Module 1 Introduction and Learning Objectives

 Bookmark this page

Introduction

Module 1 introduces the concept of systems thinking and why it is useful in analyzing
cybersecurity operational challenges across the four sectors we will explore in this
course.

We talk a lot about dissolving boundaries in cybersecurity, as the Internet continues to

erode the concept of nation-state boundaries. Boundaries DO still exist between sectors
of society and this complicates the mission of cybersecurity professionals. Increasingly,
cross-sector collaboration becomes critical.

Systems-thinking encourages a less linear and more synthesis-seeking, "collective

intelligence"  approach that is conducive to detecting and tracking motivations and
possible actions of threat actors across a spectrum who are seeking to attack many
different sectors. As threat actors continue to become more sophisticated, the thinking
in cybersecurity in all sectors needs to keep up.

This course aims to show you important sectors impacted by cybersecurity issues - 
Industry, Government, Military - and help you to begin to compare and contrast their
cultures, missions, operational challenges, and unique aspects of working in information
security within them.

Dr. Endicott-Popovsky has interviewed four very successful CISOs representing those
sectors. She will ask them the same questions about their career trajectories, their tool
kits, and their challenges. The intent is to present these "mentors" side-by-side so you
can draw some conclusions about how compatible you might be with a certain sector
approach. 

Your job is to listen carefully, take notes using the provided template, and build a
takeaway document for yourself with valuable insights gained from these leaders. 

Module Learning Objectives

 Describe "systems thinking" in a practical way.

 Apply the core concepts of systems thinking to analyzing cybersecurity threats.

 Describe the sectors - Industry, Government, Military

 At a high level, explain what might be some differences in operationalizing

cybersecurity in these sectors based on their missions.
Your Incoming Knowledge - A Brief Check
 Bookmark this page

Multiple Choice with Hints and Feedback

1 point possible (graded)

True or False? Operationalizing cybersecurity involves all of the same measures, across the
sectors.

TRUE

FALSE

unanswered

Submit

Some problems have options such as save, reset, hints, or show answer. These options follow the Submit
button.

Multiple Choice with Hints and Feedback

1 point possible (graded)

True or False? The military sector involves an almost purely technical approach to
cybersecurity.

True

False

unanswered

Submit

Some problems have options such as save, reset, hints, or show answer. These options follow the Submit
button.

Multiple Choice with Hints and Feedback

1 point possible (graded)

Systems thinking is rooted in computer science.

TRUE
 FALSE

unanswered

Explore and Discuss - What is Systems Thinking and

How Does it Apply Here?
 Bookmark this page

What is systems thinking?  It's evolution began several decades ago, but today's
accepted definition is, a cognitive approach that attempts to look at the whole of a
system by better understanding its components and how they interact and impact each
other.

Peter Senge, a major thinker in the area, uses the analogy of a family when describing
systems thinking - emphasizing that inter-relatedness and shared impacts are at the
core of systems. One core concept of systems theory is that the whole is greater than
the sum of its parts. This could not be more true when it comes to conceptualizing the
whole of cybersecurity threat.

In cybersecurity, an organizational learning approach like systems thinking can help

leaders operationalize strategies in a very complex, sometimes silo-ed system of the
interconnected sectors, or parts, of society all equally impacted by cybersecurity threat.

In this course, we will look at the interconnected yet disparate missions of Industry,
Government, Military and Academic sectors through this lens. This is an introduction, so
please consider there are many things to learn beyond this course, which is designed to
whet your appetite for thinking!

NEXT: Do the following readings to get a grounding. Then proceed to the

Discussion.

Introductory Resource - Peter Senge video and overview of the core concepts of systems
thinking

Applied Resource: A higher-level* MIT working paper - "Cyber Safety: A Systems Thinking

and Systems Theory Approach to Managing Cyber Security Risks" (2014)

* Focus on this paper's Introduction, but if you are interested, continue to read the whole
paper.

