IN9080 ¨C Security and Risk Management

Course content

Security and risk management is the foundation for ensuring good information security in organisations. This course focuses on ISMS (Information Security Management System) which can be seen as a systematic approach to managing information security.To have an ISMS is a requirement for organisations to be compliant with laws and regulations regarding information security and privacy. More specifically the course teaches security and risk management in terms of assessing relevant threats and risks to an organisation's information assets, and then selecting, implementing and operating an appropriate set of security controls to reduce and balance the risks. This includes taking into account data protection and GDPR as well as the principles for DPIA (Data Protection Impact Assessment).

Learning outcome

After completing this course, you will:

• have knowledge of the principles of security and risk management
• have knowledge of the role of security and risk management in organisations
• have knowledge of relevant laws, standards and frameworks for information security
• have knowledge of the responsibilities of top level management wrt. information security
• have knowledge about security culture
• be able to establish and operate an ISMS (Information Security Management System)
• be able to conduct threat and risk assessment for information security
• be able to?conduct DPIA (Data Protection Impact Assessment)
• be able to judge the appropriateness of security controls for reducing security risks
• be able to organise security-awareness training

Admission to the course

PhD candidates from the University of Oslo should apply for classes and register for examinations through?Studentweb.

If a course has limited intake capacity, priority will be given to PhD candidates who follow an individual education plan where this particular course is included. Some national researchers¡¯ schools may have specific rules for ranking applicants for courses with limited intake capacity.

PhD candidates who have been admitted to another higher education institution must?apply for a position as a visiting student?within a given deadline.

Recommended previous knowledge

General knowledge about information security, e.g. IN2120 Informasjonssikkerhet and IN1020 Introduksjon til datateknologi.

Overlapping courses

• 10 credits overlap with IN5080 ¨C Security and Risk Management.
• 8 credits overlap with ITLED4230 ¨C Ledelse av informasjonssikkerhet (continued).
• 8 credits overlap with ITEVU4230 ¨C Ledelse av informasjonssikkerhet.

Teaching

The course has:

• 2 hours of lectures per week (plenary sessions)
• 2 hours of workshops per week (plenary sessions)

The workshop sessions will be used for practical exercises, case studies and seminar talks given by students.

Examination

The course grade is based on the following assessment items:

• Home exam in the form of a case study: 30%

• Final?exam (digital): 70%

Both exams must be passed and must be passed in the same semester. Note that?the exam in IN9080?will be more extensive than the one in IN5080.

The home exam consists of writing a report on a specific case study. The report can be written individually or in a group of 2 or 3 students.

Examination support material

For the home exam, any support material is permitted.

For the digital final exam, no support material is permitted.

Language of examination

You may write your examination paper in Norwegian, Swedish, Danish or English.

Grading scale

Grades are awarded on a pass/fail scale. Read more about?the grading system

More about examinations at UiO

• Use of sources and citations
• Special exam arrangements due to individual needs
• Withdrawal from an exam
• Illness at exams / postponed exams
• Explanation of grades and appeals
• Resitting an exam
• Cheating/attempted cheating

You will find further guides and resources at the web page on examinations at UiO.