For this assignment, imagine that you are a cybersecurity consultant hired to identify the biggest threats to a company. You can choose any of the following companies:

Amazon

Microsoft

Cisco

Costco

Comcast

Boeing

Wells-Fargo Bank

Your local electric utility

Your local hospital

If you want to choose a different company, ask and you may be allowed to. Just be sure to ask early.

Write a memo to the CEO of the company describing what you believe are the three most serious threats to the company from cyberattacks. These could be attacks directly against the company, or attacks against others than have indirect effect on the company.

Remember from Module 1 that a threat has three elements: something bad that can happen to the company, an attacker that could make it happen, and a reason why the attacker would want to do it. Your description of each threat must include all three of those elements. You might want to look back at the textbook commentary in Module 1 to review this.

Along with the description of each threat, you must also tell the CEO a little bit about an attack that has happened to some other organization that is similar. The CEO will be much more convinced that the threat is real if they see that it has already happened to others.

Your memo should NOT talk about specific types of exploits, like spear-phishing or SQL injection. By themselves, those are not threats, they are just a means that many different threats could be carried out. You are writing this memo for the CEO, they don't need those kinds of details, they just need to be impressed by the severity of the threats and the need to do whatever they can to defend against the threats.

In general, there shouldn't be anything technical in your memo. This is the CEO you are writing for, they are very unlikely to have an IT background. Remember what we've said many times this quarter essentially all of the threats exist independent of cyberspace, it's just that cyberspace that makes them easier to carry out.

Also, your memo should NOT try to tell the CEO what they should be doing to prevent the threats, just tell them about the threats. If they are happy with your work, you will get a follow-on contract where you can provide suggestions for what they can do to prevent them, but not now.

Finally, if you are tempted to do internet research for this assignment, think again. There's nothing to research except perhaps the name of the CEO of the company you choose. Otherwise, all you need to know is about the types of threats and attacks that we have learned about this quarter. And because you don't need to use sources other than those provided in the class, you don't need any citations they would look strange in a memo anyway.