After viewing and reading the resources on systems thinking, please describe why

and how a holistic, systems approach could be effective in combating cyber threats.
 Why and how should cybersecurity strategic thinking reach beyond technical
solutions?

If you disagree, please outline why, with support from research.

Respond to at least two peers.

HINT: Take a look at the Introduction to the MIT working paper by Hamid Salim. Consider
the writer's thesis in thinking about how a systems approach operates in this
context: [The] limitations of technical approaches are not because of inherent problems
with those approaches, but because technical approaches address only a subset of
cyber security risks.

Overview of Core Assessment for this Course:

Building your Decision-Making Matrix
 Bookmark this page

For this course, you will benefit from the perspectives of four CISOs from very different sectors
(starting next, in Module 2): Industry, Academia, Military, and Government. The goal of this
course is to help you build your own decision-making matrix based on information about the
sectors’ tool kits – showing what the sectors demand in their tool kits, their missions, and how
they relate to job requirements.

You can then begin to compare the sectors’ requirements with  your own talents and existing expertise,
and start to think about your “swim lane”.

Where do you see yourself in cybersecurity? Getting to the answer is a process…

As you watch each video, use this template to capture valuable insights toward an end goal to
build a matrix comparing and contrasting the sectors, at-a-glance.

Step 1: Take notes from the videos, tracking on the keywords and parallel structure of the interviews.

After each video, I suggest you take time to look at your notes and begin to gauge your comfort
level with the key distinguishing features of each sector. Try to align your talents, strengths,
passions and goals to the sector, and find areas where you might be challenged

However, don’t be hasty! Take notes on all sectors before drawing deeper conclusions!

Step 2: Finalize your matrix for the sector , following the questions in the columns.
 Step 3: Participate in the Peer and Self-Assessment exercises linked to each Module. The
assessments will guide you, and a rubric will be provided.

Reminder: Your final assessment for this course consists of the Knowledge Checks interspersed
throughout the course, and five of these peer and self-assessment. Remember to follow the guidelines in
providing your peers valuable input, and to review two peers.

Key area 1: Key Area 2: Key Area 3: Takeaway

What was the CISO’s Features of this Sector (Culture, What did I find most My early thoughts on
career path? practices, history, rule and compelling, surprising this sector and my
tools) that make it unique, as about this sector and compatibility with it 
pointed out by the CISO. this CISO's advice?

Also, what was pointed out as

most important?

       English degree Driven by policy  

       Military Police officer Practices:

       Communicationsofficer Tech: Technology specialists in

(many were converted high demand to support
to cybersecurity) leadership. Leadership does not
necessarily require technical
…
expertise.

 
 

 
 Thinking Exercise 1
 Bookmark this page

Critical Thinking and Cyber Strategy

Systems thinking involves critical thinking in its need for openness, flexibility, and rigor.

In preparation for a brief peer-review exercise, please review this presentation, Be Like
Water: Applying Analytical Adaptability to Cyber Intelligence by Jay McAllister at a
2017 RSA conference.

Focus on the main elements and particularly on slide 29's organization around three
steps. Then, proceed to the Thinking Exercise.

OPEN RESPONSE ASSESSMENT

This assignment has several steps. In the first step, you'll provide a response to the prompt. The
other steps appear below the Your Response field.

1. Your Response
due Jan 1, 2029 05:45 +0545 (in 10 years, 8 months)IN PROGRESS

Enter your response to the prompt. You can save your progress and return to complete
your response at any time before the due date (Monday, Jan 1, 2029 05:45 +0545). After
you submit your response, you cannot edit it.
1. The prompt for this section
In the presentation you just reviewed, Be Like Water, the author lays out the core traits
of successful, effective cybersecurity thinkers. He ties these traits to the analytic
framework (slides 22-25), and the three-step process to holistically assessing threats
(slide 29).

Here, in an essay of 100 words or so (no more than a page, typed), describe what you
think the overlapping features of critical and systems thinking are in relationship to this
presentation's assertions. Consider a recent news story about a cyber attack or a
scenario with which you are professionally familiar, and apply 1-3 of the core features to
this scenario. How could a professional armed with a strong thinking style mitigate a
threat?
You will be asked to review two peers, and you will be reviewed by two peers. 20 points
possible.

