CyberSec: The Economics of Cybersecurity

Cybersecurity has become a complex process. It is a mandatory cost businesses incur. However, an acceptable security posture of an enterprise is dependent on external factors as and when new vulnerabilities come to light and an adversary tries those vulnerabilities against the defense mechanisms of an enterprise. Provisioning for cybersecurity is a never-ending process and it has a cost, which not all enterprises are in a position to bear. This course will help you understand the economics of cybersecurity so that you will be able to provision your resources and budget it effectively to maintain an acceptable security posture of your organization.  

On successful completion of this course, you will have a broad understanding of 

- Fundamental security principles and their engineering mechanisms 

- Modern security operations center (SOC) best practices 

Day 1: We will discuss the fundamental principles of cybersecurity and methods to implement these principles. We will collectively undergo use cases to understand the costs of implementing these security principles to defend an online enterprise. In parallel, we will also understand the costs incurred by attackers in launching an attack to understand the asymmetry of the relative costs between an enterprise's defense mechanisms and an attacker's offense mechanisms.

Day 2: We will discuss systematic approaches to define insecurity and mechanisms to mitigate it. We shall assess different security mechanisms for their security guarantees vis a vis its cost. We shall learn how to measure the attack perimeter of an enterprise, devise a threat model for it, sign off risk matrices, and elaborate on generating incident response strategies and compliance reports.

Day 3: We will learn the best practices to implement a modern SOC (Security Operations Center), a single data-driven platform to measure, assess, contain, respond to, and report potential security incidents in an enterprise. We shall also understand the utility of security frameworks like MITRE ATT&CK to model your enterprise's perceived threats against the tactics and techniques used by various threat actors and emerging threats.

• Business executives having cybersecurity domain experience of a minimum of two years.
• Business executives whose roles involve provisioning budgets for cybersecurity, risk assessment, business continuity strategies, and compliance reporting will benefit from this course.
• CISO, CTO, CIO, CPO, CEO 

Registration Closed

If you/your organisation are interested in this program and would like to learn more, contact us at program@iimmumbai.ac.in