Assignment 1: Enterprise Cybersecurity Foundations and Technologies

01 Overview

Assignment 1 is the first of three written assignments in COMP 6660. It assesses your understanding of the foundational concepts of enterprise cybersecurity and the core technologies that protect enterprise systems — cryptography, identity management, authentication, authorization, and access control.

The assignment has two parts. Part A is a scholarly research paper on Zero Trust Architecture for Modern Enterprises — requiring you to synthesise academic and industry literature, to develop an original argument, and to communicate it in graduate-level academic prose. Part B is a set of five technical questions requiring applied analysis and design — drawing on the cryptography, identity, and access control material examined in Unit 2.

Purpose

To consolidate your understanding of Unit 1 and Unit 2 material.
To develop your capability to conduct and communicate scholarly research in enterprise cybersecurity.
To apply cryptographic, identity, and access control concepts to realistic enterprise scenarios.
To prepare for the higher-stakes applied work in Assignment 2 and Assignment 3.

Coverage

Unit 1 — Foundations of Enterprise Cybersecurity (Lessons 1.1–1.6).
Unit 2 — Core Cybersecurity Technologies and Access Control (Lessons 2.1–2.7).

Task summary

Part A — Research paper (approx. 2,000–2,500 words).
Part B — Five technical questions (approx. 1,500–2,000 words total).

Weight and value

Weight: 20% of the final course grade.
Contribution to CLOs: CLO1, CLO2, CLO3, CLO4, CLO9.
Estimated effort: 25–30 hours of focused work.

How to approach this assignment

Begin by reviewing Unit 1 and Unit 2 in full. Read the research topic and technical questions carefully, and identify the specific lessons that address each. Read at least ten scholarly or industry sources for the research paper — academic journals, conference proceedings, standards documents, and authoritative industry publications — and take notes as you read. For the technical questions, work through the scenarios methodically, applying the concepts from the relevant lessons and justifying your design choices with reference to the course material and to published guidance. Start early — the research paper in particular requires sustained thinking and revision.

02 Learning outcomes assessed

Assignment 1 assesses the following Course Learning Outcomes (CLOs):

Course learning outcomes assessed by Assignment 1
CLO	Description	Where assessed
CLO1	Define the scope, objectives, principles, and strategic importance of enterprise cybersecurity.	Part A (research paper) — foundational framing and strategic context.
CLO2	Analyse cybersecurity threats, vulnerabilities, risks, and attack vectors affecting enterprise environments.	Part A — analysis of the threat landscape Zero Trust is intended to address.
CLO3	Evaluate and apply cryptographic, authentication, authorization, and access-control technologies.	Part B — technical questions 2, 3, and 4.
CLO4	Design and assess enterprise cybersecurity architectures and controls.	Part A and Part B — Zero Trust architecture design (technical question 1).
CLO9	Conduct scholarly research and communicate cybersecurity findings effectively.	Part A in full — research, synthesis, and academic communication.

Unit-level learning outcomes for Unit 1 and Unit 2 are mapped in the unit learning outcomes pages: Unit 1 outcomes · Unit 2 outcomes.

03 Submission details

Submission information
Item	Detail
Format	Single PDF document, submitted through Brightspace.
File name	`COMP660_Assignment1_LastName_FirstName.pdf`
Length	Part A: 2,000–2,500 words (excluding references and appendices). Part B: 1,500–2,000 words total. Total: 3,500–4,500 words.
Formatting	12-point serif or sans-serif font; 1.15 or 1.5 line spacing; 2.5 cm (1 inch) margins; page numbers; consistent heading structure; title page with name, student ID, course code, assignment title, and submission date.
Referencing style	APA 7th edition, or an equivalent recognised scholarly style (IEEE, Harvard) applied consistently.
Minimum sources	Part A: at least 10 scholarly or authoritative sources, of which at least 5 should be peer-reviewed or from standards bodies (NIST, ISO/IEC, ENISA).
Due date	See the course schedule in Brightspace for the exact due date.
Late penalty	5% of the assignment mark per calendar day late, to a maximum of five days, after which the assignment is not accepted unless an extension has been approved.
Extensions	Requests must be submitted to the course instructor before the due date, with a reasonable explanation and, where relevant, supporting documentation.

Before you submit

Submit your assignment as a single PDF. Check the PDF for formatting problems — particularly for tables, diagrams, and figures. Ensure that every in-text citation is matched by a full reference, and that every reference is cited in the text. Check the word count for each part, and confirm that your submission complies with the academic integrity and AI-use expectations set out below.

