Upon completion of this capstone tutorial, you will be able to:
Welcome to the capstone tutorial of COMP400 Unit 1. This is the culmination of your journey through the foundational concepts of computer and network security. Over the past sixteen tutorials, you have explored the full spectrum of security—from the CIA triad and threat modeling to malware analysis, DDoS defenses, security operations, governance, secure development, security economics, and emerging threats. This tutorial serves three primary purposes: review, project, and transition.
First, we conduct a comprehensive review of Unit 1. We revisit the core concepts, frameworks, and principles that form the backbone of computer and network security. This review is not a mere repetition; it is a synthesis that reveals the interconnections between topics and reinforces the integrated nature of security. You will see how threat modeling informs architecture, how architecture enables operations, how operations feed governance, and how governance shapes development—all in a continuous, reinforcing cycle.
Second, we launch the Unit 1 Capstone Project. This is your opportunity to apply everything you have learned to a real-world security scenario. You will select an organization, conduct a comprehensive security assessment, design a defense-in-depth architecture, develop an incident response plan, and present your findings in a professional report. The capstone project is the ultimate demonstration of your mastery of Unit 1 concepts.
Third, we build a bridge to Unit 2. Unit 2 focuses on Cryptographic Protocols, Tools, and Algorithms—the technical engine that enables many of the security services you have studied. We introduce the fundamental cryptographic primitives: symmetric encryption, asymmetric encryption, hash functions, and digital signatures. We show how these primitives implement the security objectives—confidentiality, integrity, authentication, and nonrepudiation—that you have already explored. We also discuss the role of cryptography in modern security architectures, including TLS, IPsec, PKI, and post-quantum cryptography.
By the end of this tutorial, you will have a clear, integrated understanding of Unit 1, a completed capstone project that demonstrates your skills, and a solid foundation for the cryptographic studies that lie ahead. Let us begin this final, culminating journey.
Unit 1 established the foundational objectives of security: the CIA triad—Confidentiality, Integrity, Availability—supplemented by Authenticity, Accountability, and Nonrepudiation. These objectives are the "what" of security. The OSI Security Architecture (X.800) provides the "how"—a taxonomy of security services (authentication, access control, confidentiality, integrity, nonrepudiation) and mechanisms (encryption, digital signatures, access control lists) that implement these objectives.
Key Frameworks:
We explored the diverse threat actors—cybercriminals, nation-states, hacktivists, insiders, and organized crime—and their motivations. We examined attack vectors: phishing, email, network exploits, USB drives, and supply-chain compromises. We analyzed malware families:
Social engineering techniques—phishing, spear-phishing, whaling, vishing, pretexting, and baiting—target the human element, bypassing technical controls.
Defense in Depth is the guiding principle: multiple layers of controls (physical, perimeter, network, host, application, data, people). Zero Trust eliminates implicit trust, requiring continuous verification. Security zones segment networks into trust levels. Controls are categorized as administrative (policies, training), technical (firewalls, encryption, IDS/IPS), and physical (access controls, surveillance).
Security operations include the SOC (Security Operations Center), SIEM (Security Information and Event Management), EDR (Endpoint Detection and Response), and threat hunting. Incident response follows the NIST SP 800-61 lifecycle: Preparation, Detection, Containment, Eradication, Recovery, and Post-Incident Activity.
Governance establishes policies, accountability, and oversight. GRC (Governance, Risk, Compliance) integrates these functions. Major compliance frameworks include GDPR (data privacy), HIPAA (healthcare), PCI DSS (payment cards), SOX (financial reporting), ISO/IEC 27001 (ISMS), and NIST SP 800-53 (federal systems).
Security economics evaluates investments using ROSI (Return on Security Investment), cost-benefit analysis, and ALE (Annualized Loss Expectancy). Cyber insurance transfers financial risk. Business continuity and disaster recovery ensure organizational survival, with RTO (Recovery Time Objective) and RPO (Recovery Point Objective) guiding recovery planning.