Knowledge Checks for Industry CISO Point-of-View

 Bookmark this page

Multiple Choice with Hints and Feedback

1 point possible (graded)

Bill Boni calls business acumen, communications skills, and technical know-how

_______________________ that enable professionals to address a wide range of issues.

areas of dominant expertise

domains of competency

unanswered

Submit

Some problems have options such as save, reset, hints, or show answer. These options follow the Submit
button.

Multiple Choice with Hints and Feedback

1 point possible (graded)

True or False. Everyone in a corporate security organization reports directly to the CISO.

TRUE

FALSE

unanswered

Submit

Some problems have options such as save, reset, hints, or show answer. These options follow the Submit
button.

Multiple Choice with Hints and Feedback

1 point possible (graded)
An example of a key domain of functional accountability related to cyber security is
____________________.

the entire engineering department

the governance risk and compliance team

a dedicated corporate lawyer

unanswered

Submit

Some problems have options such as save, reset, hints, or show answer. These options follow the Submit
button.

Multiple Choice
1 point possible (graded)

Boni notes that the TMobile cybersecurity technology office addresses emerging
technologies'_______________

basic structures

risks and rewards

possible threats

potential for profit

unanswered

Submit

Some problems have options such as save, reset, hints, or show answer. These options follow the Submit
button.

Multiple Choice with Hints and Feedback

1 point possible (graded)

What is unique to industry among the cybersecurity sectors, as related to mission focus? Check
all that apply.

public security
 shareholder interest and brand protection

productivity in balance with protection

unanswered

A Cyber Attack on the Grocery Industry

 Bookmark this page

Consider this article about threats to the cyber security of the grocery industry from Forbes,
June 2017. The angle of the article is more from the business perspective, but what can
you pick out about how a cybersecurity plan should be operationalized given the threats
this industry faces?

Discussion Prompt: 

Apply some systems thinking. What are the interconnected parts of this system? How is
the grocery industry related to society? What are its drivers that could impede a strong
cyber security strategy?

What did TMobile CISO Bill Boni point out in his interview that resonates here? 

Respond to at least two peers.

 Bookmark this page

Here is a template you can use to build your matrix. You can continually add to one, or
you might prefer to create a separate chart for each sector. Regardless, at the end, you
should be able to see a high-level overview of your impressions as this course presents
the views from the top of four sector CISOs. This module, we begin with the Industry
perspective.

Be prepared for peer review of this document as you proceed to the

Open Assessment. 
 Key Area 2:

Features of this Sector

(Culture, practices, history, Key Area 3:
rule and tools) that make it
unique, as pointed out by the What did I find Takeaway
Key area 1: CISO. most compelling,
surprising about My early thoughts on
What was the CISO’s Also, what was pointed out this sector and this this sector and my
career path? as most important? CISO's advice? compatibility with it 

       English degree
       Military Police officer
       Communications
officer (many were
converted to
cybersecurity)

 
Driven by policy
 
Practices:

  Tech: Technology specialists
in high demand to support
  leadership. Leadership does
not necessarily require
  technical expertise.

     

PEER AND SELF-EVALUATION OF MATRIX - INDUSTRY

This assignment has several steps. In the first step, you'll provide a response to the prompt. The
other steps appear below the Your Response field.

1. Your Response
due Jan 1, 2029 05:45 +0545 (in 10 years, 8 months)IN PROGRESS
 Enter your response to the prompt. You can save your progress and return to complete
your response at any time before the due date (Monday, Jan 1, 2029 05:45 +0545). After
you submit your response, you cannot edit it.
1. The prompt for this section
This Module, you begin the core assessment of the course - your peer and self-evaluation
of your building matrix of observations about the sector interviews. We start with
Industry. In this open response assignment, follow the steps carefully. Either upload a
PDF version of your matrix, or a summary of the category responses for peer and self-
evaluation. Use the provided Rubric to assess two peers.
Your response (required)

Knowledge Checks for Government CISO Point-of-

View
 Bookmark this page

Multiple Choice with Hints and Feedback

1 point possible (graded)

While at the NASA Jet Propulsion Lab, Mike Hamilton was told he needed to work to secure
networks because the internet was starting to become ________________.

infiltrated

commodified

unanswered

Submit

Some problems have options such as save, reset, hints, or show answer. These options follow the Submit
button.

