Risk Management in Information Systems (IAA202)
Vietnamese title: Quản trị rủi ro trong hệ thống thông tin
Credits: 3
Prerequisites: IAO101 or IAO201c or IAO202

Description:
The course provides a comprehensive view of managing risk in information systems.
It covers the fundamentals of risk and risk management and also includes in-depth details on more comprehensive risk management topics.
Areas of instruction include how to assess and manage risk based on defining an acceptable level of risk for information systems. Elements of a business impact analysis (BIA), business continuity plan (BCP), disaster recovery plan (DRP) and computer incident response team (CIRT) plan are also discussed.

Learning outcomes:
Understand the fundamental concepts of risk management and its importance.
Describe the process of planning risk mitigation throughout an organization.
Describe the process of implementing a risk mitigation plan.
Perform a business impact analysis.
Review a business continuity plan (BCP) based on the findings of a given risk assessment for an organization.
Review a disaster recovery plan (DRP) based on the findings of a given risk assessment for an organization.
Review a computer incident response team (CIRT) plan for an organization.
Understand methods of mitigating risk by managing threats, vulnerabilities, and exploits.
Identify compliance laws, standards, best practices, and policies of risk management.
Describe the components of an effective risk management plan.
Describe approaches for identifying and analyzing relevant threats, vulnerabilities, and exploits.
Describe the process of performing risk assessments.
Identify assets and activities to be protected within an organization.
Identify and analyze threats, vulnerabilities, and exploits.
Identify and analyze risk mitigation security controls.

Student tasks:
- Students must attend at least 80% of contact sessions in order to be accepted to the final examination.
- Students are responsible to do all exercises, assignments and labs given by instructor in class or at home and submit in time
- Use laptop in class only for learning purpose
- Promptly access at https://flm.fpt.edu.vn/ for up-to-date course information

Tools:
Internet, Student VM workstation with Microsoft Office 2007 or higher, Zenmap, Nessus, AI Tools: ChatGPT, Gemini, Copilot,…

Materials:
description: Computer Security Handbook
author: Seymour Bosworth, M.E. Kabay, Eric Whyne
publisher: John Wiley & Sons
published_date: 2014
edition: 6th
description: Information Security Management Metrics: A Definitive Guide to Effective Security Monitoring and Measurement
author: W. Krag Brotby
publisher: CRC Press
published_date: 2009
description: Information Security Risk Analysis
author: Thomas R. Peltier
publisher: CRC Press
published_date: 2010
edition: 3rd
description: Lecture slides, Lab manual, supplementary material
description: Managing Risk In Information Systems
author: Darril Gibson
publisher: Jones & Bartlett Learning
published_date: 2015
edition: 2nd
isbn: 978-1284055955
note: Books24x7, https://library.books24x7.com/toc.aspx?bookid=69822
description: Measuring and Managing Information Risk: A FAIR Approach
author: Jack Freund, Jack Jones
publisher: Butterworth-Heinemann, Elsevier
published_date: 2015
description: Security Controls Evaluation, Testing, and Assessment Handbook
author: Leighton R. Johnson
publisher: Syngress
published_date: 2016