04 Part A — Research paper

Research topic

Zero Trust Architecture for Modern Enterprises: Principles, Adoption Challenges, and Implementation Strategies

What is required

Write a scholarly research paper of 2,000–2,500 words on the research topic above. The paper must:

Define Zero Trust Architecture — its origin, its core principles, and its relationship to traditional perimeter-based security models.
Analyse the enterprise context — the changes in enterprise technology and threat that have made Zero Trust relevant, including cloud adoption, remote working, identity-based attacks, and the dissolution of the traditional network perimeter.
Examine Zero Trust's component technologies — identity and access management, micro-segmentation, continuous verification, least privilege, and the supporting control plane and data plane.
Evaluate the adoption challenges — technical, organisational, cultural, and financial barriers to Zero Trust adoption in large enterprises.
Develop implementation strategies — practical approaches for enterprises adopting Zero Trust, including phased migration, maturity models, and architecture patterns.
Synthesise scholarly and industry sources — drawing on peer-reviewed research, on standards bodies (NIST SP 800-207, CISA's Zero Trust Maturity Model), and on authoritative industry publications.
Present an original argument — the paper is not a summary of existing material; it advances a considered position on Zero Trust, supported by evidence and by critical analysis.

Suggested structure

Introduction

Introduce the topic, establish its significance, define the scope of the paper, and state the paper's thesis or argument. Explain what the paper will argue and how it will be structured.

Background and context

Establish the evolution of enterprise security architecture and the changes in technology and threat that have made Zero Trust relevant. Discuss the limitations of perimeter-based security in the modern enterprise.

Zero Trust principles and architecture

Define Zero Trust, examine its core principles, and describe its component technologies — identity, micro-segmentation, continuous verification, least privilege, and the control and data planes.

Adoption challenges

Analyse the barriers to Zero Trust adoption — the technical complexity, the legacy integration challenges, the organisational resistance, the cultural change required, and the investment implications.

Implementation strategies

Examine practical implementation approaches — phased migration, maturity models, architecture patterns, and the role of standards (NIST SP 800-207, CISA ZTMM). Discuss what enterprises should do first.

Critical evaluation and conclusion

Critically evaluate Zero Trust — what it does well, what it does not, what is frequently over-claimed, and what remains contested. Conclude with the paper's argument and its implications for enterprise practice.

Marking criteria for Part A

Part A marking criteria
Criterion	Weight	What the marker looks for
Understanding of Zero Trust	25%	Accurate, comprehensive, and nuanced understanding of Zero Trust principles, architecture, and component technologies. Evidence of reading beyond introductory material.
Analysis and critical evaluation	25%	Sophisticated analysis of the adoption challenges and implementation strategies. Critical evaluation of Zero Trust's strengths, limitations, and contested claims.
Use of scholarly sources	20%	At least 10 scholarly or authoritative sources, correctly integrated and cited. Synthesis of sources rather than summary. Evidence of engagement with peer-reviewed and standards-based material.
Argument and structure	15%	Clear thesis, coherent structure, logical progression, and a conclusion that follows from the analysis. Original argument, not merely a survey.
Academic communication	10%	Clear, precise, and professional academic prose. Correct grammar, spelling, and punctuation. Correct referencing and consistent formatting.
Engagement with course material	5%	Explicit engagement with Unit 1 and Unit 2 material — particularly the foundational concepts and core technologies examined in the lessons.

Research tips

Begin your research with the standards — NIST SP 800-207: Zero Trust Architecture and CISA's Zero Trust Maturity Model — which provide an authoritative foundation. Then move to peer-reviewed literature: search IEEE Xplore, the ACM Digital Library, ScienceDirect, and Google Scholar for recent work on Zero Trust in enterprise contexts. Read the abstracts of many papers and the full text of the most relevant. Take notes with citations as you read — it will save time when you write. Look for papers that argue against Zero Trust, or that critique its adoption — engaging with opposing views strengthens your paper.

05 Part B — Technical questions

Answer all five technical questions below. Each answer should be approximately 300–400 words, combining conceptual explanation with applied analysis. Where a question requires a design or a comparison, structure your answer accordingly — with clearly identified components, justifications, and reasoned conclusions. Diagrams are welcome and, where appropriate, encouraged.

Question 1 — Design a Zero Trust Architecture for a distributed enterprise

A multinational professional services firm with 12,000 employees operates across 20 offices in 12 countries. The firm has migrated the majority of its applications to a mix of SaaS (Microsoft 365, Salesforce, Workday) and public cloud (AWS and Azure), retains a small on-premises data centre, and permits employees to work remotely three days per week. The firm handles confidential client information and is subject to privacy regulation in multiple jurisdictions.

