• Course title: 1.1 Organisational Theory and Change (Théorie des organisations et du changement)
• Number of ECTS: 2
• Course code: MPMSSI-72
• Module(s): Module 1 : Understanding Organisations & Management (Compréhension des organisations et du management)
• Language: EN
• Mandatory: Yes

Define the characteristics of the organizational context within which security management is deployed Provide insight into the different components of the organization, their respective roles and their interrelations Identify the organizational changes related to security management, and how to manage these as well as the socio organizational risks Understand the challenges of security management in terms of sense-making within the organizations

The course aims to develop your understanding of the organizational context. It focuses on the structure (organizational configurations), types of strategies and corporate culture that characterize an organization. Content : Class 1 : What is an organization ? Which configuration ? Class 2 : What is Corporate Strategy ? What are the links between Strategy, Information systems and the organizational structure ? Class 3 : What is change and how does it work ? What are the socio organizational risks related to security management ?

Group oral presentation and supporting documentation: Case study analysis of an organizational situation, using the theoretical frameworks seen in class.

Oral presentations, PowerPoint presentations, Videos, case studies Pichault, F. (2013), Change management : Towards polyphony, Manager RH (Coll), De Boeck, 182p Pichault, F., & Schoenaers, F. (2003), "HRM practices in a process of organizational change: A contextualist perspective", Applied Psychology, 52 (1), 120-143 K.Laudon & J.P. Laudon (2014) Management Information Systems, Global Edition, 13E, Pearson Education

• Course title: 2.1 Legal and Regulatory Aspects (Aspect légaux et réglementaires)
• Number of ECTS: 3
• Course code: MPMSSI-46
• Module(s): Module 2 : Regulatory Frameworks (Cadres réglementaires)
• Language: EN
• Mandatory: Yes

Create good legal reflexes, enable students to identify / flag (for further analysis / resolution by management / legal counsels) potential legal or regulatory issues linked to their function / duties or information security in general.

General introduction (laws, regulations, courts) IT law fundamentals Liability principles Contract law principles, pre-contractual arrangements Study of usual IT contracts (development, license, maintenance, escrow) Intellectual propoerty basics Criminal law and IT crime Personal data protection law principles Employee IT monitoring IT investigations and inforensics rules IT security statutory obligations Forthcoming EU / Luxembourg rules

Students are evaluated based on a paper they submit (response to case studies and questionnaire)

Slides Relevant Luxembourg / EU laws (IT security, data protection, cybercrime)

• Course title: 3.1 Information Security Management System – IMS (Systèmes de Management de la Sécurité de l'Information – SMSI)
• Number of ECTS: 2
• Course code: MPMSSI-49
• Module(s): Module 3 : Information Security Management (Gestion de la sécurité de l'information)
• Language: EN
• Mandatory: Yes

To understand ISO/IEC 27001, its structure and its requirements To have the same interpretation of the requirements and “speak the same language” To have a first view on “how” to comply with the different requirements To be able to define an action plan towards compliance

The ISO/IEC 27001 standard  o   Overview of the standard ISMS establishment and management  o   Definition of an ISMS establishment and management project Context and objectives Document management Leadership  o   Commitment, policy and roles & responsibilities Performance evaluation o   Indicators, internal audit and management review Improvement o   Nonconformity and corrective action and incident management Risk management o   Risk assessment o   Risk treatment Information security policy(ies) and procedures Conclusions and work plan

Written exam based on a questionnaire

Slideshow in a PDF file ISO/IEC 27001. Information technology – Security techniques – Information security management systems – Requirements. International Organization for Standardization, Geneva, 2005. Management de la sécurité de l'information. Implémentation ISO 27001, Alexandre Fernandez-Toro, Eyrolles, 2012. N. Mayer, "A Cluster Approach to Security Improvement according to ISO/IEC 27001", 17th European Systems & Software Process Improvement and Innovation Conference (EUROSPI'10), Grenoble, France, September 2010. T. Valdevit, N. Mayer, and B. Barafort, "Tailoring ISO/IEC 27001 for SMEs: A Guide to Implement an Information Security Management System in Small Settings", 16th European Systems & Software Process Improvement and Innovation Conference (EUROSPI'09), Alcala, Spain, September 2009

• Course title: 3.2 Risk Analysis and Management (Analyse et gestion de risques)
• Number of ECTS: 2
• Course code: MPMSSI-50
• Module(s): Module 3 : Information Security Management (Gestion de la sécurité de l'information)
• Language: EN
• Mandatory: Yes

To introduce the concepts of risk regardless of context To highlight the socio-cultural aspects of risk perception and its (empirical) assessment methods To master the set of concepts related to Information System Security Risk Management (ISSRM) To have the theoretical background to ease the understanding of risk management methods To understand the ISO/IEC 27005:2011 standard To have a pragmatic and ready-to-use view of the standard

* Introduction to risk management Perception of risk and risk management in general Influence of socio-cultural risk perception Empirical methods Endogenous and exogenous threats Illustration based on examples * Introduction to information security risk management * Outline of information security risk management concepts Asset Risk Risk treatment * Metrics of information security risk management * The ISO/IEC 27005:2011 process and its underlying activities Context establishment Risk identification Risk analysis Risk evaluation Risk treatment Risk acceptance Risk communication and consultation Risk monitoring and review

Project on a case study

Slideshow in a PDF file ISO/IEC 27005. Information technology – Security techniques – Information security risk management. International Organization for Standardization, Geneva, 2008. Gestion des risques en sécurité de l'information – MIse en oeuvre de la norme ISO 27005, Anne Lupfer, Eyrolles, 2010 N. Mayer, "Model-based Management of Information System Security Risk", Presses universitaires de Namur, April 2009. ISBN: 978-2870376409. E. Dubois, P. Heymans, N. Mayer, and R. Matulevicius, "A Systematic Approach to Define the Domain of Information System Security Risk Management", Book Chapter in: S. Nurcan et al. (eds.), "Intentional Perspectives on Information Systems Engineering", Springer-Verlag, 2010. ISBN: 978-3-642-12543-0.

• Course title: 3.3 Risk Analysis Practices (Pratiques d'analyse de risques)
• Number of ECTS: 1
• Course code: MPMSSI-87
• Module(s): Module 3 : Information Security Management (Gestion de la sécurité de l'information)
• Language: EN
• Mandatory: Yes

• Course title: 4.1 Information Security 1 (Technologies de la sécurité 1)
• Number of ECTS: 2
• Course code: MPMSSI-51
• Module(s): Module 4 : Technical Aspects (Aspects techniques)
• Language: EN
• Mandatory: Yes

Understand the basic concepts of modern cryptography such as: confidentiality, integrity and authentication, public and private key cryptography.  Study the principles of operation of basic cryptographic algorithms: block ciphers, stream ciphers, hash functions, message authentication codes, public-key encryption and digital signatures. Become familiar with the most widely used cryptographic standards: AES, DES, SHA,  RSA, DSA, etc. – Given certain security requirements, be able to propose solutions using current best practices and state-of-the-art cryptographic standards. 

The course teaches the fundamental security components used as building blocks in modern security technologies. The material is divided in two parts. One part covers the basics of public-key cryptography: public-key encryption, digital signatures, etc. The second part is dedicated to symmetric-key cryptography and discusses topics such as stream ciphers, block ciphers, hash functions and message authentication codes. A brief outline of the covered topics follows. Overview of cryptography Introduction to public-key cryptography Public key encryption- Digital signatures Introduction to symmetric-key cryptography Block ciphers, stream ciphers Hash functions, Message authentication codes Real life applications

Written exam

Lecture slides and lecture notes William Stallings, Cryptography and Network Security (5th edition) Keith M.Martin, Everyday Cryptography Alfred Menezes, Scott Vanstone, Paul van Oorschot, The Randbook of Applied Cryprography : http:\\cacr.uwaterloo.ca/hac/

• Course title: 6.1 Working in Information Security Management (Le métier de responsable de la sécurité de l'information)
• Number of ECTS: 1
• Course code: MPMSSI-52
• Module(s): Module 6 : Professional Part (Volet professionnel)
• Language: EN
• Mandatory: Yes

Provide a feedback on the field job of a Chief Information Security Officer Provide practical tools and techniques in order to become efficient Explain common threats in order to avoid professional mistakes

Introduction – Background & expenses as a CISO CISO – Different pathways CISO – The multiple facets CISO – Strengths and obstacles CISO – A 360° organizational cleverness CISO – Good communication for effective awareness CISO – Methods & Tools. The global paradigm & combination CISO – The importance of Risk Management CISO – An ordinary day Conclusion – For a future Chief Information Security Officer

Evaluation based on a project

• Course title: 1.2 Enterprise architecture – A digital transformation governance instrument
• Number of ECTS: 3
• Course code: MPMSSI-95
• Module(s): Module 1 : Understanding Organisations & Management (Compréhension des organisations et du management)
• Language: EN
• Mandatory: Yes

1. Define the role of enterprise architecture as a mean to bridge the multiple perspectives on the enterprise (strategy, business, technology, security, …)2. Provide insight into the different elements of enterprise architecture, and the standards in terms of framework and language 3. Apply EA process and practices to manage enterprise information security risks, and to govern enterprise transformation4. Understand knowledge management concepts and technology, and the links with enterprise architecture5. Explore the technical challenge of enterprise architecture as a hub connecting the various enterprise models

The need and the challenges to structure the enterprise knowledge are understoodThe value of enterprise models in security risk management is recognizedThe standard frameworks are practically applied on a case study

Each lecture addresses a different aspect of enterprise architecture On the need of enterprise architecture descriptionEA in the context of security risk analysis Relevant views on the enterprise – Participative sessionEA objectivesProject kickoffOn the need of a framework to standardize enterprise descriptionISO42010 and frameworksIndustry models – participative sessionTOGAF in practiceProject objectivesOn the need of a language for enterprise descriptionArchiMate standardArchiMate and ISO42010Return on Modelling EffortProject objectivesOn the need of coherence in enterprise descriptionModelling languages – participative sessionModels and ISO42010EA as a models hubProject objectivesOn the need to structure the enterprise knowledgeData, information and knowledgeNetwork of models and megamodellingModel management infrastructureEA, an instrument for EKMEA as an instrument for enterprise transformation governance Recap on our journey in the world of EAReflection on the link with security risk analysis

Personal project – deliverable and presentation

TOGAF standardArchiMate standard ISO/IEC/IEEE 42010:2022

• Course title: 1.3 Financial Management (Gestion financière)
• Number of ECTS: 1
• Course code: MPMSSI-74
• Module(s): Module 1 : Understanding Organisations & Management (Compréhension des organisations et du management)
• Language: EN
• Mandatory: Yes

Students get familiar with fundamental tools of financial management: financial reporting, planning, and capital budgeting. Any person who manages investments and risks must be familiar with these concepts.Understand fundamental concepts of financial accounting, especially the annual accounts (balance sheet, income statement, cash-flow statement) as well as the main value drivers and forecasting techniques.Understand some fundamentals of financial management: project financing, financial leverage, cost of capital, and valuation.

I. Financial reporting1. Firms’ disclosure of financial information 2. The balance sheet 3. The income statement4. The statement of cash flows 5. Other financial statement informationII. Financial planning and capital budgeting1. Forecasting earnings2. Determining free cash flow and NPV3. The discounted free cash flow model 

The assessment is continuous. It is based on course work, especially practical exercises, multiple-choice tests, and case study presentations related to students’ professional activity in the field.

SlidesFor those interested interested in deepening the subjects (not mandatory literature): Financial Accounting for Decision Makers, Dr. Peter Atrill, Eddie McLaney (authors), Pearson, 2013 (seventh edition) Financial Management for Decision Makers, Dr. Peter Atrill, Pearson, 2014 (seventh edition)

• Course title: 1.5 IT Service Management (Gestion des services IT)
• Number of ECTS: 1
• Course code: MPMSSI-75
• Module(s): Module 1 : Understanding Organisations & Management (Compréhension des organisations et du management)
• Language: EN
• Mandatory: Yes

Students get familiar with fundamental tools of financial management: financial reporting, planning, and capital budgeting. Any person who manages investments and risks must be familiar with these concepts. •Understand fundamental concepts of financial accounting, especially the annual accounts (balance sheet, income statement, cash-flow statement) as well as the main value drivers and forecasting techniques. •Understand some fundamentals of financial management: project financing, financial leverage, cost of capital, and valuation. 

I. Financial reporting1. Firms’ disclosure of financial information 2. The balance sheet 3. The income statement4. The statement of cash flows 5. Other financial statement informationII. Financial planning and capital budgeting1. Forecasting earnings2. Determining free cash flow and NPV3. The discounted free cash flow model 

The assessment is continuous. It is based on course work, especially practical exercises, multiple-choice tests, and case study presentations related to students’ professional activity in the field.

Suggested readings for those who are interested in the topics in more detail: Corporate Finance, Berk-DeMarzo, Pearson (fifth edition), Chapters 2, 8, and 9Financial Accounting for Decision Makers, Atrill-McLaney, Pearson, (sixth edition), Chapters 1-6Financial Management for Decision Makers, Atrill, Pearson, (ninth edition), Chapters 2, 3, and 4

• Course title: 2.2 Law Enforcement (Mise en application des dispositions légales)
• Number of ECTS: 2
• Course code: MPMSSI-77
• Module(s): Module 2 : Regulatory Frameworks (Cadres réglementaires)
• Language: EN
• Mandatory: Yes

Students should get familiar with the legal and procedural environment of criminal investigations Students should also become familiar with good practices and learn about the specific procedural difficulties encountered by law enforcement bodies during (computer) investigations Students should eventually become familiar with the specific problems linked to gathering and reporting digital evidence

Part I. Criminal procedure and investigations 1.  Law enforcement bodies 2.  General prinicples of criminal investigations 3.  Specific procedures       – Police investigation       – Emergency procedure       – Judicial examination       – Access to telecommunication data       – Legal interception 4.  Specific aspects of obtaining digital evidence 5.  International police cooperation 6.  Mutual legal assistance Part II. Digital forensics 1. Good practice 2. Acquisition of numeric information 3. Authentification of  digital evidence 4. Analysis of digital evidence and reporting 5. Professional software 6. Practical examples and visit

Written exam (questionnaire) Short questions or multiple choice. No documentation is allowed. The questionnaire is based on the course contents and the course handouts.

Handouts of powerpoint presentations Official texts and good practice guides are provided as PDF files.

• Course title: 2.3 Special Businesses and Impacts (Spécificités du secteur financier)
• Number of ECTS: 2
• Course code: MPMSSI-91
• Module(s): Module 2 : Regulatory Frameworks (Cadres réglementaires)
• Language: EN
• Mandatory: Yes

• Course title: 4.2 Information Security Technologies 2 (Technologies de la sécurité 2)
• Number of ECTS: 2
• Course code: MPMSSI-79
• Module(s): Module 4 : Technical Aspects (Aspects techniques)
• Language: EN
• Mandatory: Yes

The course is about the main fundamental security components/technologies that are basic blocks used in most of security solutions. A first part of the course is dedicated to cryptography and the second one is about secured platforms.This second part is about public key infrastructures and how to build secure component-based platforms

Content :A.PKI applicationsPublic key infrastructureAuthentication protocolsApplication to the financial sectorCase studyB.Architectures the secure platformsModern web architecturesThe different technical levels for securing a platformImplementation of a component-based system embedding security policiesCase study

Written exam

• Course title: 4.3 Communication, Information Processing and Persistence 1 (Communication, traitement et persistances des informations 1)
• Number of ECTS: 2
• Course code: MPMSSI-80
• Module(s): Module 4 : Technical Aspects (Aspects techniques)
• Language: EN
• Mandatory: Yes

Information systems combine three dimensions that must be independently and globally secured from a systemic viewpoint; the communication aspect (classical and dynamic networks), treatments (software, business logic), and persistency (databases and data storage). The objectives of this course can be formulated as: Apprehend the different parameters impacting network and communication security.Understand the software layer and be familiar with the safe and secure design and deployment of software.

An overview of security and safety challenges and solutions for network communication and software development.

This course treats the technological means that are available or required to secure the communication between users over a hostile network, software and information systems. This course will cover but not be limited to the topics listed below: Introduction to computer networks and protocolsISO/OSI layered communication modelVirtual private networksIPSec, Firewalls, SSL/TLSIntrusion detectionE-mail securitySecurity protocolsWeb securityUser authenticationViruses/malware, RFID security, attack trees (optional)

Evaluation based on practices and assignments

The lectures and lecture notes are partly based on the following textbooks: W. Stallings, L. Brown, Computer Security – Principles and PracticeW. Stallings, Network Security Essentials – Applications and StandardsD. Gollmann – Computer SecurityC.P. Pfleeger and S.L. Pfleeger – Security in Computing

• Course title: 1.4 Project Management (Gestion des projets)
• Number of ECTS: 2
• Course code: MPMSSI-82
• Module(s): Module 1 : Understanding Organisations & Management (Compréhension des organisations et du management)
• Language: EN
• Mandatory: Yes

Donner aux étudiants les clés pour comprendre l'intérêt du mode projet Donner aux étudiants les capacités de décision d'activation et de choix des modalités du mode projet Donner aux étudiants les fondamentaux conceptuels et pratiques leur permettant de mettre en œuvre le mode projet dans leur activités relatives à la sécurité de l'information

Histoire de la gestion de projet Pourquoi le mode projet Les différents référentiels / méthode / certifications de gestion de projet à disposition Exemple de contexte : Le référentiel projet GISSIP de la DCSSI (France) Agile project Management : Theory and Planning Game  

Home exam

• Course title: 3.4 Security Policy (Politique de sécurité)
• Number of ECTS: 2
• Course code: MPMSSI-83
• Module(s): Module 3 : Information Security Management (Gestion de la sécurité de l'information)
• Language: EN
• Mandatory: Yes

• Course title: 3.5 Compliance Assurance (Assurance de la conformité)
• Number of ECTS: 2
• Course code: MPMSSI-84
• Module(s): Module 3 : Information Security Management (Gestion de la sécurité de l'information)
• Language: EN
• Mandatory: Yes

• Course title: 4.4 Communication, Information Processing and Persistence 2 (Communication, traitement et persistance des informations 2)
• Number of ECTS: 4
• Course code: MPMSSI-94
• Module(s): Module 4 : Technical Aspects (Aspects techniques)
• Language: EN
• Mandatory: No

The course aims at presenting design techniques to develop a secure software integrating persistency. The course is two-fold : the first part is about modeling, development and testing of software (including security policies); the second one about secured databases. We thus introduce software engineering techniques for security.Modelling will be done with UML standard, that will be briefly presented, as well as the link with programming. The student will understand the main challenges for efficient implementation of a maintainable security policy (access control, XACML standard)

A.Design and validation for safety and security Design methods for designing software and architecturesSecurity policies and their deploymentSoftware functional testingSoftware security testingB.Secured databases Architectures for persistency (databases, cloud, datacenters)Securing a databasePerformance, robustness and security testing of databasesUse case :A practical case will be (partly) implemented in Java (e.g. Auction system) or an Android application

Evaluation via practical work and questionnaires

Lectures (24hrs), personal work (72hrs)

• Course title: 4.5 Threats, Attacks and Controls (Menaces, attaques et parades)
• Number of ECTS: 2
• Course code: MPMSSI-86
• Module(s): Module 4 : Technical Aspects (Aspects techniques)
• Language: EN
• Mandatory: Yes

Understand common web vulnerabilities, their impact on security properties, and how to fix them, prevent them. Acquire the ability to exploit web vulnerabilities through tools or manually.

SQL Injection & other injection flaws in theory and in practice. Cross Site Scripting theory and practical exploitation. Common web application vulnerabilities. Web application auditing methodology.Self-teaching ressources and material.

Practical exam on real-world vulnerability discovery and exploitation

Virtual machines, online ressources.Web applications Hacker Handbook, OWASP Top 10, OWASP Wiki

• Course title: 5.1 Human Risk (Risque humain)
• Number of ECTS: 2
• Course code: MPMSSI-68
• Module(s): Module 5 : Human Aspects (Aspects humains)
• Language: EN
• Mandatory: Yes

Introduce and familiarise course participants with basic principles and properties of:Human information processing: What are the basic principles of human perception and cognition?Human risk-taking behavior: Under which circumstances do people engage in risky behavior? Persuasion and manipulation in social interactions: What are the best-known strategies in social engineering? How to identify social engineering attacks? How to avoid these attacks?

Theories and models of human information processing ‘Basics’: Human sensation and perception 'Higher cognitive functions’: thinking, remembering, problem-solving ‘Regulatory mechanisms’: Emotion, motivation and their effects on behavior ‘Outcome’: Human behavior  Principles of social interaction Human behavior in groups Leadership and the influences of authorities ‘Tit-for-tat’: Reciprocity in interactions Influence and persuasion in social interactions Social engineering: A novel social phenomenon in information security General aspects: Communication and elicitation Methods: Interviews and interrogation Influence: persuasion, playing with limited attention Counteractive measures: identifying social engineering attacks, raising personal security awareness, learning how to respond properly

Oral presentation of a selected topic from the field of human risks (small groups up to four students: 60%), written exam based on a questionnaire (individual: 40%)

Powerpoint presentations, video clips, handouts, group discussionsCialdini, R. (2001). Influence. Science and practice. Boston, MA: Pearson Education, Inc.Hadnagy, C. (2011). Social Engineering: The art of human hacking. Indianapolis, IN: John Wiley & Sons Ltd.Levine, R. (2003). The power of persuasion: how we’re bought and sold. Hoboken, NJ: John Wiley & Sons.Wickens, C. D., Lee, J. D., Liu, Y., & Gordon Becker, S. E. (2004). An introduction to human factors engineering. Upper Saddle River, NJ: Pearson Education, Inc.

• Course title: 3.6 Business Continuity Management (Gestion de la continuité)
• Number of ECTS: 1
• Course code: MPMSSI-70
• Module(s): Module 3 : Information Security Management (Gestion de la sécurité de l'information)
• Language: EN
• Mandatory: Yes

• Course title: 5.2 Human Communication (Communication humaine)
• Number of ECTS: 2
• Course code: MPMSSI-71
• Module(s): Module 5 : Human Aspects (Aspects humains)
• Language: EN, FR
• Mandatory: Yes

Explore the fundamental principles and attributes of your communication style Get an overview of relevant approaches, models and components of human communication Summarise the challenges related to communication issues in everyday life, institutional and work contexts Apply the fundamental principles and components of human communication to a work context. Analyse the communication process in a corporate activity system.

My communication profileEssentials of communicationWhat is Communication?Components of CommunicationCommunication PrinciplesHow Does Communication Occur?What are Communication Contexts?Purposes of communicationSelected models of communicationVerbal and non-verbal communicationPerception, Self and CommunicationCommunication within corporate activity systems

Case study (individual paper)

Lecture support : Set of slides to download from the related moodle space   Literature :   Iyamu, T. & Shaanika, I. (2019). The use of activity theory to guide information systems research. Education and Information Technologies, 24:165–180 https://doi.org/10.1007/s10639-018-9764-9 Research Group on Socio-Digital Systems (2011). Things we have learnt about communication. Issue 1. Microsoft Corporation. Online available at: http://research.microsoft.com/en-us/projects/thingswevelearnt/things_issue1.pdf Russell, D. (2001). Looking beyond the interface: Activity theory and distributed learning. In M. Lea & K. Nicoll (Eds.). Distributed learning (pp. 64-82). New York: Routledge Falmer. Online available at: http://www.public.iastate.edu/~drrussel/drresume.html

• Course title: 6.3 Professional Project (Projet professionnel)
• Number of ECTS: 14
• Course code: MPMSSI-81
• Module(s): Module 6 : Professional Part (Volet professionnel)
• Language: EN
• Mandatory: Yes

Travailler sur un projet au choix de l'étudiant et sous la direction d’un tuteur, qui est aussi un enseignant de la formation. Rédiger un mémoire de Master en relation avec le projet professionnel affecté à l’étudiant par l’équipe pédagogique. Comprendre l'intérêt des apports académiques dans les pratiques professionnelles Se familiariser avec la mise en pratique des connaissances acquises   Exercer sur le terrain une responsabilité de la sécurité de l'information

Sujet et contenu, à définir par l'étudiant et ses encadrants académiques et professionnels lors du lancement du project

rapport de projet et défense oral

L'étudiant est leader sur son projet professionnel et se conforme aux indications données dans le guide du projet professionnel Supports en anglais, projet au choix de l'étudiant, réunions intermédiaires et défense en anglais par défaut ou dans la langue commune

• Course title: 6.2 Security Emerging Technologies
• Number of ECTS: 3
• Course code: MPMSSI-93
• Module(s): Module 6 : Professional Part (Volet professionnel)
• Language: EN
• Mandatory: Yes