Assessments:
category: Assessment 1
type: on-going
weight: 10.0
duration: Option 1: 45'/team; Option 2 (For Constructivism Approach only): Follow lecturer's proposal
question_type: CLO1, CLO2, CLO3, CLO4, CLO5
no_question: Option 1: Project Presentation And Preview Assessment_part_1; Option 2 (For Constructivism Approach only): Follow lecturer's proposal
knowledge_and_skill: Option 1: Project Presentation; Option 2 (For Constructivism Approach only): Follow lecturer's proposal
grading_guide: Cover Lectures 1- 5
note: Phase 1: Risk Identification & Assessment: Define the enterprise, its critical assets, and conduct a qualitative risk assessment.
category: Assessment 2
type: on-going
weight: 15.0
duration: Option 1: 45'/team; Option 2 (For Constructivism Approach only): Follow lecturer's proposal
question_type: CLO6, CLO7, CLO8, CLO9, CLO10
no_question: Option 1: Project Presentation And Preview Assessment_part_2; Option 2 (For Constructivism Approach only): Follow lecturer's proposal
knowledge_and_skill: Option 1: Project Presentation; Option 2 (For Constructivism Approach only): Follow lecturer's proposal
grading_guide: Cover Lectures 6- 10
note: Phase 2: Mitigation Planning: Develop policies and select security controls to treat identified risks, including a cost-benefit analysis.
category: Assessment 3
type: on-going
weight: 15.0
duration: Option 1: 45'/team; Option 2 (For Constructivism Approach only): Follow lecturer's proposal
question_type: CLO11, CLO12, CLO13, CLO14, CLO15
no_question: Option 1: Project Presentation And Preview Assessment_part_3; Option 2 (For Constructivism Approach only): Follow lecturer's proposal
knowledge_and_skill: Option 1: Project Presentation; Option 2 (For Constructivism Approach only): Follow lecturer's proposal
grading_guide: Cover Lectures 11- 15
note: Phase 3: Response & Recovery: Create core components of a resilient framework: a Business Impact Analysis (BIA), Business Continuity Plan (BCP), Disaster Recovery Plan (DRP), and a Computer Incident Response Team (CIRT) plan.
category: Final Project Presentation
type: on-going
weight: 20.0
duration: 45'/each
question_type: CLO1, CLO2, CLO3, CLO4, CLO5,CLO6, CLO7, CLO8, CLO9, CLO10,CLO11, CLO12, CLO13, CLO14, CLO15
no_question: Project Presentation
knowledge_and_skill: Project Presentation
note: Each team have 45 minutes for presentation.
Evaluate the final presentation, based on what the teams introduce, share, and demonstrate their final report, mainly focus on:
- Phase 1: Risk Identification & Assessment 20%
- Phase 2: Mitigation Planning 25%
- Phase 3: Response & Recovery 30%
- Presentation: 10%
- Team working: 15%
category: Midterm Test
type: on-going
weight: 20.0
duration: Option 1: 30'- 40’ Option 2 (For Constructivism Approach only): Follow lecturer's proposal
no_question: Option 1: Multiple choices Marked by Computer or a suitable format Option 2 (For Constructivism Approach only): Questions or Activities proposed by lecturer
knowledge_and_skill: Option 1: 20-25 Option 2 (For Constructivism Approach only): Follow lecturer's proposal
grading_guide: Cover Lectures 1- 8
note: in class, by instructor
category: Final Exam
type: Final exam
weight: 20.0
duration: 60'
no_question: Multiple choices Marked by Computer
knowledge_and_skill: 50
grading_guide: concepts, algorithms; all studied Chapters
note: by exam board, using computer

Schedule:
session: Lecture 1. Risk Management Fundamentals
1.1 The Major Components of Risk to an IT Infrastructure
1.2 Risk Management and Its Importance to the Organization
learning_outcomes: T
session: Lecture 1. Risk Management Fundamentals
1.3 Risk Identification Techniques
1.4 Risk Management Techniques
learning_outcomes: T
session: Project Kick-off & Team Formation:
Introduce project requirements, deliverables, and grading rubric.
Form student teams (3–5 members).
Brainstorm possible project topics (e.g., risk analysis for a healthcare IT system, vulnerability assessment in cloud environments).