Design a Zero Trust Architecture for the firm. Your answer should:

Identify the principal trust zones and policy decision points — where policy is defined, where policy is enforced, and where access decisions are made.
Describe the identity architecture — how the firm establishes and verifies identity for users, devices, and services, and how identity integrates with the access decisions.
Describe the device posture and verification approach — how the firm determines whether a device is trusted, and how device posture affects access.
Describe the micro-segmentation approach — how the firm segments its estate, including cloud, on-premises, and SaaS environments.
Describe the continuous verification and monitoring approach — how the firm verifies ongoing trust and detects anomalies.
Identify the principal implementation challenges you would expect — including legacy integration, user experience, and operational complexity — and how the firm should address them.

Support your design with reference to NIST SP 800-207, to CISA's Zero Trust Maturity Model, and to the material in Lessons 2.5, 2.6, and 2.7.

Question 2 — Compare AES and RSA for enterprise applications

An enterprise is designing the cryptographic controls for a new customer data platform. The platform will store customer records at rest, will transmit data over untrusted networks, and will sign audit records to provide non-repudiation. The enterprise wishes to choose appropriate cryptographic algorithms for each purpose.

Compare AES and RSA — and, where appropriate, ECC — and recommend which should be used for each purpose. Your answer should:

Explain the fundamental difference between symmetric and asymmetric cryptography, and the implications of that difference for enterprise use.
Describe AES — its structure, its key lengths, its performance characteristics, and the scenarios to which it is well-suited.
Describe RSA and ECC — their mathematical foundations, their security assumptions, their key sizes, and the scenarios to which each is well-suited.
Explain the key distribution problem and how hybrid cryptography — combining symmetric and asymmetric — addresses it.
Recommend the specific algorithms and key lengths for encryption at rest, encryption in transit, and digital signatures for audit records, with justification for each recommendation.
Discuss the quantum threat — how quantum computing affects the security of RSA and ECC, and what the enterprise should do about it.

Support your analysis with reference to NIST SP 800-57, to NIST's post-quantum cryptography programme, and to Lessons 2.1, 2.2, and 2.3.

Question 3 — Design an IAM solution for a healthcare organisation

A regional healthcare organisation operates five hospitals, 40 clinics, and a central administrative function. It employs 8,000 clinical staff, 3,000 administrative staff, and engages 1,500 contractors and visiting clinicians. The organisation uses a mix of on-premises clinical systems, SaaS applications, and cloud services, and is subject to health privacy regulation (e.g. HIPAA, PHIPA).

Design an Identity and Access Management solution for the organisation. Your answer should:

Describe the identity lifecycle — how identities are created, maintained, and terminated for permanent staff, contractors, and visiting clinicians.
Describe the authentication architecture — the authentication methods used for different user populations, and how multi-factor authentication is applied.
Describe the authorization model — whether the organisation should use RBAC, ABAC, or a combination, with justification.
Describe the federation and single sign-on approach — how the organisation provides seamless access across clinical systems, SaaS applications, and cloud services.
Describe the privileged access management approach — how administrative access to clinical and infrastructure systems is controlled and monitored.
Address the specific healthcare challenges — the clinical need for rapid access in emergencies, the shared-workstation environment, the mixed employment model, and the privacy obligations.
Identify the success metrics — how the organisation will know whether the IAM solution is working.

Support your design with reference to NIST SP 800-63, to relevant healthcare privacy and security guidance, and to Lessons 2.5 and 2.6.

Question 4 — Evaluate authentication mechanisms for preventing credential-based attacks

Credential compromise — through phishing, through credential stuffing, through brute force, and through MFA bypass — is the most common initial access technique in enterprise intrusions. The enterprise wishes to strengthen its authentication controls to reduce the risk of credential-based attacks.

Evaluate the principal authentication mechanisms available to the enterprise, and recommend a strategy. Your answer should:

Describe the threat landscape for credential-based attacks — phishing, credential stuffing, password spraying, brute force, MFA fatigue, and adversary-in-the-middle MFA relay.
Evaluate password-based authentication — its weaknesses, and the controls that mitigate them (password policies, breach monitoring, credential hygiene).
Evaluate multi-factor authentication — the different factors (something you know, have, are), and the security differences between MFA methods (SMS, TOTP, push notification, FIDO2/passkey).
Evaluate phishing-resistant authentication — how FIDO2 and passkeys work, why they are resistant to credential phishing, and their adoption challenges.
Evaluate passwordless authentication — the different passwordless approaches, their benefits, and their limitations.
Recommend an authentication strategy — which mechanisms to deploy, for which populations, and in what sequence, with justification.
Identify the implementation challenges — user experience, legacy systems that cannot support modern authentication, and organisational change.