Secure development integrates security into the SDLC through SSDLC, DevSecOps, and tools like SAST, DAST, IAST, SCA, and SBOM. Supply-chain security addresses third-party risks.
| Topic Area | Key Concepts | Tutorial Reference |
|---|---|---|
| Foundational Objectives | CIA+AAA, OSI Security Architecture (X.800) | 1.1 |
| Threat Landscape | Threat actors, attack vectors, STRIDE, DREAD | 1.2 |
| Security Models & Principles | Defense in Depth, Least Privilege, Zero Trust, Reference Monitor | 1.3 |
| Malware Fundamentals | Categories, lifecycle, components, detection | 1.4 |
| Viruses | Architecture, types, polymorphic, metamorphic | 1.5 |
| Worms, Trojans, Rootkits | Propagation, RATs, banking Trojans, user/kernel-mode | 1.6 |
| Bots, Ransomware, APTs | Botnets, C2 models, encryption, double-extortion, APT lifecycle | 1.7 |
| DoS/DDoS | Floods, SYN attacks, amplification, scrubbing, CDN | 1.8, 1.9 |
| Security Operations | SOC, incident response, NIST SP 800-61, PICERL | 1.11 |
| Governance & Compliance | GRC, GDPR, HIPAA, PCI DSS, SOX, ISO 27001 | 1.12 |
| Secure Development | SSDLC, DevSecOps, SAST, DAST, SCA, SBOM | 1.13 |
| Security Economics | ROSI, ALE, cyber insurance, BCP/DRP | 1.15 |
| Emerging Threats | MITRE ATT&CK, AI/ML, SASE, cybersecurity mesh | 1.16 |
The Unit 1 Capstone Project is a comprehensive assessment that requires you to apply all Unit 1 concepts to a real-world security scenario. You will select an organization (real or fictional), conduct a security assessment, and produce a professional report.
Objectives:
Scope: The project covers the full spectrum of Unit 1 topics. You will produce a comprehensive report of approximately 3,000-5,000 words, along with a presentation.
Assessment criteria: Depth of analysis, application of Unit 1 concepts, creativity, clarity of communication, professionalism, and integration of topics.
Choose one of the following scenarios or propose your own:
The final report must include:
The presentation (15-20 minutes) should highlight the key findings, architecture, and recommendations.
Unit 2 explores Cryptographic Protocols, Tools, and Algorithms. Cryptography is the technical engine that enables many of the security services you have studied in Unit 1. Understanding cryptography is essential for designing secure systems, implementing security controls, and validating security architectures.
Cryptography serves five primary objectives, directly aligning with Unit 1:
Symmetric encryption uses the same key for both encryption and decryption. It is fast and efficient for bulk data encryption. Key algorithms:
Key distribution: The main challenge of symmetric cryptography—how to securely share the key.
Asymmetric encryption uses a pair of keys: a public key for encryption and a private key for decryption. It enables secure communication without prior key sharing. Key algorithms:
Digital signatures: Provide authentication and nonrepudiation. A message signed with a private key can be verified by anyone with the corresponding public key.
Hash functions produce a fixed-size output (digest) from any input. Key properties:
Key algorithms: SHA-256, SHA-3, MD5 (deprecated), SHA-1 (deprecated). Hashes are used for integrity verification, password storage, and digital signatures.
PKI is a system for issuing, managing, and revoking digital certificates. It provides the infrastructure for secure communication and identity verification. Components:
PKI is the foundation of secure web communication (TLS), email encryption (S/MIME), and code signing.
