The following are links to synopses of a few good security risk analysis projects from last semester’s undergraduate security risk analysis course at Penn State (SRA 311, Fall 2008):

• SNAPR: Social Network Action and Privacy Risk: this study develops a self-assessment tool for individuals to assess their exposure to harms resulting from internet overexposure (thanks Kris for your blog post on this)

• Risk Assessment of External Assets: this study looks at risks imposed on a particular asset due to its interactions with dependent assets

• Risk Analysis Methodology for the Development of Prewritten Press Releases: this study looks at the problem of having to allocate attention toward the preparation of prewritten risk communication messages

• Interactive Web Tool for Determining the Risk of Theft by an Unauthorized Intruder from a Campus Lab:  this study makes progress toward an online self-assessment tool for campus lab security – there will be more to come on this topic in the coming months

• Risks of Somali Piracy to Commercial Shipping: one student’s look at the exposure of commercial shipping to the risks posed by Somali pirates

Overall, these projects aren’t bad considering I gave the students pretty vague instructions (perhaps too vague).  For more information, contact the respective authors.  Meanwhile, I have quite a list of good projects in the works for late-Spring 2009 delivery.

Send article as PDF to

In Spring 2009, I anticipate having 65 students (or more) enrolled in my SRA 311 (Risk Management: Assessment and Mitigation) course.   SRA 311 is the last required core course for the Security Risk Analysis undergraduate major at Penn State University.  Most students in this course will be second-semester juniors or first-semester seniors interested in a career in security risk analysis or intelligence analysis.

All SRA 311 students are required to contribute to a final course project that seeks to perform a risk study for a real problem of real interest to real decision makers.  I anticipate 5-person teams, and with 65 students this means I should have about 13 teams.  This also means I need at least 13 final course project ideas to choose from.

To meet my needs, I am currently seeking course project ideas for my SRA 311 students.  If you have any risk analysis project ideas that would lend itself to student participation, please send me an email or leave a comment to this post.  Ideas from last semester include:

• Self-assessment methodology for social network participation risk
• Risk analysis self-assessment methodology for campus lab theft
• Press release preparedness methodology
• many others…

Some of the ideas I have for Spring 2009 include:

• User risk assessment for an online social/collaborative environment (PSU Home, Second Life, etc.)
• Research lab security assessment methodology
• Methodology for hazard preparedness (each group focused on a different hazard)
• Technology transfer risk assessment methodology
• Structure and content of a regional threat and vulnerability forecast
• Risk assessment methodology for organizational surprise

What I would really like are some information security-oriented risk analysis project ideas, a few homeland security ones, maybe one or two methods geared toward the national security or business intelligence communities, etc.

Unlike in Fall 2008, many Spring 2009 projects will be focused on building simple decision support tools that implement the methodology, complemented by a media presentation (You Tube video, website, poster, NO POWERPOINT).  Of course, for those niche studies, the project will be dominated by a paper.

Send article as PDF to