Module 2 · Unit 3 · Forum 3
COMP 6660 · Enterprise Cybersecurity Forum 3 — Threat Intelligence and Risk Management
The third graded discussion forum. Analyse how enterprises frame and manage risk, and how threat intelligence informs — or fails to inform — defensive decisions.
01 Forum overview
Forum 3 is where the analytical methods of Unit 3 meet the reality of enterprise decision-making. It invites you to examine how risk is framed and how threat intelligence is used — or misused — in practice.
The forum runs asynchronously in Brightspace and is one of six graded forums contributing to the 10% online participation component. It draws particularly on Lessons 3.1, 3.2, and 3.3, though the attack-class lessons (3.4–3.7) supply important illustrative material.
Forum 3 also supports Assignment 2, whose research topic is ransomware as an enterprise threat. Students who contribute strong analysis here often find that the assignment's research essay is easier to structure and substantiate.
Where to post
The forum is hosted in Brightspace, in the Unit 3 Discussion topic under the Discussions tool.
02 Discussion prompts
Choose one of the following prompts for your initial contribution.
Prompt A — Risk assessment methodologies in practice
Enterprises use a range of risk-assessment methodologies, from qualitative scoring matrices to quantitative approaches such as FAIR. Analyse:
- the strengths and weaknesses of qualitative and quantitative approaches;
- why many enterprises default to qualitative scoring despite its known limits;
- how risk assessment output is — or should be — used in investment decisions;
- what a credible risk-assessment process would look like for a mid-sized enterprise.
Support your analysis with at least three scholarly or authoritative sources.
Prompt B — Ransomware trends and enterprise response
Ransomware has evolved from isolated encryption events to enterprise-wide crises involving data theft, extortion, and regulatory consequences. Analyse:
- how the ransomware business model has changed over the past five years;
- which enterprises are most exposed, and why;
- the controls that materially reduce ransomware impact (backups, segmentation, identity, detection);
- whether paying a ransom should be prohibited, and what the arguments are on each side.
Support your analysis with at least three scholarly or authoritative sources.
Prompt C — Supply-chain attacks as an enterprise risk
Supply-chain compromise — through software dependencies, managed service providers, or third-party platforms — is now a systemic risk. Analyse:
- why supply-chain attacks are difficult to detect and contain;
- which recent incidents illustrate the pattern, and what they have in common;
- what controls reduce exposure at the enterprise level (SBOM, vendor assurance, network segmentation);
- whether current regulatory approaches are adequate to the problem.
Support your analysis with at least three scholarly or authoritative sources.
03 Participation requirements
Initial contribution
One substantive posting of approximately 300–500 words that:
- demonstrates understanding of the Unit 3 readings;
- incorporates at least three scholarly sources;
- contributes original analysis;
- links theory to enterprise practice.
Peer responses
At least two meaningful responses to classmates that:
- extend the discussion;
- critically evaluate ideas;
- present alternative perspectives;
- introduce supporting evidence or examples.
Simple agreement is not sufficient.
04 Grading rubric
| Criterion | Weight |
|---|---|
| Relevance and quality of contributions | 30% |
| Critical analysis and reflection | 30% |
| Integration of research evidence | 20% |
| Engagement with peers | 20% |
| Total | 100% |
05 Alignment with unit outcomes
| Outcome | How the forum addresses it |
|---|---|
| U3.1 — Threat analysis | Prompt C examines supply-chain threats; Prompt B examines ransomware lifecycles. |
| U3.2 — Risk and vulnerability assessment | Prompt A directly evaluates risk-assessment methodologies. |
| U3.3 — Attack techniques | Prompts B and C require analysis of specific attack classes. |
| U3.4 — Mitigation strategies | All prompts ask students to recommend proportionate mitigations. |
| CLO9 — Scholarly communication | All prompts require scholarly argument supported by sources. |
06 Guidance for a strong contribution
How do I find credible threat intelligence sources?
Prefer reports from established incident-response firms (Mandiant, CrowdStrike, Sophos), national agencies (NCSC-UK, CISA, ENISA), and independent research organisations. Avoid vendor content that exists primarily to sell a product, unless you are analysing it critically.
Is it acceptable to disagree with a classmate?
Yes — constructive disagreement is often the strongest form of engagement. What matters is that you support your disagreement with evidence and reasoning rather than asserting a contrary position. The rubric rewards critical evaluation.
Can I discuss a specific incident without naming the organisation?
If the incident has been publicly reported (regulator findings, official post-incident reviews, mainstream coverage), naming the organisation is appropriate. If you are drawing on non-public experience, anonymise it.
How does Forum 3 help with Assignment 2?
Assignment 2 asks you to conduct a threat-modeling exercise, design a secure cloud-migration architecture, compare detection technologies, analyse a supply-chain attack, and design a defence-in-depth strategy. Forum 3 exercises the threat-modelling and supply-chain reasoning those questions require.
Should I focus on one attack class or compare several?
Either can work, but depth is usually rewarded over breadth. A contribution that analyses one attack class thoroughly — with lifecycle, indicators, and proportionate mitigations — is typically stronger than one that surveys several superficially.
Next
After posting to Forum 3, continue to Unit 4 — Enterprise Security Architectures and Technologies.