Support your analysis with reference to NIST SP 800-63-3, to CISA's guidance on phishing-resistant MFA, and to Lesson 2.6.

Question 5 — Analyse how Zero Trust contributes to confidentiality, integrity, availability, and accountability

Zero Trust is frequently described as an architectural approach that improves enterprise security. However, the specific ways in which Zero Trust contributes to the classical security objectives — confidentiality, integrity, availability, and accountability — are frequently assumed rather than analysed.

Analyse how Zero Trust contributes to each of the following objectives, being precise about the mechanisms and about the limits of Zero Trust's contribution. Your answer should:

Analyse Zero Trust's contribution to confidentiality — through least privilege, through micro-segmentation, through data-centric controls, and through continuous verification. Note where the contribution is direct and where it is indirect.
Analyse Zero Trust's contribution to integrity — through device posture verification, through signed transactions, through integrity monitoring, and through the prevention of lateral movement. Note where the contribution is significant and where Zero Trust relies on other controls.
Analyse Zero Trust's contribution to availability — through resilience by design, through reduced blast radius, through controlled failure, and through the potential risks that Zero Trust introduces (e.g. centralised policy decision points as single points of failure).
Analyse Zero Trust's contribution to accountability — through comprehensive logging, through per-request attribution, through the audit trail that Zero Trust architecture requires, and through the enforcement of individual identity.
Evaluate where Zero Trust does not contribute — the objectives and risks that Zero Trust does not address, and the complementary controls that remain necessary.
Draw a reasoned conclusion — on the overall contribution of Zero Trust to each of the four objectives, and on the implications for enterprise security strategy.

Support your analysis with reference to NIST SP 800-207, to the foundational security concepts in Unit 1 (Lesson 1.3), and to the Zero Trust material in Lesson 2.7.

Marking criteria for Part B

Part B marking criteria
Criterion	Weight	What the marker looks for
Technical accuracy	30%	Correct, precise, and current technical understanding of the concepts addressed in each question. Use of appropriate terminology.
Applied analysis and design	30%	Ability to apply concepts to the specific enterprise scenarios. Quality and coherence of design decisions, with clear justification.
Critical evaluation	20%	Recognition of trade-offs, limitations, and alternatives. Willingness to identify where a technology or approach is not appropriate, and to note unresolved issues.
Use of published guidance	10%	Reference to relevant standards, frameworks, and authoritative sources (NIST, CISA, ISO/IEC). Appropriate use of citations.
Academic communication	10%	Clear, structured, and professional answers. Correct grammar and referencing. Diagrams where appropriate.

06 Format and referencing

Document structure

Your submission should have the following structure:

Title page — with your name, student ID, course code (COMP 6660), assignment title ("Assignment 1 — Enterprise Cybersecurity Foundations and Technologies"), submission date, and word count for each part.
Table of contents — with page numbers.
Part A — Research paper — with its own title, abstract (150–200 words), and section headings.
Part B — Technical questions — with each question reproduced as a heading, followed by your answer.
References — a single reference list covering both parts, formatted according to the referencing style you have chosen.
Appendices — if you wish to include diagrams, detailed designs, or supplementary material that does not fit within the word count.

Referencing

You must cite all sources you use, in accordance with an accepted referencing style. Choose one style — APA 7th edition, IEEE, or Harvard — and apply it consistently across both parts.

When referencing standards and frameworks, cite the specific document and section where possible:

Standards — for example, NIST SP 800-207, NIST SP 800-63-3, NIST SP 800-57, ISO/IEC 27001, and equivalent.
Peer-reviewed sources — journal articles, conference proceedings, and scholarly monographs.
Authoritative industry sources — CISA, ENISA, NCSC, and equivalent national bodies; recognised analyst publications.
Vendor documentation — where necessary, but should not form the primary basis for technical arguments.

Use of diagrams and tables

Diagrams and tables are encouraged, particularly for technical question 1 (Zero Trust architecture) and technical question 3 (IAM solution). Diagrams should be your own work, should be clearly labelled, and should be referenced in the text.