Cryptography is embedded in nearly every security protocol and system:
| Cryptographic Primitive | Security Objectives | Key Algorithms | Unit 1 Connection |
|---|---|---|---|
| Symmetric Encryption | Confidentiality | AES, ChaCha20 | Data protection (1.1, 1.13) |
| Asymmetric Encryption | Confidentiality, Key Exchange | RSA, ECC | Secure communication, PKI |
| Digital Signatures | Authentication, Nonrepudiation, Integrity | RSA, ECDSA | Nonrepudiation (1.1), PKI |
| Hash Functions | Integrity | SHA-256, SHA-3 | Integrity (1.1), password storage |
| MAC | Integrity, Authentication | HMAC | Message authentication (1.1) |
| PKI | Identity, Key Management | X.509, CA | Authentication (1.1), Access control (1.3) |
The concepts from Unit 1 map directly to cryptographic mechanisms:
Cryptography is not a silver bullet; it must be applied within the framework of security principles:
Quantum computers pose a significant threat to current cryptography:
To prepare for Unit 2, you should:
Unit 1 Final Reflection: Security is a continuous journey of learning, adaptation, and improvement. The concepts, frameworks, and principles you have mastered in Unit 1 are the essential toolkit for any security professional. As you move to Unit 2, remember that cryptography is the technical engine that enables many of the security services you have studied. The threat models, architectural principles, and operational practices you have learned will guide you in applying cryptographic tools effectively and securely.
Test your understanding of Unit 1 synthesis, capstone project, and cryptographic foundations. Questions range from foundational to advanced analytical levels.
Question 1 (Foundational): Which cryptographic primitive is primarily used to ensure data integrity?
Question 2 (Foundational): The OSI Security Architecture (X.800) defines which of the following as a security service?
Question 3 (Intermediate): In the Unit 1 Capstone Project, which phase involves identifying assets and assessing their criticality?
Question 4 (Intermediate): Which cryptographic algorithm is most vulnerable to quantum attacks using Shor's algorithm?
Question 5 (Intermediate): The Capstone Project final report should include which of the following sections?
Question 6 (Intermediate): PKI (Public Key Infrastructure) is primarily used to:
Question 7 (Advanced): Which of the following is a key challenge in symmetric cryptography?
Question 8 (Advanced): In the context of Unit 1, cryptography is best understood as:
Question 9 (Advanced): The Unit 1 Capstone Project requires students to apply:
Question 10 (Advanced Scenario): An organization is planning to implement Zero Trust architecture. Which cryptographic capability is essential for its success?
Question 11 (Theoretical): Explain how cryptographic mechanisms implement the security services defined in the OSI Security Architecture (X.800). Provide a specific example for each service.
Authentication: Digital signatures and certificates verify identity.
Access Control: Cryptographic tokens (JWT) encode permissions.
Data Confidentiality: Encryption (AES) protects data from unauthorized disclosure.
Data Integrity: Hash functions (SHA-256) and MACs ensure data is unaltered.
Nonrepudiation: Digital signatures provide proof of origin and delivery.
Question 12 (Scenario): You are presenting your Unit 1 Capstone Project to the board of directors. Which of the following should be the primary focus of your presentation?
Apply your knowledge through these comprehensive exercises.
Exercise 1 (Intermediate): Capstone Project Plan
Select a scenario from the list provided in Section 5.2.4. Develop a detailed project plan for your Unit 1 Capstone Project, including: (a) project objectives, (b) scope and boundaries, (c) a phased timeline with milestones, (d) key deliverables for each phase, (e) required resources, and (f) a risk assessment for the project itself.
Scenario B: Financial Services Firm
(a) Objectives: Assess security posture of the investment bank, identify risks, design enhanced architecture, develop incident response and governance plans.
(b) Scope: Online trading platform, customer accounts, internal network, proprietary trading algorithms.
(c) Timeline: Phase 1 (Weeks 1-2): Profile and assets; Phase 2 (Weeks 3-4): Threat and risk; Phase 3 (Weeks 5-6): Architecture; Phase 4 (Weeks 7-8): Operations and governance; Phase 5 (Weeks 9-10): Report; Phase 6 (Weeks 11-12): Presentation.
(d) Deliverables: Asset inventory, threat model, risk analysis, architecture diagram, controls list, operations plan, governance assessment, final report.
