Organizing for Cybersecurity, 6 credits

Main field of study

Course level

Advancement level

Course offered for

• Master of Science in Information Technology
• Master of Science in Computer Science and Software Engineering
• Master of Science in Computer Science and Engineering
• Master's Programme in Cybersecurity

Prerequisites

Achieved Bachelor level studies in Computer Science.

Intended learning outcomes

The course applies organisation theory to the study of cybersecurity and views cybersecurity as an object and process of organising and management. The course is designed to enable students to develop competencies that will enable them to subsequently evaluate and, if necessary, make organisational and management-related cybersecurity decisions.

Upon successful completion of the course, students will be able to 

• explain risk, uncertainty and compliance as socially constructed
• identify opportunities and limitations of risk control
• evaluate cybersecurity incidents as learning opportunities 
• recognize cybersecurity-related professions and professionalism 
• design a cybersecurity strategy

Course content

The course addresses how cybersecurity activities are aligned in a structured manner with organisational objectives in compliance with relevant industry and government regulations. Organising cybersecurity involves defining roles related to cybersecurity, including responsibility for coordinating authority and informal relationships, and allocating resources to cybersecurity within the organisation. The course deals with the following topics.

Organizing Uncertainty 

• Rise of internal risk control due to expansion of legal and quasi-legal rules, counting and reporting as well as professionalism
• Concepts of corporate governance and responsibility
• Organizational legitimacy as a threat of corporate governance

Cybersecurity and Professionalism

• Professionalism as the ‘third logic’
• Creation of the cybersecurity profession as social identity and semi-profession 
• Variety of professional roles ensuring cybersecurity and their responsibilities for compliance and in case of misconduct

Cybersecurity and Compliance Management

• Rise of transnational regulation sustaining a world of governance
• Government and governance of cybersecurity and its design
• Implementation of governance: management of compliance and deviance in organizations

Cybersecurity and Incident Management

• Classic vs. strategic approach of cybersecurity
• Integration of organizational learning from failures or misconduct (incidents) under bounded rationality 
• Compliant cybersecurity strategy including sensemaking, resources, responsibilities, and incentives 
• Classification of incidences and incident management

Teaching and working methods

The course consists of lectures, seminars, project work and self-study.

Examination

Grades

Other information

The course contains mandatory examination elements that may entail a small additional cost for the student, corresponding to the cost of course literature.

About teaching and examination language

The teaching language is presented in the Overview tab for each course. The examination language relates to the teaching language as follows: 

• If teaching language is “Swedish”, the course as a whole could be given in Swedish, or partly in English. Examination language is Swedish, but parts of the examination can be in English.
• If teaching language is “English”, the course as a whole is taught in English. Examination language is English.
• If teaching language is “Swedish/English”, the course as a whole will be taught in English if students without prior knowledge of the Swedish language participate. Examination language is Swedish or English depending on teaching language.

Other

The course is conducted in such a way that there are equal opportunities with regard to sex, transgender identity or expression, ethnicity, religion or other belief, disability, sexual orientation and age.

The planning and implementation of a course should correspond to the course syllabus. The course evaluation should therefore be conducted with the course syllabus as a starting point. 

The course is campus-based at the location specified for the course, unless otherwise stated under “Teaching and working methods”. Please note, in a campus-based course occasional remote sessions could be included.  

Department