Word count

The word count includes the main body of your answers but excludes the title page, table of contents, references, appendices, and figure captions. Each part has its own word count range — please observe both.

07 Overall marking rubric

Assignment 1 is marked out of 100. The overall mark comprises the weighted total of the Part A and Part B criteria, scaled to the assignment weight.

Assignment 1 — overall weighting
Component	Weight	Description
Part A — Research paper	50%	Research paper on Zero Trust Architecture for Modern Enterprises.
Part B — Technical questions	50%	Five technical questions, each worth 10% of the assignment mark.

Grade descriptors

Grade descriptors
Grade	Range	Description
A (Excellent)	85–100%	Demonstrates comprehensive and precise understanding; original and sophisticated analysis; extensive and well-integrated use of scholarly sources; clear, precise, and professional academic communication. Answers address the questions with insight and depth, identify trade-offs and limitations, and reach well-justified conclusions.
B (Good)	70–84%	Demonstrates strong understanding and competent analysis; appropriate use of scholarly sources; clear and well-structured communication. Answers address the questions fully, though with less depth, originality, or nuance than an A-grade submission.
C (Satisfactory)	60–69%	Demonstrates adequate understanding; basic analysis; some use of scholarly sources; clear but sometimes imprecise communication. Answers address the questions but may be superficial, may not fully engage with trade-offs, or may lack original insight.
D (Marginal)	50–59%	Demonstrates limited understanding; weak analysis; limited use of scholarly sources; communication difficulties. Answers address parts of the questions but may contain technical inaccuracies, may lack justification for design decisions, or may omit key components.
F (Unsatisfactory)	0–49%	Does not demonstrate understanding of the material; minimal or no analysis; inadequate or absent sources; unclear communication. Answers do not address the questions, contain significant technical errors, or are substantially incomplete.

08 Academic integrity

This assignment must be your own work. You must not:

Copy from another student. Collaboration on the assignment is not permitted except where explicitly approved by the instructor.
Copy from published sources without citation. All use of others' work — including paraphrasing and summarising — must be properly cited. Copying passages verbatim without quotation and citation is plagiarism.
Reuse work submitted for another course. Submission of substantially the same work for multiple courses is not permitted without prior approval.
Use generative AI to produce the assignment. The use of AI tools is permitted for specific purposes as set out below — but the intellectual work must be your own.

All submissions will be checked through plagiarism detection software. Suspected cases of academic misconduct will be handled in accordance with the university's academic integrity policy.

What is acceptable and what is not

Acceptable: Discussing the material with classmates; using AI tools for editing, for improving grammar, or for suggesting structure; using AI tools for generating questions you then research and answer yourself; using AI tools as a research aid (e.g. to find sources you then read yourself).

Not acceptable: Submitting text generated by AI as your own; using AI to write your analysis, your arguments, or your conclusions; using AI to generate citations without reading the sources; using AI to complete any part of the assignment that constitutes the intellectual work.

09 Use of AI tools

The use of generative AI tools in this course is permitted within defined boundaries. The purpose of these boundaries is to ensure that your learning — and your assessed work — reflect your own understanding and your own intellectual effort.

Permitted uses

Editing and proofreading. Using AI to check grammar, spelling, clarity, and consistency.
Structural suggestions. Using AI to suggest how a section might be structured — which you then implement in your own words.
Research assistance. Using AI to suggest search terms, to identify possible sources, or to generate questions — provided you then locate and read the original sources yourself.
Explaining concepts. Using AI to help you understand a concept you are struggling with — provided you then apply the concept yourself.
Generating counterarguments. Using AI to suggest counterarguments to your thesis — which you then evaluate yourself and incorporate if appropriate.

Not permitted

Generating assignment text. Submitting AI-generated text as your own work, in whole or in part.
Generating analysis or arguments. Using AI to produce the analysis, the arguments, or the conclusions of your assignment.
Generating citations. Including citations to sources you have not read, or that AI has generated without verification.
Completing any assessed intellectual work. Any part of the assignment that requires you to understand, to analyse, to design, or to conclude must be your own work.

Disclosure

Where you have used AI tools in completing this assignment, you must disclose the use in a short statement at the end of the assignment:

Which AI tools you used.
For which purposes you used them.
How the output was used — for example, "used for grammar checking," "used to suggest structural options I then evaluated."
Confirmation that the intellectual work — the research, the analysis, the design, the argument, and the conclusions — is your own.

Failure to disclose AI use where it has occurred may be treated as academic misconduct.