(e) Resources: Threat intelligence feeds, NIST CSF, OWASP ASVS, FAIR methodology.
(f) Risks: Data availability, stakeholder engagement; mitigations: use of public data, regular check-ins.
Exercise 2 (Advanced): Cryptographic Bridging Analysis
For each of the following Unit 1 security services, identify the cryptographic mechanism that implements it and explain how: (a) Confidentiality, (b) Integrity, (c) Authentication, (d) Nonrepudiation, (e) Access Control. Provide a real-world example of each.
(a) Confidentiality → Symmetric encryption (AES). Example: TLS uses AES to encrypt web traffic.
(b) Integrity → Hash functions (SHA-256). Example: File integrity verification using hashes.
(c) Authentication → Digital signatures and PKI. Example: SSL/TLS certificates authenticate web servers.
(d) Nonrepudiation → Digital signatures. Example: Signing contracts with digital signatures.
(e) Access Control → Cryptographic tokens (JWT). Example: OAuth 2.0 uses JWTs for authorization.
Exercise 3 (Advanced): Risk and Architecture Integration
For your chosen capstone scenario, (a) identify the top three risks using ALE (calculate SLE and ARO), (b) design controls for each risk, (c) map these controls to the defense-in-depth layers, (d) calculate the ROSI for each control, and (e) create a high-level architecture diagram showing the controls.
Top Risks (Healthcare Scenario):
(a) Risk 1: Ransomware (SLE=$2M, ARO=0.2 → ALE=$400k). Risk 2: Data Breach (SLE=$1.5M, ARO=0.15 → ALE=$225k). Risk 3: Insider Threat (SLE=$1M, ARO=0.1 → ALE=$100k).
(b) Controls: (1) MFA + EDR + Offline Backups ($150k/year); (2) Encryption + DLP + Access Controls ($100k/year); (3) UBA + Least Privilege + Auditing ($75k/year).
(c) Mapping: Network (firewalls, segmentation), Host (EDR), Application (WAF, DLP), Data (encryption), People (training).
(d) ROSI: Ransomware ROSI = (400k-150k)/150k = 167%; Breach ROSI = (225k-100k)/100k = 125%; Insider ROSI = (100k-75k)/75k = 33%.
(e) Architecture diagram: Perimeter firewall → DMZ → Internal segmentation (EHR zone, Admin zone, IoT zone) → EDR on all endpoints → Encryption at rest and in transit → SIEM monitoring.
Exercise 4 (Advanced): Post-Quantum Transition Planning
An organization uses RSA-2048 and ECC-256 extensively. Develop a post-quantum migration plan that includes: (a) an inventory of cryptographic assets, (b) risk assessment (timeline and impact), (c) algorithm selection (referencing NIST PQC standards), (d) a phased migration strategy, (e) testing and validation, and (f) budget and timeline estimates.
(a) Inventory: TLS certificates, email signing, code signing, SSH keys, VPNs.
(b) Risk: Quantum computers capable of breaking RSA/ECC are expected within 10-15 years. High-risk systems (long-lived certificates) need priority.
(c) Algorithm selection: CRYSTALS-Kyber (encryption), CRYSTALS-Dilithium (signatures), SPHINCS+ (hash-based signatures).
(d) Phased: Phase 1 (1-2 years) — Inventory and impact assessment; Phase 2 (2-4 years) — Pilot deployments; Phase 3 (4-7 years) — Production migration; Phase 4 (7-10 years) — Full transition and retirement of RSA/ECC.
(e) Testing: Hybrid deployments (RSA + PQC) during transition, interoperability testing.
(f) Budget: $2M over 5 years (tools, training, migration).
Exercise 5 (Advanced Research): Unit 1 Synthesis Reflection
Write a 500-word reflection on your Unit 1 journey. Address: (a) the three most important concepts you learned, (b) how they connect to each other, (c) a real-world example that illustrates this connection, (d) how your understanding of security has evolved, and (e) your goals for Unit 2.
