Course Syllabus
Contact Information
Instructor Bio
I currently serve as an Executive Strategist for Crowdstrike, an industry-leading cybersecurity company for intelligence, incident response, and cyber defenses. In this role, I help organizations develop strategies for building robust cybersecurity programs, serve as an industry thought leader, and provide creative solutions to make organizations more secure, efficient, and effective.
Previously, I served as the Chief Information Security Officer for the State of Oklahoma and Commanding Officer for Oklahoma Cyber Command. I was charged with leading all cybersecurity defensive efforts, offensive operations, and compliance/privacy practices. I oversaw the state’s efforts to push 32,000 employees to work securely and effectively from home during the global pandemic, established the state’s first enterprise fraud prevention, detection, and investigation program, launched the Oklahoma Information Sharing and Analysis Center (OK-ISAC), and completely rebuilt Oklahoma Cyber Command with best-of-breed cybersecurity tools, expanded partnerships, and a diverse, world-class team.
I also served as Chief Operations and Accountability Officer for the state’s information services division. In that role, I oversaw the technology operations for 189 executive branch agencies and affiliates. In that role, I executed the unification of 110 IT organizations across the state, realized over $875M in cost savings, and was featured in the Wall Street Journal best-seller, “One Mission: How Leaders Build a Team of Teams” by Chris Fussell.
Prior to joining the State, I excelled as an IT leader for the University of Oklahoma. Notably, I played a central role in establishing OU's cybersecurity program, the OU Cyber-Forensics Lab, and OU’s highly popular technology retail store which ranked as the #1 institutionally managed Apple reseller in the Southeast. I also provided critical leadership for the development of one of the first iPhone apps for higher education (OU2GO).
I have a master’s degree in Applied Intelligence, specializing in Cyber Intelligence, Homeland Security, and Counterterrorism from Georgetown University; a bachelor’s degree from the University of Oklahoma, a master’s certificate in IT service management, and numerous other industry certifications.
Course Details
For a list of course activities, scroll to the bottom of this page.
Course Prerequisites
- MIT 5602: Management Information Systems
- MIT 5722: Cybersecurity I: Cyberdefense
Course Materials
Required Materials
- Ullman, Catherine. The Active Defender: Immersion in the Offensive Security Mindset. 1st Edition, Wiley Publishing. 2023. ISBN-13 978-1119895213
Recommended Reading
- Zegart, Amy. Spies, Lies and Algorithms: The History and Future of American Intelligence. Princeton University Press. 2022. ISBN-13 978-0691147130
- Zenko, Micah. Red Team: How to Succeed by Thinking Like the Enemy. 1st Edition, Basic Books. 2015. ISBN-13 978-0465048946
Grades
Breakdown
| Activity | Description | Points | Percentage |
|---|---|---|---|
| Participation | Engagement with the Live Session discussions, activities, and guest speakers. | 7 @ 5 pts each | 5% |
| Adversary Profiles | One-page reports of known cybersecurity adversaries. | 3 @ 10 pts each | 15% |
| Critical Thinking Discussions | Weekly discussion boards analyzing course materials. | 5 @ 10 pts each | 15% |
| SAT Case Study Presentation | Presentation response to an assigned scenario on actions to deal with a cybersecurity threat | 100 pts | 20% |
| Successful Attack Case Study Presentation | Attack Case Study Presentation based on a successful real-world cybersecurity attack | 100 pts | 20% |
| Threat Assessment Presentation | Cybersecurity Threat Assessment (CTA) presentation based on the CMI case study | 100 pts | 25% |
| Total | 415 pts | 100% |
Scale
| Percentage | Letter Grade |
|---|---|
| 90–100% | A |
| 80–89% | B |
| 70–79% | C |
| 60–69% | D |
| Below 60% | F |
Course Components
Participation
You can participate in our course by actively engaging with the course materials (readings, videos, activities) and participating in the weekly Live Sessions. Attending the Live Sessions should be your preferred choice. When possible, you should attend and participate in the Live Sessions in real time.
In the event that your work or personal schedule makes it impossible for you to attend, please review the recording of the Live Session, write a 250-300 word summary, and post that summary in the Critical Thinking Discussion for that module. Then write two 100-150 word responses to your peers' original posts in the Critical Thinking Discussion for that module. You will have until Sunday at 11:59 PM of the module week to submit your Live Session summary and Critical Thinking Discussion responses.
Adversary Profiles
Throughout this course, students will be asked to produce three (3) Adversary Profiles based on threat groups/individuals of their choosing. Students will use one of the Adversary Profiles during the course to inform the final Cybersecurity Threat Assessment presentation to CMI.
Critical Thinking Discussions
You are required to write a 150-200-word response to the week's prompt and connect it to this week's topic. Discussion prompts change each week, depending on the module topic. Your prompt response post should reference course material as well as sources, when possible. Your post should demonstrate comprehension of the subject matter at hand. We'll discuss these response posts in our Live Sessions each week. Post your Prompt Response before 12 PM (noon) on Tuesday.