Using AI responsibly

AI tools can be valuable as aids — as a research assistant, as a writing coach, as a source of challenge to your thinking. They cannot be a substitute for your understanding, and they cannot be a substitute for your intellectual work. The assignment's purpose is to develop your capability as a security professional — and that development requires you to engage with the material yourself. Use AI tools where they help you learn; do not use them to avoid learning.

10 Support and resources

Course resources

Unit 1 lessons — the foundational concepts, the threat landscape, security frameworks, and case studies examined in Lessons 1.1–1.6.
Unit 2 lessons — the cryptographic, identity, access control, and authentication material examined in Lessons 2.1–2.7.
Unit resources pages — the Unit 1 resources and Unit 2 resources — with recommended standards, papers, and industry sources.
Unit discussions — the Unit 1 forum and Unit 2 forum — where you can discuss the material with classmates.

Standards and frameworks

NIST SP 800-207 — Zero Trust Architecture.
NIST SP 800-63-3 — Digital Identity Guidelines.
NIST SP 800-57 — Recommendation for Key Management.
NIST SP 800-53 — Security and Privacy Controls.
NIST Post-Quantum Cryptography — the post-quantum standards programme.
CISA Zero Trust Maturity Model — the US Cybersecurity and Infrastructure Security Agency's Zero Trust guidance.
ISO/IEC 27001 and 27002 — the international ISMS standard and control catalogue.
FIDO2 and WebAuthn — the phishing-resistant authentication specifications.

Academic skills support

Library services — for help with literature search, with database access, and with source evaluation.
Writing centre — for help with academic writing, with structure, and with referencing.
Study skills support — for help with time management, with reading strategies, and with exam preparation.
Accessibility services — for support with any adjustments you require.

Contact

Course instructor — for questions about the assignment brief, about content, or about extensions. Contact through Brightspace or at the address provided in the syllabus.
Teaching assistants — for questions about course material and about assignment expectations. Contact details are available in Brightspace.
Technical support — for problems with Brightspace or with submission.

Getting help early

If you have questions about the assignment, ask early — the instructor and teaching assistants are here to help, and it is much easier to help with a question than with a completed assignment that has taken the wrong approach. If you are struggling with any aspect of the assignment, contact the instructor before the due date — do not wait until you are out of time.

11 Preparation checklist

Use the checklist below to plan and to verify your work. It is not exhaustive, but it identifies the principal requirements.

Before you begin

Read the assignment brief in full.
Review Unit 1 and Unit 2 lessons and the unit resources pages.
Identify the specific lessons that address each question.
Plan your time — this assignment requires 25–30 hours of focused work.
Locate the standards and frameworks you will need.

Research paper (Part A)

Read at least 10 scholarly or authoritative sources — of which at least 5 are peer-reviewed or from standards bodies.
Take notes with citations as you read.
Develop a clear thesis — the paper's original argument.
Structure the paper with clear sections and logical progression.
Engage with opposing views — do not merely survey.
Include a conclusion that follows from the analysis.
Check the word count (2,000–2,500 words, excluding references and appendices).

Technical questions (Part B)

Answer all five questions.
Each answer is approximately 300–400 words.
Each answer addresses all components of the question.
Design decisions are justified with reference to the course material and to published guidance.
Trade-offs and limitations are acknowledged.
Diagrams are included where appropriate — particularly for questions 1 and 3.
Total word count for Part B is 1,500–2,000 words.

Formatting and referencing

Title page with name, student ID, course code, assignment title, submission date, and word count.
Table of contents with page numbers.
Both parts are clearly identified.
Every citation is matched by a full reference.
Every reference is cited in the text.
Consistent referencing style throughout (APA 7th, IEEE, or Harvard).
Consistent formatting throughout.
PDF file name is correct (COMP660_Assignment1_LastName_FirstName.pdf).

Integrity and disclosure

All work is your own.
All sources are cited.
Where AI tools have been used, the use is disclosed in accordance with the requirements set out above.
You have read and understood the academic integrity policy.

Final submission

Assignment is submitted through Brightspace as a single PDF.
Submission is before the due date — or an extension has been approved.
You have kept a copy of your submission.

A final note

Assignment 1 is an opportunity to consolidate your understanding of the foundations of enterprise cybersecurity and the core technologies that protect enterprise systems. Approach it as a piece of scholarly work — researched, reasoned, and carefully communicated. The capability you develop in this assignment — to read and synthesise sources, to analyse problems, to design solutions, and to communicate your reasoning — will serve you throughout the course, throughout your studies, and throughout your professional practice.