Use AI brainstorming: students ask AI to suggest 5–10 possible topics → select one with instructor approval.
learning_outcomes: U
session: Guide: How to Identify Threats and Vulnerabilities in an IT Infrastructure
learning_outcomes: U
session: Lecture 2. Managing Risk: Threats, Vulnerabilities, and Exploits
2.1 Understanding and Managing Threats
2.2 Understanding and Managing Vulnerabilities
learning_outcomes: T
session: Lecture 2. Managing Risk (cont): Threats, Vulnerabilities, and Exploits
2.1 Understanding and Managing Threats
2.2 Understanding and Managing Vulnerabilities
learning_outcomes: T
session: Lecture 3. Maintaining Compliance
3.1 Regulations Related to Compliance
3.2 Organizational Policies for Compliance
learning_outcomes: T
session: Lecture 3. Maintaining Compliance
3.3 Standards and Guidelines for Compliance
learning_outcomes: T
session: Project Proposal Submission:
Teams submit a 1-2 page proposal outlining their chosen enterprise, scope, and initial risk hypotheses.
AI can assist in structuring the proposal, but students must critically refine it.
Instructor + peers provide feedback
learning_outcomes: U
session: Guide: Align Risks, Threats and Vulnerabilities to COBIT P09 Risk Management Controls
learning_outcomes: U
session: Lecture 4. Developing a Risk Management Plan
4.1 Objectives and Scope of a Risk Management Plan
4.2 Assigning Responsibilities, Procedures and Schedules for Accomplishment
learning_outcomes: T
session: Lecture 4. Developing a Risk Management Plan
4.3 Reporting Requirements, Plan of Action and Milestones
4.4 Charting the Progress of a Risk Management Plan
learning_outcomes: T
session: The AI Auditor: Teams present their top 5 identified risks.
Another team or an AI prompt (e.g., "Act as a skeptical internal auditor") challenges the analysis for completeness and relevance to COBIT.
learning_outcomes: U
session: Guide: Define the Scope and Structure for an IT Risk Management Plan
learning_outcomes: U
session: Lecture 5. Defining Risk Assessment Approaches
5.1 Understanding Critical Components of a Risk Assessment
learning_outcomes: T
session: Lecture 5. Defining Risk Assessment Approaches
5.2 Types of Risk Assessments and Challenges
5.3 Best Practices for Risk Assessment
learning_outcomes: T
session: Lecture 6. Performing a Risk Assessment
6.1 Selecting a Risk Assessment Methodology
6.2 Identifying the Management Structure, Assets and Activities Within Risk Assessment Boundaries