Multiple Choice with Hints and Feedback

1 point possible (graded)

According to Hamilton, early security of networks was attempted mainly through

_____________.

dedicated cybersecurity monitoring teams

firewalls
unanswered

Submit

Some problems have options such as save, reset, hints, or show answer. These options follow the Submit
button.

Multiple Choice with Hints and Feedback

1 point possible (graded)

Early in his career, Hamilton did a lot of ________________ that led to expertise.

hacking

experimentation

unanswered

Submit

Some problems have options such as save, reset, hints, or show answer. These options follow the Submit
button.

Multiple Choice with Hints and Feedback

1 point possible (graded)

True or False. Hamilton has found policy to be a non-integral part of his work. It was the
technology experimentation and entrepreneurial spirit that led to his success.

TRUE

FALSE (Listen closely to Hamilton. He repeatedly emphasizes the importance of becoming

very familiar with policy in building a well-rounded cybersecurity career.

unanswered

Submit

Some problems have options such as save, reset, hints, or show answer. These options follow the Submit
button.

Multiple Choice with Hints and Feedback

1 point possible (graded)

In operationalizing cybersecurity for a local government, it's important to adhere to the same
rules and regulations that govern at the federal level.
 Somewhat true

Not true

Very true

unanswered

Submit

Some problems have options such as save, reset, hints, or show answer. These options follow the Submit
button.

Hint

Multiple Choice with Hints and Feedback

1 point possible (graded)

Hamilton faced a crisis in his time with Seattle when attackers wanted to target
________________ who brokered purchases of power from other states when snow melt was
insufficient to feed the Seattle grid.

inside Seattle Light employees

power marketers

unanswered

Submit

Some problems have options such as save, reset, hints, or show answer. These options follow the Submit
button.

Hint

Multiple Choice with Hints and Feedback

1 point possible (graded)

Social media use is troubling to Hamilton because users ____________________________.

(All that apply.)

are susceptible to fake news

give up too much information about themselves

 build up jealousy toward one another that might someday result in neighbor-neighbor
attacks

Explore and Discuss: Government Cybersecurity News

 Bookmark this page

Explore this site dedicated to government cybersecurity news. What are your impressions

about what seems important, the categories of information, and the tone? Pick one
article to discuss with peers. Point out why you chose this and if it is tied to the interview
with Gent Walsh this Module. Were there any things you noticed about this site more
after viewing the video?

Respond to two peers.

Sector Overview Matrix - Adding Government

 Bookmark this page

Using the template provided earlier, either add to or create a fresh Government matrix
overview of your impressions after viewing the interview with Mike Hamilton. Then,
participate in the peer and self-assessment exercise.

PEER AND SELF-EVALUATION OF MATRIX - GOVERNMENT

This assignment has several steps. In the first step, you'll provide a response to the prompt. The
other steps appear below the Your Response field.

1. Your Response
due Jan 1, 2029 05:45 +0545 (in 10 years, 8 months)IN PROGRESS

Enter your response to the prompt. You can save your progress and return to complete
your response at any time before the due date (Monday, Jan 1, 2029 05:45 +0545). After
you submit your response, you cannot edit it.
1. The prompt for this section
This Module, you continue the core assessment of the course - your peer and self-
evaluation of your building matrix of observations about the sector interviews. We
continue with Government. In this open response assignment, follow the steps carefully.
Either upload a PDF version of your matrix, or a summary of the category responses for
peer and self-evaluation. Use the provided Rubric to assess two peers.
Your response (required)

Knowledge Checks for Military CISO Point-of-View

 Bookmark this page

Multiple Choice with Hints and Feedback

1 point possible (graded)

Colonel Gent Walsh got his start in his career as a(n) ________________.

computer science engineer

military police officer

English instructor

unanswered

Submit

Some problems have options such as save, reset, hints, or show answer. These options follow the Submit
button.