Unit 1 Reflection: The three most important concepts are: (1) Defense in Depth—security must be layered; (2) Threat Modeling—understanding threats informs all decisions; (3) Risk Management—security is about managing risk, not eliminating it. These connect: threat modeling identifies risks, risk management prioritizes them, and defense in depth mitigates them. Example: The SolarWinds attack showed how supply-chain threats (threat modeling) create high risk (risk management) that requires layered defenses (defense in depth). My understanding has evolved from seeing security as technical controls to seeing it as a holistic discipline. For Unit 2, I want to deepen my understanding of cryptography and how it enables secure architectures.
These assignments require deep research, synthesis, and practical application.
Homework 1: Unit 1 Capstone Project – Full Proposal
Develop a comprehensive proposal for your Unit 1 capstone project. Include: (a) organization profile, (b) project objectives, (c) scope and boundaries, (d) methodology (frameworks, tools), (e) detailed project plan with milestones, (f) resource requirements, (g) risk assessment for the project, and (h) a draft table of contents for the final report.
Proposal: Organization: Global e-commerce platform (5,000 employees, $1B revenue). Objectives: Assess security posture, identify risks, design enhanced architecture. Scope: Web application, customer database, payment processing, corporate network. Methodology: STRIDE threat modeling, NIST CSF, FAIR risk analysis, OWASP ASVS. Timeline: 12 weeks with 6 phases. Resources: Threat intelligence feeds, compliance frameworks, security tools. Project risks: Scope creep, data availability. Draft TOC: Executive Summary, Organization Profile, Asset Inventory, Threat Model, Risk Analysis, Architecture Design, Operations Plan, Governance, Secure Development, Economics, Implementation Roadmap, Conclusion.
Homework 2: Cryptographic Foundations Essay
Write a 700-word essay on "The Role of Cryptography in Achieving the CIA Triad." Your essay must address: (a) how encryption provides confidentiality, (b) how hashing and MACs provide integrity, (c) how digital signatures and PKI provide authentication and nonrepudiation, (d) the interplay between these primitives in a secure system, (e) the limitations of cryptography, and (f) how cryptography fits into a defense-in-depth architecture.
Cryptography and the CIA Triad: Confidentiality is achieved through symmetric (AES) and asymmetric (RSA) encryption. Integrity is provided by hash functions (SHA-256) and message authentication codes (HMAC). Authentication and nonrepudiation are enabled by digital signatures and PKI. These primitives work together: TLS uses asymmetric key exchange, symmetric encryption, and hashing. However, cryptography has limitations—key management, implementation flaws, and quantum threats. In a defense-in-depth architecture, cryptography is one layer, combined with access control, monitoring, and physical security.
Homework 3: Post-Quantum Cryptography Research Paper
Research the NIST post-quantum cryptography standardization process. Write a 700-word report that includes: (a) the motivation for PQC, (b) the selection process and timeline, (c) the selected algorithms (CRYSTALS-Kyber, CRYSTALS-Dilithium, SPHINCS+, FALCON), (d) the security assumptions of each, (e) the performance implications, (f) challenges for adoption, and (g) recommendations for organizations.
NIST PQC Standardization: Motivation: Quantum computers threaten RSA and ECC. NIST selected four algorithms: CRYSTALS-Kyber (encryption), CRYSTALS-Dilithium (signatures), SPHINCS+ (hash-based signatures), and FALCON (signatures). Security is based on lattice and hash problems. Performance: Larger key sizes (Kyber: 1,568 bytes vs RSA: 256 bytes), but efficient enough for most applications. Challenges: Migration complexity, algorithm agility, and integration with existing PKI. Recommendations: Begin inventory, plan for hybrid deployments, and stay informed on standards.
Homework 4: Security Economics and Cryptography Integration
An organization is considering migrating to post-quantum cryptography. The current RSA infrastructure costs $200k/year to maintain. The PQC migration will cost $1M over 5 years. Using ROSI analysis: (a) calculate the current ALE (assume RSA is vulnerable to quantum attacks after 10 years with a potential breach cost of $10M), (b) calculate the ROSI of the migration, (c) discuss the qualitative benefits, (d) propose a phased migration plan, and (e) justify the investment to the board.