Solution Design: Propose mitigation solutions for identified risks.
Deliverable: Draft solution framework (diagram, flowchart, or risk management plan outline).
Mid-point check-in presentation (15 minutes/team) for instructor feedback.
learning_outcomes: T
session: Lecture 6. Performing a Risk Assessment
6.3 Identifying and Evaluating Relevant Threats, Vulnerabilities and Countermeasures
6.4 Selecting a Methodology Based on Assessment Needs
learning_outcomes: T
session: Lecture 6. Performing a Risk Assessment
6.5 Developing Mitigating Recommendations and Presenting Risk Assessment Results
learning_outcomes: T
session: Lecture 6. Performing a Risk Assessment
6.6 Best Practices for Performing Risk Assessments
learning_outcomes: T
session: Review Assessment 1
learning_outcomes: U
session: Review Assessment 1
learning_outcomes: U
session: Review Assessment 1
learning_outcomes: U
session: Lecture 7. Identifying Assets and Activities to Be Protected
7.1 System Access and Availability
7.2 System Functions: Manual and Automated
learning_outcomes: T
session: Lecture 7. Identifying Assets and Activities to Be Protected
7.3 Hardware, Software and Personnel Assets
7.4 Data and Information Assets
learning_outcomes: T
session: Lecture 7. Identifying Assets and Activities to Be Protected
7.5 Asset and Inventory Management Within the Seven Domains of a Typical IT Infrastructure
learning_outcomes: T
session: Lecture 7. Identifying Assets and Activities to Be Protected
7.6 Identifying Facilities and Supplies Needed to Maintain Business Operations
learning_outcomes: T
session: Lectures 8. Identifying and Analyzing Threats, Vulnerabilities, and Exploits
8.1 Threat Assessments
8.2 Vulnerability Assessments
learning_outcomes: T
session: Lectures 8. Identifying and Analyzing Threats, Vulnerabilities, and Exploits
8.3 Exploit Assessments
learning_outcomes: T
session: AI-Supported Evaluation: Teams use AI to test and critique proposed risk assessments (e.g., ask AI to act as an auditor).
Deliverable: AI Evaluation Log – 1–2 pages explaining suggestions and team refinements.
learning_outcomes: U
session: Structured Peer Review: Teams swap reports and provide feedback using a provided rubric.
Subsequently, use AI to summarize the peer feedback and identify common strengths/weaknesses across all reviews
learning_outcomes: U
session: Implementation / Case Study Detailing: Develop detailed risk mitigation plans or case studies.
Deliverable: Progress Report (4–5 pages) with initial results.
learning_outcomes: U
session: Lectures 9. Identifying and Analyzing Risk Mitigation Security Controls
9.1 In-Place Controls, Planned Controls and Control Categories
9.2 Procedural Control Examples
learning_outcomes: T
session: Lectures 9. Identifying and Analyzing Risk Mitigation Security Controls
9.3 Technical Control Examples
9.4 Physical Control Examples
9.5 Best Practices for Risk Mitigation Security Controls
learning_outcomes: T
session: Lectures 10. Planning Risk Mitigation Throughout Your Organization
10.1 The Scope of Risk Management for Your Organization
10.2 Understanding and Assessing the Impact of Legal and Compliance Issues on Your Organization
learning_outcomes: T
session: Lectures 10. Planning Risk Mitigation Throughout Your Organization
10.3 Translating Legal and Compliance Implications
10.4 Assessing the Impact of Legal and Compliance Implications on the Seven Domains of a Typical IT Infrastructure
learning_outcomes: T
session: Lectures 10. Planning Risk Mitigation Throughout Your Organization
10.5 Assessing How Security Countermeasures and Safeguards Can Assist with Risk Mitigation
10.6 Understanding the Operational Implications of Legal and Compliance Requirements
learning_outcomes: T
session: Lectures 10. Planning Risk Mitigation Throughout Your Organization
10.7 Identifying Risk Mitigation and Risk Reduction Elements for the Entire Organization
10.8 Performing a Cost-Benefit Analysis
10.9 Best Practices for Planning Risk Mitigation Throughout Your organization
learning_outcomes: T
session: The Cost-Benefit Challenge: Teams propose their chosen mitigation controls.
Other teams/AI (prompt: "Act as a CFO focused on ROI") challenge the cost-benefit analysis and operational feasibility.
learning_outcomes: U
session: Review Assessment 2
learning_outcomes: U
session: Review Assessment 2
learning_outcomes: U
session: Lectures 11. Turning Your Risk Assessment into a Risk Mitigation Plan
11.1 Translating Your Risk Assessment into a Risk Mitigation Plan
11.2 Prioritizing and Verifying Risk Elements and How These Risks Can Be Mitigated
11.3 Performing a CBA on the Identified Risk Elements
learning_outcomes: T
session: Lectures 11. Turning Your Risk Assessment into a Risk Mitigation Plan
11.4 Implementing and Following Up on the Risk Mitigation Plan
11.5 Best Practices for Enabling a Risk Mitigation Plan from Your Risk Assessment
learning_outcomes: T
session: Lectures 12. Mitigating Risk with a Business Impact Analysis
12.1 The Scope and Objectives of a BIA
12.2 The Steps of a BIA Process
12.3 Identifying Mission-Critical Business Functions and Processes
learning_outcomes: T
session: Lectures 12. Mitigating Risk with a Business Impact Analysis
12.4 Mapping Business Functions and Processes to IT Systems
12.5 Best Practices for Performing a BIA for Your Organization
learning_outcomes: T
session: Plan Consolidation: Integrate all components (BIA, BCP, DRP, CIRT) into a unified Risk Management Framework document.
learning_outcomes: U
session: Lectures 13. Mitigating Risk with a Business Continuity Plan
13.1 Elements of a BCP
13.2 How Does a BCP Mitigate an Organization's Risk?
learning_outcomes: T
session: Lectures 13. Mitigating Risk with a Business Continuity Plan
13.3 Best Practices for Implementing a BCP for Your Organization
learning_outcomes: T
session: Lectures 14. Mitigating Risk with a Disaster Recovery Plan
14.1 Critical Success Factors of a DRP
14.2 Elements of a DRP
learning_outcomes: T
session: Lectures 14. Mitigating Risk with a Disaster Recovery Plan
14.3 How Does a DRP Mitigate an Organization's Risk?
14.4 Best Practices for Implementing a DRP for Your Organization
learning_outcomes: T
session: Lectures 15. Mitigating Risk with a Computer Incident Response Team Plan
15.1 Purpose and Elements of a CIRT Plan
15.2 How Does a CIRT Plan Mitigate an Organization's Risk?
learning_outcomes: T
session: Lectures 15. Mitigating Risk with a Computer Incident Response Team Plan
15.3 Best Practices for Implementing a CI RT Plan for Your Organization
learning_outcomes: T
session: Review Assessment 3
learning_outcomes: U
session: Review Assessment 3
learning_outcomes: U
session: Final Project Preparation
learning_outcomes: U
session: Final Project Preparation
learning_outcomes: U
session: Final Project Preparation
learning_outcomes: U
session: Final Project Preparation
learning_outcomes: U
session: Final Project Presentation
learning_outcomes: U
session: Final Project Presentation
learning_outcomes: U