Multiple Choice with Hints and Feedback

1 point possible (graded)

Walsh thinks of cyber as a narrow term that only encompasses warfare.

True

False

unanswered

Submit

Some problems have options such as save, reset, hints, or show answer. These options follow the Submit
button.

Multiple Choice with Hints and Feedback

1 point possible (graded)

Walsh says military cybersecurity is organized around the OODA loop, which stands for
__________ _____________ ___________ ____________.
 Observe, Orient, Decide, Act

Orientation, Observation, Duty, Assessment

unanswered

Submit

Some problems have options such as save, reset, hints, or show answer. These options follow the Submit
button.

Multiple Choice with Hints and Feedback

1 point possible (graded)

Due to the way Department of Defense networks are configured, in the National Guard, the
approach is focused on ________________________.

enterprise management

firewall management

departmental specialization

unanswered

Submit

Some problems have options such as save, reset, hints, or show answer. These options follow the Submit
button.

Multiple Choice with Hints and Feedback

1 point possible (graded)

When he says, "Our battlefield is at the front line of every corporate network," Walsh means
_______________________________.

the military focus should be only on protecting industry, because that is where the main
threat lies.

the sectors of our country are inescapably connected by cyber threat.

unanswered

Explore and Discuss: U.S. Military Strategy

  Bookmark this page

This course employs a U.S.-centric approach. Here is a chance to look at the United

States' Department of Defense's public strategy (2015) at a high level, integrating some of
Col. Walsh's insights into your examination.

We can also, here in Discussion, ask for international perspectives. If you are a student
from a country other than the U.S., how does this strategy's core components and tone
compare to that of your home country (if a similar strategy is made public)?

Discuss: After viewing the interview with Col. Walsh, then reading this DoD strategy at a
high level, what is noticeable? To start, examine what the document and Col. Walsh say
about the military's core mission.

Respond to at least two peers.

Sector Overview Matrix - Adding Military

 Bookmark this page

1. Using the template provided earlier, either add to or create a fresh Government matrix
overview of your impressions after viewing the interview with Mike Hamilton. Then, participate
in the peer and self-assessment exercise.
2.
PEER AND SELF-EVALUATION OF MATRIX - MILITARY

This assignment has several steps. In the first step, you'll provide a response to the prompt. The
other steps appear below the Your Response field.

1. Your Response
due Jan 1, 2029 05:45 +0545 (in 10 years, 8 months)IN PROGRESS

Enter your response to the prompt. You can save your progress and return to complete
your response at any time before the due date (Monday, Jan 1, 2029 05:45 +0545). After
you submit your response, you cannot edit it.
1. The prompt for this section
This Module, you continue the core assessment of the course - your peer and self-
evaluation of your building matrix of observations about the sector interviews. We
continue with Military. In this open response assignment, follow the steps carefully.
Either upload a PDF version of your matrix, or a summary of the category responses for
peer and self-evaluation. Use the provided Rubric to assess two peers.
Your response (required)

Your Takeaway Matrix

 Bookmark this page

After viewing ALL videos, compare and contrast the commonalities and differences in the tool kits
needed for each sector.

Synthesize your own takeaways from each sector (you can use the template below or create your own),
then participate in a final course discussion.

In the Discussion, tell your peers: My takeaway from the course videos and resources has led me to think
I might be most compatible with _______________(sector). Or, explain why you have not been able to
narrow to any particular sector. Where do you see yourself going?

Respond to at least two peers.

SECTOR Entrance requirements as I Core mission and Highlights and

perceive them/compare to my how I could see Challenges of this
own preparedness and interest myself operating Sector
within it
 

Private      
industry

Government      

Military