It would not be surprising that organizations which rely on IoT, SCADA or process control systems will start reshaping their classic DRPs to also address their OT critical systems and capabilities.)    It is the business continuity plan (BCP) that takes into account the much broader scope of activities required to keep an organization alive and operating, as it recovers from both the immediate effects of a disruptive incident and restoring non-critical services and activities so it can move forward. Let’s see how the security professional would support these plans, during both their development and operational activation and use. 

Module 6: Chapter 8 Review

Chapter 8 brought together many different aspects of information systems security, binding them together with several important ideas. First, systems must be managed, if they are to be protected and kept secure. One form of management is configuration management, in which we ensure that changes are only made when authorized; when effective, CM systems can become part of the arsenal of intrusion detection capabilities.  Physical security measures were placed in the context of protecting and sustaining the organization, its systems and its people. In many organizations, these physical security control systems are data-driven and thus tightly integrated with overall IAAA and incident detection capabilities. SUNBURST and other recent attacks on SCADA, ICS and other operational technology (OT) systems highlighted the need for many organizations and security professionals to expand their horizons to include things beyond the edge of the TCP/IP networks, databases and web page views of the organization and the threat landscape.  We also saw that effective systems management requires measurement, observation, test and analysis in order to know what today’s security posture really is, and to inform considerations of where, when and how to improve that posture. Inspections, assessments, audits and ethical penetration testing were all viewed in this context.  Two other major topic areas — business continuity and security education, training and awareness — actually come together in surprising ways. Many of us who’ve served in our nation’s militaries, police or emergency first responder corps know that humans in highly disruptive situations often must fall back on their training, if they are to remain calm, not panic and thoughtfully deal with the situation one step at a time. Microtraining is an excellent example of this. By popping up a mock phishing or malware-based attack activity when an end user least expects it, microtraining presents users with the chance to either fall back unthinkingly to habit, or stop, observe, orient themselves to a potential security issue and then make decisions. Awareness, training and education efforts can provide employees with the skills and the frame of mind they need to deal with disruptions, no matter what scale and no matter whether they are simulated or real. As with other aspects of information systems security, continuity of operations and disaster recovery require extensive preparation, and one of the most important tasks in that is preparing one’s people to adapt and overcome as a team. 

Good to know

Know what's good

, what to watch for

, and possible dealbreakers

Teaches concepts, skills, and background information for certification

Taught by experts with deep experience in the field

Develops skills and knowledge for use in a variety of job roles

Builds a strong foundation for further learning in the field

Includes a variety of learning materials and activities

May require some prior knowledge or experience in the field

Activities

Be better prepared before your course. Deepen your understanding during and after it. Supplement your coursework and achieve mastery of the topics covered in Maturing Risk Management with these activities:

Review change management concepts

Show steps

Refresh your understanding of change management principles and processes to enhance your comprehension of module 1.

Browse courses on Change Management

Show steps

Revisit materials from previous courses or certifications related to change management.
Review industry articles and case studies on effective change management practices.
Attend webinars or online seminars on change management methodologies.

Participate in a discussion forum on change management

Show steps

Exchange knowledge and insights with peers to deepen your understanding of change management practices.

Browse courses on Change Management

Show steps

Join online forums or discussion groups dedicated to change management.
Engage in discussions, ask questions, and share experiences related to change management.

Conduct a physical security assessment

Show steps

Engage in a hands-on activity that reinforces the concepts of physical security design and implementation.

Browse courses on Physical Security

Show steps

Identify and document potential threats and vulnerabilities to a physical facility.
Assess existing security measures and evaluate their effectiveness.
Recommend improvements to enhance physical security and mitigate risks.

Five other activities

Expand to see all activities and additional details

Show all eight activities

Explore microtraining resources

Show steps

Familiarize yourself with microtraining techniques to enhance your understanding of security awareness and training.

Browse courses on Security Awareness Training

Show steps

Identify online platforms or vendors that provide microtraining content.
Enroll in or explore free microtraining modules related to security awareness.
Evaluate the effectiveness and applicability of microtraining to your organization.

Attend a workshop on physical security best practices

Show steps

Gain hands-on experience and practical guidance on implementing physical security measures.

Browse courses on Physical Security

Show steps

Identify and register for workshops or seminars related to physical security.
Attend the workshop and actively participate in discussions and exercises.
Apply the knowledge and skills gained to enhance your organization's physical security posture.

Design a security assessment plan

Show steps

Apply your knowledge of security assessment techniques to create a comprehensive plan that aligns with organizational needs.

Browse courses on Security Assessment

Show steps

Define the scope and objectives of the security assessment.
Identify the assets and systems to be assessed.
Select and apply appropriate assessment techniques.
Develop a reporting framework to communicate assessment findings.

Contribute to an open-source security awareness project

Show steps

Apply your understanding of security awareness principles by contributing to community-driven projects.

Browse courses on Security Awareness

Show steps

Identify open-source projects focused on security awareness and education.
Review the project's documentation and identify areas where you can contribute.
Submit code changes, documentation updates, or other contributions that enhance the project.

