MIS 491-800 Vulnerability Risk Management (VRM)

Syllabus - Summer 2021

Required Text

Papers, articles, regulations provided via web links

 

Course Description

Prerequisite: None.
This course assumes no prior knowledge of vulnerability risk management (VRM) and starts by introducing the VRM basics. Along the way, we will delve into the details of the U.S National Vulnerability Database (NVD) and the Common Vulnerabilities and Exposures (CVE) list. We will also explore the different kinds of vulnerabilities, how VRM relates to the National Institute of Standards and Technology (NIST) definitions of risk, common/popular tools used for VRM, and several other related topics.

Schedule (*all times are EDT)

Sunday Monday Tuesday Wednesday Thursday Friday Saturday
16 May 17 May
Intro to 491 VRM
  • 1000-1100 Zoom
  • Python prog asgmt
18 May
  • CVE papers, 1999
  • Defs/Acronyms
19 May
  • Biz article (2019)
  • Paper Intro/BG (2021)
  • Blog article (2019)
20 May
Programming results
Readings discussion

  • 1000-1100 Zoom
  • NIST SP800-37r2, Ch 2
21 May
  • 3 Messer vids
  • NIST SP800-40r3, Ch 2-4
22 May
  • Tripathi & Singh, 2011
  • Ruohonen, 2017
  • Feutrill, et al, 2018
23 May 24 May
Paper ideas
  • 1000-1100 Zoom
  • Paper format
  • Paper idea refinement
25 May
  • CIS Controls
26 May
  • Code thinking
  • NVD API
27 May
Research Stmt
CIS Controls

  • 1000-1100 Zoom
  • Partner meeting
28 May
  • Blog easy reads
29 May
  • Investigate VRM tools
30 May 31 May
Memorial Day
1 June
Demo Present
CIS Controls

  • 1000-1100 Zoom
  • Prepare presentation
2 June
  • Vuln Mgmt Prediction
  • Prepare presentation
3 June
Vuln scanning presentations
  • 1000-1100 Zoom
  • Work paper topic
4 June
  • Work paper topic
5 June
  • Work paper topic
6 June
  • Work paper topic
7 June
Mid-course results
  • 1000-1100 Zoom
  • Equifax video
8 June
  • Bruce Schneier
9 June
  • VM Digital Transformation
10 June
Equifax, Bruce
  • 1000-1100 Zoom
  • Work paper topic
11 June
  • Work paper topic
12 June
  • Work paper topic
13 June
  • Work paper topic
14 June
NO MEETING
  • 1000-1100 Zoom
  • Work paper topic
15 June
  • Work paper topic
16 June
Reading Day
  • Work paper topic
  • 17 June
    Final: paper presentations
    • 1000-1100 Zoom
    18 June 19 June

    Course Student Learning Outcomes (SLOs)

    1. Explain the concepts of vulnerability, threat, and risk in the context of information system networks.
    2. Evaluate what is known about the Equifax VRM program around the time of the 2017 breach.
    3. Write a VRM-topic-based paper through an iterative process of drafting and revision.

    Policy Information

    Academic Honor Code

    As a student at The University of North Carolina Wilmington, I am committed to honesty and truthfulness in academic inquiry and in the pursuit of knowledge. I pledge to uphold and promote the UNCW Student Academic Honor Code.

    The University of North Carolina Wilmington is a community of high academic standards where academic integrity is valued. UNCW students are committed to honesty and truthfulness in academic inquiry and in the pursuit of knowledge. This commitment begins when new students matriculate at UNCW, continues as they create work of the highest quality while part of the university community, and endures as a core value throughout their lives.

    Please read and be familiar with the UNCW Student Academic Honor Code. I have highlighted some parts that are particularly relevant to CSC 131 here.

    Academic dishonesty in any form will not be tolerated in this class.

    Time Commitment

    This particular version of MIS 491 runs over 32 days (17 May - 17 June); it is a matter of UNC system policy that we should expect to be committed for an average of 4 hours per day (hpd), 7-days a week, to this class (or any 3-credit hour class you take during a summer session w/in the UNC system).

    A credit hour is defined as one 50-minute meeting of face-to-face instruction per week for 15 weeks, plus a minimum of 2 hours per week for 15 weeks of out-of-class student work.

    You should be mentally prepared to spend ~4 hpd on this class.

    Grading

    Grading Scale (+/- at instructor discretion)

    A: (avg >= 90)
    B: (90 > avg) and (avg >= 80)
    C: (80 > avg) and (avg >= 70)
    D: (70 > avg) and (avg >= 60)

    Coursework Weighting

    30% Reading comprehension
    70% Final paper

    Late Policy

    Assignments are due at 1800 (6pm) EDT on the date that they are due. Normally, no assignments will be accepted late. However, if a situation results from other than your poor planning, I am generally willing to accept late assignments w/o penalty. When in doubt - send me email.

    Extra Credit

    There is no specified extra credit in this class.

    Assignment Turn-around

    Assignments will be evaluated and feedback provided by 0800 the day following submission.

    Attendance

    Due to the condensed nature of this course, Zoom attendance is important. Absences for other than true emergencies will have a negative impact on your final grade.

    Communication Guidelines

    Our course has a discussion board titled, CSC 131 Community Q&A , to which anyone may post questions and responses. This is a place for the exchange of ideas, providing of tips, or posing of questions. I will monitor the discussion regularly and respond NLT 12 hours from the post date/time (though often much more quickly during my waking hours).
    Email: send me an email anytime about anything related to the course. From roughly 0800 - 2230, I expect I will regularly reply within 20 min - 2 hours. Most of the time I will be on or near my computer; sometimes I will be out working in the yard or running. I expect to be highly available to you during this summer semester. On exam days, when exams are due at 2359, I will be available on email until midnight.

    Special Needs

    If you have a disability and need reasonable accommodation in this course, you should inform the instructor of this fact in writing within the first week of class or as soon as possible. If you have not already done so, you must register the Office of Disability Services in DePaolo Hall (ext. 2-3746) and obtain a copy of your Accommodation Letter. You should then arrange a meeting to make mutually agreeable arrangements based on the recommendations of the Accommodation Letter. For more information, please visit the Disability Resource Center site.

    Title IX

    UNCW takes all forms of interpersonal violence very seriously. When students disclose, first- or third-hand, to faculty or staff about sexual misconduct, domestic violence, dating violence and/or stalking, this information must be reported to the administration in order to ensure that students' rights are protected, appropriate resources are offered, and the need for further investigation is explored to maintain campus safety. There are three confidential resources who do not need to report interpersonal violence: UNCW CARE, the Student Health Center, and the Counseling Center. If you want to speak to someone in confidence, these resources are available, including CARE's 24-hour crisis line (910-512-4821). For more information, please visit the UNCW CARE site.