SAT Case Study Presentation
Students will apply key course concepts to a provided cybersecurity scenario and choose an appropriate course of action to deal with an imminent threat. Using course readings and additional readings suggested by the instructor as a foundation, each student will craft an intelligence question that is relevant to their policy option, conduct additional research, and use an SAT to help them answer their intelligence question.
Successful Attack Case Study Presentation
For this activity, you will prepare an Attack Case Study Presentation based on one of the successful attacks identified in the course. The case study presentation you produce will provide a comprehensive view of the attack and its impact, the organization's response, and recommendations for mitigation of future threats. This case study will be used to inform the final Cyber Threat Assessment presentation for CMI.
Threat Assessment Presentation
For this activity, you will prepare a Cybersecurity Threat Assessment (CTA) based on the CMI case study provided in this course. The threat assessment you produce will include all identified threats, adversaries, and their associated techniques, tactics, and procedures. You will assume any unknown information and note these assumptions in your final cybersecurity threat assessment presentation. This assignment will use revised content from the Adversary Profiles, SAT Case Study Presentation, and Successful Attack Case Study Presentation to develop a threat assessment identifying your findings and proposals for addressing them.
You will prepare a CTA slide presentation to convey your findings of the CMI threats and a proposed solution. Your CTA should include threats specific to CMI attack surfaces (endpoints, workloads/data, identities/personnel) as well as profiles of appropriate Adversaries with their TTPS, IOCs/IOAs, and recommendations for threat mitigation. As you are presenting this CTA in a presentation format, you will summarize your findings and recommendations to aid CMI executives in making appropriate cybersecurity investments.
Course Policies
Communication
I typically respond to students within 24 hours Monday-Friday and within 48 hours on weekends. I encourage students to contact me again if they haven’t heard from you within your communication windows, as I may not have received their email.
Please call me Matt and address me as such in emails or during class discussions. My role as a teacher is to facilitate our Live Session discussions and activities. While I am a subject matter expert in this area, my goal is to support your learning by letting you interact with each other and me as much as possible during the Live Sessions.
Feedback
Grades are typically posted within one week of assignment due dates.
Late Policy
Our course is built so that our assignments build on each other. Assignments will be accepted late with a 10% penalty if submitted before the next Live Session.
Plagiarism
Plagiarism is the most common form of academic misconduct at OU. There is basically no college-level assignment that can be satisfactorily completed by copying. OU's basic assumption about writing is that all written assignments show the student's own understanding in the student's own words. That means all writing assignments, in class or out, are assumed to be composed entirely of words generated (not simply found) by the student, except where words written by someone else are specifically marked as such with proper citation. Including other people's words in your paper is helpful when you do it honestly and correctly. When you don't, it's plagiarism.
For more information about plagiarism, watch this video and then take this short course offered by University Libraries.
Academic Integrity for Artificial Intelligence Programs
In this course, we will use generative Artificial Intelligence (AI) tools for specific assignments to teach you how to successfully leverage the technology, especially for work. Using AI programs where they are not explicitly assigned or allowed is considered academic dishonesty and will be considered a violation of academic integrity. If the usage of such programs is found, students will receive a “0” for the grade and will be reported to OU’s Integrity Council. Students unsure about using AI tools in coursework should speak directly to their instructor or seek guidance from the Student's Guide to Academic Integrity.
University Academic Policies and Student Support
Land Acknowledgement
Long before the University of Oklahoma was established, the land on which the University now resides was the traditional home of the “Hasinais” Caddo Nation and “Kirikirʔi:s” Wichita & Affiliated Tribes.
We acknowledge this territory once also served as a hunting ground, trade exchange point, and migration route for the Apache, Comanche, Kiowa and Osage nations. Today, 39 tribal nations dwell in the state of Oklahoma as a result of settler and colonial policies that were designed to assimilate Native people.
The University of Oklahoma recognizes the historical connection our university has with its indigenous community. We acknowledge, honor and respect the diverse Indigenous peoples connected to this land. We fully recognize, support and advocate for the sovereign rights of all of Oklahoma’s 39 tribal nations. This acknowledgment is aligned with our university’s core value of creating a diverse and inclusive community. It is an institutional responsibility to recognize and acknowledge the people, culture and history that make up our entire OU Community.
Course Catalog
Search the OU Course Catalog.
Student Handbook
Please familiarize yourself with the OU Student Handbook.
Student Support Services
OU offers a variety of services to support students. For more information, please refer to the Student Support Module in your Orientation course.
Online Library
Access digital materials and other resources at OU Libraries.
Copyright Statement and Privacy Information
Sessions of this course may be recorded or live-streamed. These recordings are the intellectual property of the individual faculty member and may not be shared or reproduced without the explicit, written consent of the faculty member. In addition, the privacy rights of others such as students, guest lecturers, and providers of copyrighted material displayed in the recording may be of concern. Students may not share any course recordings with individuals not enrolled in the class or upload them to any other online environment.