Develop a business continuity plan (BCP)

Show steps

Demonstrate your understanding of business continuity principles by creating a comprehensive BCP.

Browse courses on Business Continuity Planning

Show steps

Identify critical business functions and their dependencies.
Develop a strategy to maintain essential operations during a disruption.
Establish communication channels and protocols for incident response.
Test and exercise the BCP to ensure its effectiveness.

Career center

Learners who complete Maturing Risk Management will develop knowledge and skills that may be useful to these careers:

Information Security Analyst

An Information Security Analyst uses their technical knowledge to help identify, prevent, and resolve security vulnerabilities across the organization. This course helps those in this role by providing them with an overview of several aspects of information systems security. It also gives strategies, techniques, and processes for organizational expectations for control set, evaluated, and improved. This makes the course very valuable to anyone who works in this role.

See salaries and explore the career path for Information Security Analyst

Security Architect

Security Architects design, implement, and maintain an organization's IT security infrastructure. This involves working with a variety of security technologies, including firewalls, intrusion detection systems, and encryption. This course is a valuable resource for Security Architects as it provides them with an overview of several aspects of information systems security. It also walks through security assessment activities commonly performed by security professionals.

See salaries and explore the career path for Security Architect

IT Auditor

IT Auditors examine an organization's IT systems and processes to ensure that they are secure and compliant with regulations. They may also provide advice on how to improve IT security. The course covers a variety of topics that are relevant to IT Auditors, including change management and physical security considerations.

See salaries and explore the career path for IT Auditor

Security Consultant

Security Consultants provide advice and guidance to organizations on how to improve their IT security. They may also help organizations to implement and manage security solutions. This course can be helpful for Security Consultants as it provides them with an overview of several aspects of information systems security. It also provides strategies, techniques, and processes for organizational expectations for control set, evaluated, and improved. This makes the course very valuable to anyone who works in this role.

See salaries and explore the career path for Security Consultant

Cybersecurity Engineer

Cybersecurity Engineers design, implement, and maintain IT security systems. They may also work to identify and resolve security vulnerabilities. The course covers several topics relevant to this role, including change management, physical security considerations, and security assessment activities.

See salaries and explore the career path for Cybersecurity Engineer

Security Operations Analyst

Security Operations Analysts monitor an organization's IT systems for security threats. They may also respond to security incidents and investigate security breaches. This course can be helpful for Security Operations Analysts as it provides them with an overview of several aspects of information systems security. It also provides strategies, techniques, and processes for organizational expectations for control set, evaluated, and improved.

See salaries and explore the career path for Security Operations Analyst

IT Security Manager

IT Security Managers are responsible for overseeing an organization's IT security program. They may also work to develop and implement security policies and procedures. This course provides a comprehensive overview of the information systems security field and provides strategies, techniques, and processes for organizational expectations for control set, evaluated, and improved. This course may also be useful for professionals seeking career advancement in this role.

See salaries and explore the career path for IT Security Manager

Risk Manager

Risk Managers identify, assess, and mitigate risks to an organization. They may also develop and implement risk management plans. This course provides an overview of several aspects of information systems security and may be useful for those seeking a career in this field.

See salaries and explore the career path for Risk Manager

Incident Responder

Incident Responders investigate and resolve security incidents. They may also work to develop and implement incident response plans. This course provides an overview of several aspects of information systems security and may be useful for those seeking a career in this field.

See salaries and explore the career path for Incident Responder

Security Analyst

Security Analysts monitor an organization's IT systems for security threats. They may also investigate security incidents and provide advice on how to improve IT security. This course provides an overview of several aspects of information systems security and may be useful for those seeking a career in this field.

See salaries and explore the career path for Security Analyst

Penetration Tester

Penetration Testers identify and exploit vulnerabilities in an organization's IT systems. They may also provide advice on how to improve IT security. This course provides an overview of several aspects of information systems security and may be useful for those seeking a career in this field.

See salaries and explore the career path for Penetration Tester

Compliance Analyst

Compliance Analysts ensure that an organization's IT systems are compliant with regulations. They may also develop and implement compliance programs. This course provides an overview of several aspects of information systems security and may be useful for those seeking a career in this field.

See salaries and explore the career path for Compliance Analyst

Forensic Analyst

Forensic Analysts investigate computer crimes and cyberattacks. They may also provide evidence for legal proceedings. This course provides an overview of several aspects of information systems security and may be useful for those seeking a career in this field.

See salaries and explore the career path for Forensic Analyst

Chief Information Security Officer (CISO)

The Chief Information Security Officer (CISO) is responsible for overseeing an organization's IT security program. They may also develop and implement security policies and procedures. This course provides a comprehensive overview of the information systems security field and provides strategies, techniques, and processes for organizational expectations for control set, evaluated, and improved. This course may also be useful for professionals seeking career advancement in this role.

See salaries and explore the career path for Chief Information Security Officer (CISO)

IT Project Manager

IT Project Managers plan and execute IT projects. They may also work to ensure that IT projects are completed on time, within budget, and to the required quality standards. This course provides an overview of several aspects of information systems security and may be useful for those seeking a career in this field.

See salaries and explore the career path for IT Project Manager