(a) ALE = $10M / 10 years = $1M/year.
(b) Migration cost over 5 years = $1M, annualized = $200k/year. Risk Reduction = $1M - $0 = $1M. ROSI = ($1M - $200k) / $200k = 400%.
(c) Qualitative: Competitive advantage, regulatory compliance (future mandates), customer trust.
(d) Phased: Year 1-2: Inventory and planning; Year 3-4: Pilot and hybrid; Year 5: Full migration.
(e) Justification: The ROI is 400%, and the qualitative benefits (trust, compliance) are significant. The migration protects the organization from a catastrophic quantum threat.
Homework 5: Unit 1 and Unit 2 Synthesis – Final Reflection
Write a 1,000-word final essay that synthesizes your entire journey through Unit 1 and prepares you for Unit 2. Your essay must address: (a) your understanding of the core security objectives (CIA+AAA) and how they form the foundation, (b) how threat modeling and risk assessment drive security decisions, (c) the role of defense-in-depth and Zero Trust in designing secure architectures, (d) the importance of security operations, governance, and compliance in maintaining security, (e) how security economics and business continuity ensure organizational resilience, (f) how cryptography (Unit 2) connects to and enables these concepts, (g) your personal reflection on your growth as a security professional, and (h) your goals for the remainder of the course.
Final Synthesis: Unit 1 has given me a comprehensive foundation in computer and network security. The CIA triad is the lens through which all security should be viewed. Threat modeling (STRIDE) and risk assessment (ALE, FAIR) provide the analytical tools to identify and prioritize risks. Defense-in-depth and Zero Trust provide the architectural principles. Security operations, governance, and secure development provide the ongoing practices. Security economics ties it all to business objectives. Cryptography—the focus of Unit 2—is the technical engine that enables confidentiality (encryption), integrity (hashing), and authentication (digital signatures). I have grown from seeing security as a set of technical controls to understanding it as a holistic discipline. My goals for Unit 2 are to master cryptographic principles and apply them to secure system design.
This capstone tutorial has brought together the full breadth of Unit 1 and built a bridge to Unit 2. We began with a comprehensive review of all Unit 1 concepts—from the CIA triad and threat modeling to malware, DDoS, operations, governance, secure development, economics, and emerging threats. This review highlighted the interconnections between topics and the integrated nature of security.
We then launched the Unit 1 Capstone Project, a comprehensive assessment that requires you to apply all Unit 1 concepts to a real-world security scenario. The project includes multiple phases: organization selection and scoping, asset inventory and risk analysis, architecture design, operations and governance planning, and final report and presentation. This project is your opportunity to demonstrate mastery and to produce a professional deliverable that showcases your skills.
We then built a bridge to Unit 2, introducing the fundamental cryptographic primitives—symmetric encryption, asymmetric encryption, hash functions, and digital signatures—and showing how they implement the security objectives you have studied. We discussed the role of PKI, the importance of post-quantum cryptography, and the applications of cryptography in modern security protocols. We mapped Unit 1 concepts to cryptographic mechanisms, demonstrating that cryptography is not a separate discipline but the technical engine that enables many of the security services you have already explored.
Congratulations on completing Unit 1 of COMP400. You have built a comprehensive foundation in computer and network security—from fundamental principles to advanced strategies. You are now well-prepared for Unit 2, where you will dive deeply into cryptographic protocols, tools, and algorithms. The concepts, frameworks, and principles you have mastered in Unit 1 will guide you in applying cryptographic tools effectively and securely.
As you move forward, remember that security is a continuous journey of learning, adaptation, and improvement. The field is dynamic, and the threats evolve continuously. But with the foundation you have built, you are equipped to face these challenges and to contribute meaningfully to the security profession.