• Reflect on the evolution of the cyber threat landscape and the ways in which this endangers the prosperity or survival of businesses
• Analyse the specific cyber risks faced by any company and explain the steps businesses need to take to prepare for and manage this risk
• Evaluate the trade-offs and strategic decisions that must be made when establishing a businesses’ cyber security posture and risk appetite
• Account for the regulatory, political and technological developments that set the framework for business cyber security
• Understand the role of cybersecurity in supply chains and why it is changing
• Understand the roles and functions that the board and the managers of individual business units such as IT, compliance and operations have to fulfil to create and maintain a high level of company cybersecurity
• Understand the concept of cybersecurity culture and why it depend both on the board as a role model and employee awareness

Over the last years we have become used to learning in the news about a major company being hacked at least once a week. Even the largest companies struggle to keep up with the everchanging threat from cyber criminals and state hackers. In smaller companies and organizations board members and executives often feel overwhelmed by the complexity of the cyber threat and the emerging regulatory landscape. This is why business leaders consistently rank cyber security as one of their biggest worries in risk surveys yet only a minority of companies is confident they have appropriate strategies in place to deal with the escalating threat from ransomware and other cyber attacks. However, given the huge impact a cyber attack can have on business performance and continuity the status quo is increasingly seen as unacceptable.

This course will cut through the complexity of cybersecurity and look at how companies can achieve the right balance of security, cost and usability of their IT systems. We will establish what questions business leaders in large or medium-sized companies should ask their IT department, and how effective cyber security can be achieved in a small company or organization. Students will learn about the interplay of technical, commercial, organizational and legal considerations that have to be balanced to develop an appropriate company strategy to deal with cyber risk. This involves setting up an organization in a way that minimizes the risk of experiencing a cyber attack and ensures it is prepared to mitigate the damage and recover quickly if systems are breached. In addition, the course will cover new EU cybersecurity regulation that will require many companies to step up their efforts considerably – just as GDPR did for data protection. We will investigate what changes are coming, how they might be implemented and how the supply chain relationships between large and small companies will develop.

Students who complete this course will be able to assess the cyber security needs of any company and develop appropriate risk management strategies and policy guidelines. These skills are in high demand among employers who struggle to find candidates who have any understanding of cyber risk.

The course will use pre-recorded video lectures to introduce the subject matter and we will explore the topics in more depth in classroom discussions. The seminars will rely on active learning methods such as simulations and role-play to facilitate a good discussion, culminating in an incident response cyber war game. In addition, guest lecturers will provide insights on how leading Danish and international companies deal with the cyber risk to their IT systems and supply chains.

Students from all eligible programmes at CBS can sign up for this elective, and there are no formal prerequisites for this course.

Course structure:

1. Cyber threat assessment: what is going on out there, and how dangerous is it?
   Methods used by state hackers and cyber criminals
   Risks faced by business or organisations
   The scale of the damage suffered by companies each year
    
2. Cyber defence
   What measures can companies take to defend their networks against Cyberthreats?
   What are NIST security controls, and which ones should companies implement?
    
3. Understanding and managing company cyber risk
   What does good company cyber risk management look like?
   What stakeholders are involved?
   How should boards handle cyber risk?
   What is the role of the IT department, and what does a CISO do?

4 Preparing and managing Incident response

How do you prepare for a network breach, and how do you practice your response?

What do you do when you have been breached, who do you call, what are your legal duties, who are your stakeholders?

Is it smarter to just pay the ransom and move on?

5. Cybersecurity Culture, Awareness and role-based training

Who does staff awareness training, what is good practice and how do we know it works?

What is cybersecurity culture, and does every company need it?

Is spear-phishing your own employees a good idea or not?

Should an IT department be trusted or feared?

6. Measuring company cyber risk: risk monitoring, standards and insurance

Do companies need cybersecurity insurance, and how does it work?

How can cyber risk be measured and quantified?

Cyber risk supply chain monitoring

The physical side of cyber security

What IT security standards exist, and should my company seek certification?

7. Cyber Security Risk management for SMEs and startups

How is cyber security risk management done in small companies?

What do they need to improve (and remain in supply chains)?

What level of cybersecurity does a startup need at the point of launching?

8. EU cybersecurity regulation
Discussion of NIS 2 Directive and the role of ENISA

What EU or national regulation exists in which sectors, what do companies have to do to comply?

NIS 2 and the expansion of ‘critical infrastructure’ and ‘essential services’

Explaining the scale of the changes this new regulation and its cybersecurity requirements will mean for hundreds of thousands of businesses in the EU

.

9.Implementing NIS 2

What do companies have to do in practice to implement the requirements of the new Directive, and why do they struggle so often?

What does a good implementation plan look like, and how can you make sure that the entire company cooperates in this endeavour?

10. Supply Chain cybersecurity

Why has supply chain cybersecurity become such a hot topic in recent years?

How do criminals and state hackers exploit the supply chain to infiltrate well-protected targets?

How can companies manage these risks, especially if they have hundreds of suppliers?

11.. Cyber War Game

Tabletop exercise simulating a cyber attack and the response to it

• New theory
• Teacher’s own research
• Models
• Monitor and discuss research developments in the field

• Analysis
• Discussion, critical reflection, modelling
• Activities that contribute to new or existing research projects

The literature will be shared via Canvas before the semester starts. Due to the fast-changing nature of the field, additions and changes may be made throughout the course – these will always be communicated via Canvas. Students are advised to check the syllabus on Canvas before they buy any material.

Sample literature: