Digital Reading Room 2.0 -- ECAM 600: Cybersecurity Awareness and Management in Business

ECAM 600: Cybersecurity Awareness and Management in Business Report a Broken Link

This course aims to equip students with a comprehensive understanding of cybersecurity and privacy concepts, principles, frameworks, and strategies. Students will develop practical skills necessary to assess risks, establish effective governance structures, and develop strategies to safeguard critical assets across various sectors. Students will also learn how cybersecurity has evolved from a technical concern to a fundamental business enabler, with leadership directly responsible for managing privacy and information security risks.

Lesson 1

Case Study

Dubé, L. (2016, March). Autopsy of a data breach: The Target case. International Journal of Case Studies in Management, 14(1).

Supplementary Readings

Craigen, D., Diakun-Thibault, N., & Purse, R. (2014). Defining cybersecurity. Technology Innovation Management Review, 4(10), 13–21. https://doi.org/10.22215/timreview/835

Fruhlinger, J. (2019, December 5). What is cybersecurity? Types, careers, salary, and certification. CSO Online. https://www.csoonline.com/article/568119/what-is-cyber-security-types-careers-salary-and-certification.html

Heichler, E. (2025, Winter). Deepfake anxiety in the C-suite. MIT Sloan Management Review, 66(2). https://sloanreview.mit.edu/article/deepfake-anxiety-in-the-c-suite/

Hepfer, M., Chatterjee, R., & Smets, M. (2024, May 1). The CEO’s cyber resilience playbook. MIT Sloan Management Review, 65(4), 70–76. https://sloanreview.mit.edu/article/the-ceos-cyber-resilience-playbook/

Hepfer, M., & Powell, T. C. (2020, September 8). Make cybersecurity a strategic asset. MIT Sloan Management Review, 62(1), 40–45. https://sloanreview.mit.edu/article/make-cybersecurity-a-strategic-asset/

National Institute of Standards and Technology. (2024). The NIST Cybersecurity Framework (CSF) 2.0. U.S. Department of Commerce. https://doi.org/10.6028/NIST.CSWP.29

Rothrock, R. A., Kaplan, J., & Van der Oord, F. (2017, November 16). The board’s role in managing cybersecurity risks. MIT Sloan Management Review, 59(2), 12–15. https://sloanreview.mit.edu/article/the-boards-role-in-managing-cybersecurity-risks/

Segalla, M., & Rouziès, D. (2023). The ethics of managing people’s data. Harvard Business Review, 101(4), 134–141. https://hbr.org/2023/07/the-ethics-of-managing-peoples-data

von Solms, B., & von Solms, R. (2018). Cybersecurity and information security – what goes where? Information and Computer Security, 26(1), 2–9. https://doi.org/10.1108/ICS-04-2017-0025

Lesson 2

Case Study

Duta, A., & Hedges, P. (2025, August 14). Alberta Dental Service Corporation: Responding to a cyberattack crisis [Case study]. Ivey Publishing.

Supplementary Readings

Dimitriadis, C. (2026, January 28). Strengthening cyber standards for a resilient defense industrial base. Forbes. https://www.forbes.com/councils/forbestechcouncil/2026/01/28/strengthening-cyber-standards-for-a-resilient-defense-industrial-base/

Fortinet. (2026a). Data security: Definition, importance, and types. https://www.fortinet.com/resources/cyberglossary/data-security

Fortinet. (2026b). Types of cyber attacks: Top 20 threats & prevention strategies. https://www.fortinet.com/resources/cyberglossary/types-of-cyber-attacks

Giboney, J. S., Schuetzler, R. M., & Grimes, G. M. (2023). Know your enemy: Conversational agents for security, education, training, and awareness at scale. Computers & Security, 129. https://doi.org/10.1016/j.cose.2023.103207

Hernandez, J. C. (2025, September 27). What are cyber threats? Types, examples, and prevention strategies. Prey Project. https://preyproject.com/blog/cyber-threats

Moore, M. (2026). Top cybersecurity threats to watch in 2026. University of San Diego. https://onlinedegrees.sandiego.edu/top-cyber-security-threats/

Ravichandran, H. (2023, March 15). How AI is disrupting and transforming the cybersecurity landscape. Forbes. https://www.forbes.com/councils/forbestechcouncil/2023/03/15/how-ai-is-disrupting-and-transforming-the-cybersecurity-landscape/

Waelchli, S., & Walter, Y. (2025). Reducing the risk of social engineering attacks using SOAR measures in a real-world environment: A case study. Computers & Security, 148. https://doi.org/10.1016/j.cose.2024.104137

Lesson 3

Supplementary Readings and Videos

Afshari-Mofrad, M., Amrollahi, A., & Abedin, B. (2024). Adopt agile cybersecurity policymaking to counter emerging digital risks. MIS Quarterly Executive, 23(4), Article 3. https://aisel.aisnet.org/misqe/vol23/iss4/3

Almond Consulting. (2024, December 11). Introduction to insider threats: The #1 cybersecurity risk (and how to stop them)!!! [Video]. YouTube. https://www.youtube.com/watch?v=UrskIYRjoww

Dominion Risk. (2024, March 4). Trust but verify: The insider threat challenge [Video]. YouTube. https://www.youtube.com/watch?v=7wNnuL5oZDo

Exabeam. (2020, September 11). What are insider threats and how do we classify them? [Video]. YouTube. https://www.youtube.com/watch?v=fEw08Npmm2w

Imperva, a Thales Company. (2017, July 5). Challenges of detecting insider threats - Whiteboard Wednesday [Video]. YouTube. https://www.youtube.com/watch?v=0z4ausiqLgg

Moore, M. (2026). Top cybersecurity threats to watch in 2026. University of San Diego. https://onlinedegrees.sandiego.edu/top-cyber-security-threats/

Robinson, R. J. (2025). Human factor in cybersecurity: Insider kill chain risks for corporate security. 2025 International Conference on Electronics, Communications, and Energy Research (ICECER). https://doi.org/10.1109/ICECER65523.2025.11400888

Security Researcher. (2025, February 9). Why insider threats are destroying companies (and you don't know it) [Video]. YouTube. https://www.youtube.com/watch?v=795-KmeUEhc

Tridgell, J. (2025). Open or closing doors? The influence of ‘digital sovereignty’ in the EU’s cybersecurity strategy on the cybersecurity of open-source software. Computer Law & Security Review, 56. https://www.sciencedirect.com/science/article/pii/S0267364924001444

Lesson 4

Case Study

Rahrovani, Y., Arashad, A., & Robert, L. (2025, June 3). Robots on patrol and on plates: Contrasting tales of deployment [Case study]. Ivey Publishing.

Supplementary Readings

Abhari, K., Safaei Pour, M., & Shirazi, H. (2024). How to design a better cybersecurity readiness program. MIS Quarterly Executive, 23(4). https://aisel.aisnet.org/misqe/vol23/iss4/8

Alashoor, T., Boodraj, M., Quintanilha, A., Palme, S., & Aldawood, H. (2025, March). Insights on how data privacy officers can build a corporate privacy culture. MIS Quarterly Executive, 24(1), Article 6. https://aisel.aisnet.org/misqe/vol24/iss1/6

Datta, P., & Acton, T. (2025). Promises and perils of generative AI in cybersecurity. MIS Quarterly Executive, 24(2). https://aisel.aisnet.org/misqe/vol24/iss2/5/

Heichler, E. (2025, Winter). Deepfake anxiety in the C-suite. MIT Sloan Management Review, 66(2). https://sloanreview.mit.edu/article/deepfake-anxiety-in-the-c-suite/

iTnews. (2026). State of security 2026: Cyber resilience. https://www.itnews.com.au/state-of-security-2026/state-of-security-2026-cyber-resilience-625425

Manari, U., Ngobeni, S., Letshwenyo, M., Baruni, K., Ndhlovu, N., & Senamela, P. (2024). Towards a comprehensive cybersecurity information sharing framework. Proceedings of the 24th European Conference on Cyber Warfare and Security, 24(1). https://doi.org/10.34190/eccws.24.1.3628

Proudfoot, J. G., Cram, W. A., Madnick, S., & Coden, M. (2023). The importance of board member actions for cybersecurity governance and risk management. MIS Quarterly Executive, 22(4). https://aisel.aisnet.org/misqe/vol22/iss4/6/

Štaffenová, N., Dupáková, D., & Kubina, M. (2026). Integration of ISMS into the organization’s strategy and its impact on security culture in the digital environment. Administrative Sciences, 16(1). https://www.mdpi.com/2076-3387/16/1/26

Stevens, E. (2026). 13 essential cybersecurity frameworks, standards and regulations explained. Bitsight. https://www.bitsight.com/blog/7-cybersecurity-frameworks-to-reduce-cyber-risk

Ungo, R., Díaz, R., & Singh, B. (2024). Developing a framework to evaluate the cyber-protection of the information sharing across different types of supply chain governance. Journal of Information Warfare 23(4), 72–88. https://www.jstor.org/stable/27384422

Other References

Associated Press. (2018, March 2). Georgia punishes Delta for crossing the NRA; airline insists it’s ‘not taking sides.’ Los Angeles Times. https://www.latimes.com/business/la-fi-delta-nra-20180302-story.html

Lesson 5

Case Study

Levy, D., & Klinger, M. (2025, August 26). Inbox intervention: Should AI help clinicians respond to patients? [Case study]. Harvard Kennedy School.

Supplementary Readings

Clemons, J., Gellner, T., & Bruce, V. (2024, May/June). Crafting the right IT/OT cybersecurity strategy. Control Engineering, 42–43. https://bt.e-ditionsbyfry.com/publication/?i=824852&p=50&view=issueViewer

Gorkhali, A., Chowdhury, R., & Diouf, F. (2025). Does strategically aligned investment in cybersecurity systems reduce data breaches? Pacific Asia Journal of the Association for Information Systems, 17(2), 76–95. https://aisel.aisnet.org/pajais/vol17/iss2/4/

Hussain, M. K., Rahman, M. M., Soumik, M. S., & Alam, Z. N. (2025). Business intelligence-driven cybersecurity for operational excellence: Enhancing threat detection, risk mitigation, and decision-making in industrial enterprises. Journal of Business and Management Studies, 7(6), 39–52. https://doi.org/10.32996/jbms.2025.7.6.5

Kreps, S., & Arsenault, A. C. (2023, April 14). What business needs to know about the new U.S. cybersecurity strategy. Harvard Business Review. https://hbr.org/2023/04/what-business-needs-to-know-about-the-new-u-s-cybersecurity-strategy

Pearlson, K., Schwartz, J., Sposito, S., & Arbisman, M. (2022). How Verizon Media built a cybersecurity culture. MIS Quarterly Executive, 21(2), 165–181. https://aisel.aisnet.org/misqe/vol21/iss2/6/

Sullivan, J. C., & Saxton, M. (2020, May 13). The 5-step guide to making AI work within your cybersecurity strategy. Security Magazine. https://www.securitymagazine.com/articles/92349-the-5-step-guide-to-making-ai-work-within-your-cybersecurity-strategy

U.S. Government Accountability Office. (2024, June 13). High-risk series: Urgent action needed to address critical cybersecurity challenges facing the nation (GAO-24-107231). https://www.gao.gov/products/gao-24-107231

Wagle, K., Yousuf, S., Alswailem, Y., Almengash, M., & Alturkistani, F. (2022, August 8). Turning a cybersecurity strategy into reality: A holistic performance management framework. Boston Consulting Group. https://www.bcg.com/publications/2022/cybersecurity-performance-management-framework

Lesson 6

Supplementary Readings and Videos

Blackman, R. (2023, May 9). How to avoid the ethical nightmares of emerging technology. Harvard Business Review. https://hbr.org/2023/05/how-to-avoid-the-ethical-nightmares-of-emerging-technology

Candelon, F., Charme di Carlo, R., De Bondt, M., & Evgeniou, T. (2021). AI regulation is coming: How to prepare for the inevitable. Harvard Business Review. https://hbr.org/2021/09/ai-regulation-is-coming-how-to-prepare-for-the-inevitable

Chamorro-Premuzic, T., & Buchband, R. (2020, December 23). If you’re tracking employee behavior, be transparent about it. Harvard Business Review. https://hbr.org/2020/12/if-youre-tracking-employee-behavior-be-transparent-about-it

Chaudhuri, A., Sarkar, S., & Bala, P. K. (2025). Thematic exploration and analysis of cybersecurity policies of businesses: An NLP-based approach. Journal of Organizational Computing and Electronic Commerce, 35(2), 157–187. https://doi.org/10.1080/10919392.2024.2435115

Cynet. (2026, March 5). Creating your cyber security policy: Ultimate 2025 guide. https://www.cynet.com/security-foundations/cybersecurity/creating-your-cyber-security-policy-ultimate-guide/

Educate 360. (2025, April 8). Simplifying cybersecurity policies: A guide to compliance made easy [Video]. YouTube. https://www.youtube.com/watch?v=rKF6_Gzf5wA

Everything Cybersecurity. (2024, July 13). What are cybersecurity policies and procedure? [Video]. YouTube. https://www.youtube.com/watch?v=4vwYi1y6Ahs

Isaeva, E., Seki, M., & Kakinaka, M. (2025). Information system security policy noncompliance: Effects of sanctions and training in public organizations. Pacific Asia Journal of the Association for Information Systems, 17(4), 26–49. https://aisel.aisnet.org/pajais/vol17/iss4/2/

Madnick, S. E. (1978). Management policies and procedures needed for effective computer security. Sloan Management Review, 20(1), 61–74. https://www.proquest.com/docview/1302983575/fulltextPDF/147D27244D9B4E67PQ/7?accountid=8408&sourcetype=Scholarly%20Journals

Sangfor Technologies. (2025, July 10). Don’t get sued: What is a cybersecurity policy & why you need it now. https://www.sangfor.com/glossary/what-is-a-cybersecurity-policy-guide-templates

Skillweed. (2025, September 24). Why cybersecurity policies matter | Policies, procedures, standards & guidelines [Video]. YouTube. https://www.youtube.com/watch?v=ehQXpvh3GdI

Winnefeld, J. A., Jr., Kirchhoff, C., & Upton, D. M. (2015). Cybersecurity’s human factor: Lessons from the Pentagon. Harvard Business Review, 87–95. https://hbr.org/2015/09/cybersecuritys-human-factor-lessons-from-the-pentagon

Lesson 7

Case Study

Rajgopal, S., & Gezer, B. (2019, March 5). The Marriott breach shows just how inadequate cyber risk disclosures are. Harvard Business Review. https://hbr.org/2019/03/the-marriott-breach-shows-just-how-inadequate-cyber-risk-disclosures-are

Supplementary Readings

Alavi, M. (2024, March 25). Research: How different fields are using GenAI to redefine roles. Harvard Business Review. https://hbr.org/2024/03/research-how-different-fields-are-using-genai-to-redefine-roles

Anand, B. N., & Wu, A. (2025). The gen AI playbook for organizations: Where to use it, where not to, and why strategy still wins. Harvard Business Review, 103(6), 118–129. https://hbr.org/2025/11/the-gen-ai-playbook-for-organizations

Barsky, N. P., & Pearlson, K. (2025, May 20). Boards need a more active approach to cybersecurity. Harvard Business Review. https://hbr.org/product/boards-need-a-more-active-approach-to-cybersecurity/H08QDZ-PDF-ENG

Isik, Ö., & Goswami, A. (2024, October 29). Phishing attacks are evolving. Here’s how to resist them. Harvard Business Review. https://hbr.org/2024/10/phishing-attacks-are-evolving-heres-how-to-resist-them

Johnson, V., Maurer, C., Torres, R., Guerra, K., Mohit, H., Srivastava, S., & Chatterjee, S. (2024). The 2023 SIM IT issues and trends study. MIS Quarterly Executive, 23(1), 83–124. https://aisel.aisnet.org/misqe/vol23/iss1/7/

Muhly, F., Jordan, J., Cialdini, R. B., & Neidert, G. P. M. (2025, June 24). Create a company culture that takes cybersecurity seriously. Harvard Business Review. https://store.hbr.org/product/create-a-company-culture-that-takes-cybersecurity-seriously/H08S16

Pearlson, K., & Novaes Neto, N. (2022, March 4). 7 pressing cybersecurity questions boards need to ask. Harvard Business Review. https://hbr.org/product/7-pressing-cybersecurity-questions-boards-need-to-ask/H06W99

Pearlson, K., Sposito, S., Arbisman, M., & Schwartz, J. A. (2021, September 30). How Yahoo built a culture of cybersecurity. Harvard Business Review. https://store.hbr.org/product/how-yahoo-built-a-culture-of-cybersecurity/H06L2J

Roslansky, R. (2023, December 4). Talent management in the age of AI. Harvard Business Review. https://hbr.org/2023/12/talent-management-in-the-age-of-ai

Other References

Cialdini, R. B. (2021). Influence: The psychology of persuasion (New and expanded ed.). Harper Business.

Neidert, G. P. (2008). The core motives approach to understanding social influence. In M. F. Barney, G. P. Neidert, & R. B. Cialdini, Is ethical influence the secret of leadership? [Unpublished manuscript] (pp. 29–35). https://www.asu.edu/courses/pgs461/Neidert's%20Core%20Motives%20Model_Exerpted%20from_Is%20Ethical%20Influence%20the%20Secret%20of%20Leadership_2008_b.pdf

Lesson 8

Supplementary Readings and Videos

All Things Secured. (2024, August 15). Passkeys SUCK (here’s why + how I use them) [Video]. YouTube. https://www.youtube.com/watch?v=_tQbWop1P7o

Antisyphon Training. (2025, October 28). Firewall fundamentals explained | Network security for beginners [Video]. YouTube. https://www.youtube.com/watch?v=K4ilFsm2GvA

BEAA Security Solutions. (2024, November 2). Access control | Strategies for secure systems | Cyber security [Video]. YouTube. https://www.youtube.com/watch?v=cHFldT99mJ4

Brooks, C. (2025, September 9). Data centers facing bold security challenges in 2026 and beyond. SecurityInfoWatch. https://www.securityinfowatch.com/cybersecurity/information-security/article/55310735/data-center-facing-bold-security-challenges-in-2025-and-beyond

IBM Technology. (2025, April 24). How hackers steal passwords: 5 attack methods explained [Video]. YouTube. https://www.youtube.com/watch?v=vKPGZHoHX8k

Ilyas, B., Kumar, A., Ali, S. M., & Lei, H. (2025). Blockchain-enabled IoT access control model for sharing electronic healthcare data. Multimedia Tools and Applications, 84(10), 8127–8148. https://doi.org/10.1007/s11042-024-19266-4

Lingam, K., & Srinivasan, S. (2025). Cybersecurity for virtual work: Preserving virtual workspaces and communication platforms with AI-powered access control and threat detection. 2025 International Conference on Digital Innovations for Sustainable Solutions (ICDISS). https://ieeexplore.ieee.org/document/11320640

Louati, H., Louati, A., Kariri, E., & Almekhlafi, A. (2025). AI-based anomaly detection and optimization framework for blockchain smart contracts. Administrative Sciences, 15(5), 163. https://doi.org/10.3390/admsci15050163

Reddivari, R., Chavan, B. B., & Pandey, B. (2025). AI-integrated identity and access management: Advancing cybersecurity through intelligent access control and continuous authentication. 2025 IEEE Madhya Pradesh Section Conference (MPCON), 505–511. https://ieeexplore.ieee.org/document/11256518

Lesson 9

Supplementary Readings and Videos

AlertMedia. (2024, November 22). Business continuity planning: Strategies to minimize business disruptions [Video]. YouTube. https://www.youtube.com/watch?v=pYCfHQk7538

Brumă, L. M. (2023). Cloud incident response - a comprehensive analysis. Informatica Economică, 27(4), 32–43. https://doi.org/10.24818/issn14531305/27.4.2023.03

Burt, A. (2024, December 4). How to prepare your company for AI incidents. Harvard Business Review. https://hbr.org/2024/12/how-to-prepare-your-company-for-ai-incidents

Canadian Centre for Cyber Security. (2026, January). Developing your incident response plan (ITSAP.40.003). Government of Canada. https://www.cyber.gc.ca/en/guidance/developing-your-incident-response-plan-itsap40003

Canadian Centre for Cyber Security. (2026, January). Developing your IT recovery plan (ITSAP.40.004). Government of Canada. https://www.cyber.gc.ca/en/guidance/developing-your-it-recovery-plan-itsap40004

Canadian Centre for Cyber Security. (2026, January). Ransomware: How to prevent and recover (ITSAP.00.099). Government of Canada. https://www.cyber.gc.ca/en/guidance/ransomware-how-prevent-and-recover-itsap00099

