Overview of Key Tasks and Projects Completed
Using Lecture casts, book reading and a having a seminar sessions with the Lecturer, this module provided an in-depth understanding of Security and Risk Management through various activities, assessments, and group projects.
Below is an organized overview of the tasks and assignments I completed during the Module.
Focused on the common definitions, concepts and processes of not only Security and Risk Management, but also of terms like Confidentiality, Integrity, Availability, risks, threats, vulnerabilities, Industry 4.0, digitization, etc.
Learnt on the different types of Standards and there compatibility to OpenFAIR framework (i.e. ISO 31000, ISO 27001, ISO 27005, NIST 800-30, COSO ERM, etc) and also looked on OpenFAIR and OCTAVE framework.
Looked at the approaches to quantify and qualify risks, and also categorisation of the risk standards to different situations.
Our lecturer assigned us to group of 4 so that we work on an Assessment Project.
Dived deeper into the effects of different types of assessment (Qualitative vs. Quantitative).
Learned the importance of user participation in the risk management process to ensure accurate assessment and mitigation strategies.
Collaborated with members of my group (using WhatsApp for texts and calls, personal emails, zoom and teams video calls and Google Docs), to develop a Risk Identification Report, which required us to create a detailed risk assessment document.
Focused on the popular Threat Modelling Approaches/Frameworks: STRIDE, DREAD, Attack Trees and hybrid models such as the Process for Attack Simulation and Threat Analysis (PASTA).
Guided on how to select the right framework(S) to use as per a case study and I learned that one could perform risk assessment on one case study using multiple approaches.
We were assigned a case study (a Development Team Project) to do in Groups. The requirement was to create and design a Risk Identification report (which was to be handed in on week 6) and an Executive Summary (which was to be handed in on week 11).
Designed Use-case diagrams and Sequence diagrams Using Visual Paradigm UML tool to represent system workflows and identify potential threats.
Studied different security standards such as GDPR standard (UK/EU), ISO 27000 (global), NIST (globally), etc. and their relevance to security compliance across different industries and locations.
Analyzed case studies to understand the implications of these standards in various scenarios.
Participated in a seminar discussing the practical applications of Security and Risk Standards.
Covered on the methods that can be used as part of quantitative risk modelling: probabilistic approaches such as Monte Carlo simulations and Bayes Theorem-based methods, as well as Multi-Criteria Decision Analysis (MCDA) techniques such as TOPSIS, AHP and ANP.
Learnt the various scenarios and principles that are needed for the application of the quantitative approaches. Not forgetting their tools eg YASAI, monteCarlito, @risk, etc, and the probability distributions eg uniform, binomial, geometric, etc.
Performed risk modelling activities on Monte Carlo Simulation in Excel and Bayes.
Participated in a Collaborative Learning Discussion, critiquing the CVSS (Common Vulnerability Scoring System) and discussing alternatives for risk assessment.
Gained knowledge on creating and implementing Business Continuity Plans (BCP) and Disaster Recovery (DR) plans.As well as its contributing factors such as Business Impact Assessments (BIA), Recovery Time Objectives (RTOs) and Recovery Point Objectives (RPOs).
Learnt the different solutions to meet specific recovery objectives. The examples of the solutions included: Hybrid cloud model, Cloud DRaaS like Amazon (AWS), Microsoft (Azure), Google (GCP), Alibaba, IBM, Rackspace and many others.
Contributed to the development of a Disaster Recovery Plan and an Executive Summary outlining the Business Continuity and Disaster Recovery solutions for a given case study.
Explored current and future trends in Security and Risk Management, and their advantages, disadvantages and impacts.
These future trends included Enterprise Risk Management (ERM), Machine Learning, DevSecOps, Artificial Intelligence, Science Security, etc.
Participated in the Great Debate on the most influential trends in Security and Risk Management, whereby as a group we focused on Software Supply Chain Management as the trend for the future of Security and Risk Management (SRM).
This module provided a comprehensive overview of Security and Risk Management, combining theoretical frameworks with practical group projects. The skills and knowledge gained will contribute significantly to my professional development, preparing me for real-world cybersecurity challenges.
Submitted a Reflective Essay analyzing key takeaways from this module, challenges faced, and how the acquired skills apply to real-world secure software development.