Academic Integrity
As a member of the OU community, it is your responsibility to protect your educational investment by knowing and following the rules. The Student Code is available from the Office of the Vice President for Student Affairs and is contained in the Student's Guide to Academic Integrity.
Academic honesty is incredibly important in this course. Cheating is strictly prohibited at the University of Oklahoma because it devalues the degree you are working hard to get. Should you know of someone else engaging in academic misconduct, please report it to your instructor or directly to the Office of Academic Integrity. Your instructor has a professional obligation to report academic misconduct.
In addition to the course conduct policies outlined by your professor in the Course Syllabus in the online classroom, please review the Graduate Student Handbook.
Religious Observance
It is the policy of the University to excuse the absences of students that result from religious observances and to reschedule examinations and additional required classwork that may fall on religious holidays, without penalty. [See Faculty Handbook 3.15.2].
Reasonable Accommodation for Disabilities
The Accessibility and Disability Resource Center (ADRC) is committed to supporting students with disabilities to ensure that they can enjoy equal access to all components of their education. This includes your academics, housing, and community events. Please review OU's Accessibility Policy.
If you are experiencing a disability or a mental/medical health condition that has a significant impact on one or more life functions, you can receive accommodations to provide equal access. Possible disabilities include but are not limited to learning disabilities, AD(H)D, mental health, and chronic health. Additionally, we support students with temporary medical conditions (broken wrist, shoulder surgery, etc.) and pregnancy.
To discuss potential accommodations, please contact the ADRC at 730 College Avenue, (phone) 405-325-3852, or adrc@ou.edu.
Title IX Resources
For any concerns regarding gender-based discrimination, sexual harassment, sexual misconduct, stalking, or intimate partner violence, the University offers a variety of resources, including advocates on-call 24/7, counseling services, mutual no-contact orders, scheduling adjustments, and disciplinary sanctions against the perpetrator. To learn more or to report an incident, please contact the Institutional Equity Office (M-F, from 8-5, at 405-325-3546) or OU Advocates (available 24/7 at 405-615-0013).
Adjustments for Pregnancy/Childbirth-Related Issues
Should you need modifications or adjustments to your course requirements because of documented pregnancy-related or childbirth-related issues, please contact your instructor as soon as possible to discuss your options. Generally, modifications will be made where medically necessary and similar in scope to accommodations based on temporary disability. Learn more about the rights of pregnant and parenting students by consulting the FAQ sheets provided by the Institutional Equity Office.
Mental Health Support Services
If you are experiencing any mental health issues that are impacting your academic performance, counseling is available at the University Counseling Center (UCC). The Center is located on the second floor of the Goddard Health Center, at 620 Elm Rm. 201, Norman, OK 73019. To schedule an appointment, call 405-325-2911. For more information, please visit the University Counseling Center.
Final Exam Preparation Period
Pre-finals week will be defined as the seven calendar days before the first day of finals. Faculty may cover new course material throughout this week. For specific provisions of the policy please refer to OU's Final Exam Preparation Period policy.
Required Policies for Students On Campus
Emergency Protocol
During an emergency, there are official university procedures that will maximize your safety.
Severe Weather: If you receive an OU Alert to seek refuge or hear a tornado siren that signals severe weather:
- Look for severe weather refuge location maps located inside most OU buildings near the entrances
- Seek refuge inside a building. Do not leave one building to seek shelter in another building that you deem safer. If outside, get into the nearest building.
- Go to the building’s severe weather refuge location. If you do not know where that is, go to the lowest level possible and seek refuge in the innermost room. Avoid outside doors and windows.
- Get in, Get Down, Cover Up.
- Wait for official notice to resume normal activities.
Additional information about severe weather preparedness is available through the Department of Campus Safety's Emergency Management Division.
OU-Norman Campus: Tornado Refuge Protocol
Severe Weather Preparedness Video
Armed Subject/Campus Intruder
If you receive an OU Alert to shelter-in-place due to an active shooter or armed intruder situation or you hear what you perceive to be gunshots:
- Avoid: If you believe you can get out of the area without encountering the armed individual, move quickly towards the nearest building exit, move away from the building, and call 911.
- Deny: If you cannot flee, move to an area that can be locked or barricaded, turn off lights, silence devices, spread out, and formulate a plan of attack if the shooter enters the room.
- Defend: As a last resort fight to defend yourself. For more information, visit:
OU's Emergency Preparedness site
Shots Fire on Campus Procedure
Fire Alarm/General Emergency
If you receive an OU Alert that there is danger inside or near the building, or the fire alarm inside the building activates:
- Leave the building. Do not use the elevators.
- Know at least two building exits.
- Assist those who may need help.
- Proceed to the emergency assembly area.
- Once safely outside, Notify first responders of anyone who may still be inside the building due to mobility issues.
- Wait for official notice before attempting to re-enter the building.
Course Summary:
| Date | Details | Due |
|---|---|---|