Cyber security models and risk assessment: access control models, NIST, ISO/IEC 27001 and Zero Trust

This week’s topics

Cyber security models and risk assessment: access control models, NIST, ISO/IEC 27001 and Zero Trust

1. Starting point: threat intelligence and the cost of cyber crime
2. Cyber security models: Bell-LaPadula, Biba, Clark-Wilson, RBAC, NIST and ISO/IEC 27001, Zero Trust
3. Risk assessment and threat modelling (STRIDE, DREAD, attack trees), security controls

What you will be able to do

• 2.3 Evaluate several key cyber security models and their focuses.
• 2.4 Analyse the role of risk management in identifying security threats and vulnerabilities.

Activity

Start with this week’s 3 videos, then: Seminar, guided reading and a short written task: evaluate several key cyber security models and their focuses.

Study materials

Videos

• The cost of cyber crime and hacker motivation · Oak National Academy, Key Stage 4 (GCSE level) · for registered students
• Cyber Threat Intelligence Explained: A Quick Guide for Beginners · YouTube · Adam Goss · 11 min · for registered students
• Threat Intelligence - CompTIA Security+ SY0-701 - 4.3 · YouTube · Professor Messer · 5 min · for registered students

Further resources

• ENISA Threat Landscape 2025: Executive summary and overview · PDF · ENISA Threat Landscape 2025 (v1.3), executive summary and overview of current threats to organisations, pp. 6–10 · for registered students
• Introduction to Computer Science, 14.2: What is the threat model? · PDF · OpenStax Introduction to Computer Science (2024), 14.2 opening on threat models and threat ranking, pp. 833–834 · for registered students
• Foundations of Information Systems, 5.3: Risk Management Strategies · PDF · OpenStax Foundations of Information Systems (2025), 5.3: risk assessment by likelihood and impact, controls and staff training, pp. 182–191 · for registered students
• Introduction to Computer Science, 14.2: Authentication and access control · PDF · OpenStax Introduction to Computer Science (2024), 14.2 sections on authentication, passwords and access control, pp. 839–841 · for registered students
• A comparative study on cyber threat intelligence: the security incident response perspect… · Open-access article · Schlette et al. (2021), IEEE Communications Surveys & Tutorials. Survey of cyber threat intelligence: sources, formats and how it is used. · for registered students