Huang, K., & Madnick, S. (2020, August 14). A cyberattack doesn’t have to sink your stock price. Harvard Business Review. https://hbr.org/2020/08/a-cyberattack-doesnt-have-to-sink-your-stock-price

Online PM Courses - Mike Clayton. (2021, June 23). What is a disaster recovery plan? And how to make one [Video]. YouTube. https://www.youtube.com/watch?v=c2WRVclyFcg

Patel, R. (2023, May 18). Most companies can’t handle cybersecurity alone: Few organizations have the right tools, people, infrastructure, and processes to protect themselves. Harvard Business Review. https://hbr.org/2023/05/most-companies-cant-handle-cybersecurity-alone

Pearlson, K. (2024, July 18). When cyberattacks are inevitable, focus on cyber resilience. Harvard Business Review. https://hbr.org/2024/07/when-cyberattacks-are-inevitable-focus-on-cyber-resilience

ProjectManager. (2019, March 22). How to make a disaster recovery plan - project management training [Video]. YouTube. https://www.youtube.com/watch?v=1zxUnFivL8Q

Rapid7. (2018, April 4). Whiteboard Wednesday: Developing an incident response program [Video]. YouTube. https://www.youtube.com/watch?v=lNVZApNAqjE

Ribeiro, A. (2026, September 15). Cyber-informed engineering shifts critical infrastructure security from protecting networks to engineering out consequences. Industrial Cyber. https://industrialcyber.co/features/cyber-informed-engineering-shifts-critical-infrastructure-security-from-protecting-networks-to-engineering-out-consequences/

Yahalom, R. (2025, January 10). What the 2024 CrowdStrike glitch can teach us about cyber risk. Harvard Business Review. https://hbr.org/2025/01/what-the-2024-crowdstrike-glitch-can-teach-us-about-cyber-risk

Lesson 10

Supplementary Readings and Videos

BPM. (2025, July 18). What is cybersecurity compliance? https://www.bpm.com/insights/blog/what-is-cybersecurity-compliance

Cynet. (2026, March 5). Cybersecurity compliance: 6 steps to security-compliance alignment. https://www.cynet.com/security-foundations/cybersecurity/cyber-security-compliance-6-steps-to-security-compliance-alignment/

Defendify. (2025). 2025 IT and security budget preparation checklist. https://www.defendify.com/blog/cybersecurity-budget-checklist/

EVA BENN | CYBERSECURITY | AI. (2026, June 15). How to stop wasting security budget | Ross Young | Cybersecurity Mondays Season 1 EP 9 [Video]. YouTube. https://www.youtube.com/watch?v=zSKdeYNn2Zg

GetCyber. (2022, June 2). Cyber security planning and budgeting - Ch-3.4 [Video]. YouTube. https://www.youtube.com/watch?v=puGe0JIql5c

Gupta, D. (2025, March 10). Cybersecurity compliance and regulatory frameworks: A comprehensive guide for companies. https://guptadeepak.com/cybersecurity-compliance-and-regulatory-frameworks-a-comprehensive-guide-for-companies/

Hernandez, J. (2023, November 27). Top considerations when creating a cybersecurity budget. The Quest Blog. https://blog.quest.com/top-considerations-when-creating-a-cybersecurity-budget/

Kolodiy, R. (2025, September 3). How to create an effective cybersecurity budget in 2026. TechMagic. https://www.techmagic.co/blog/cybersecurity-budget

Krishnan, A. (2022, September 1). Cybersecurity budget breakdown and best practices. TechTarget. https://www.techtarget.com/searchsecurity/tip/Cybersecurity-budget-breakdown-and-best-practices

Martin, M. (2025, November 26). A complete guide to cybersecurity compliance for businesses. Atlas Systems. https://www.atlassystems.com/blog/cybersecurity-compliance

SecurityXperts.ca. (2025, December 28). The connection between digital identity and compliance. https://securityxperts.ca/the-connection-between-digital-identity-and-compliance/

TechTransformation. (2022, July 18). Cybersecurity budget process [Video]. YouTube. https://www.youtube.com/watch?v=Wx882Iapl0s

VerSprite. (2021, November 2). How to build a cyber security budget proposal [Video]. YouTube. https://www.youtube.com/watch?v=LUHinr4bMpE