COMP 6660 · Enterprise Cybersecurity Enterprise Threat Analysis and Security Architecture

01 Overview

Assignment 2 is the second of three written assignments in COMP 6660. It assesses your understanding of the threat landscape, of risk and vulnerability assessment, of security architecture design, and of the technologies through which enterprise infrastructure is protected — the material examined across Units 3, 4, and 5.

The assignment has two parts. Part A is a scholarly research paper on Ransomware as an Enterprise Threat — requiring you to synthesise academic and industry literature on ransomware's evolution, to analyse the defensive strategies that address it, and to evaluate the organisational resilience required to survive it. Part B is a set of five technical questions requiring applied analysis and design — covering threat modelling, cloud migration architecture, security technology comparison, supply-chain attack analysis, and defence-in-depth design.

02 Learning outcomes assessed

Assignment 2 assesses the following Course Learning Outcomes (CLOs):

Unit-level learning outcomes for Units 3, 4, and 5 are mapped in the unit learning outcomes pages: Unit 3 outcomes · Unit 4 outcomes · Unit 5 outcomes.

03 Submission details

04 Part A — Research paper

What is required

Write a scholarly research paper of 2,000–2,500 words on the research topic above. The paper must:

• Trace the evolution of ransomware — from its early forms through to the modern ransomware-as-a-service ecosystem, including the industrialisation of ransomware operations, the emergence of affiliates and initial-access brokers, and the shift to double and triple extortion.
• Analyse the modern ransomware threat — the actors, the business models, the techniques, and the targeting. Explain why ransomware has become such a consequential enterprise threat, and what distinguishes the modern ransomware operator from earlier criminal actors.
• Examine the enterprise exposure — the vulnerabilities and control failures that ransomware exploits, including internet-facing services, unpatched systems, credential compromise, and inadequate backup and recovery capability.
• Evaluate the defence strategies — preventive, detective, and responsive — including identity controls, endpoint and network protection, segmentation, backup and recovery, and the role of threat intelligence and threat hunting.
• Analyse the organisational resilience dimension — what enterprises must do beyond prevention to survive a ransomware incident, including continuity planning, tested recovery, crisis management, negotiation policy, and the cultural and organisational factors that determine the outcome.
• Synthesise scholarly and industry sources — drawing on peer-reviewed research, on standards bodies (NIST, CISA, ENISA, NCSC), and on authoritative industry publications.
• Present an original argument — the paper is not a summary of existing material; it advances a considered position on ransomware defence, supported by evidence and by critical analysis.

Suggested structure

05 Part B — Technical questions

Answer all five technical questions below. Each answer should be approximately 300–400 words, combining conceptual explanation with applied analysis. Where a question requires a design or a comparison, structure your answer accordingly — with clearly identified components, justifications, and reasoned conclusions. Diagrams are welcome and, where appropriate, encouraged.

Marking criteria for Part B

06 Format and referencing

Document structure

Your submission should have the following structure:

1. Title page — with your name, student ID, course code (COMP 6660), assignment title ("Assignment 2 — Enterprise Threat Analysis and Security Architecture"), submission date, and word count for each part.
2. Table of contents — with page numbers.
3. Part A — Research paper — with its own title, abstract (150–200 words), and section headings.
4. Part B — Technical questions — with each question reproduced as a heading, followed by your answer.
5. References — a single reference list covering both parts, formatted according to the referencing style you have chosen.
6. Appendices — if you wish to include diagrams, detailed architectures, or supplementary material that does not fit within the word count.

Referencing

You must cite all sources you use, in accordance with an accepted referencing style. Choose one style — APA 7th edition, IEEE, or Harvard — and apply it consistently across both parts.

When referencing standards and frameworks, cite the specific document and section where possible:

• Standards — for example, NIST CSF 2.0, NIST SP 800-61, NIST SP 800-161, ISO/IEC 27001, ISO/IEC 27017, ISO/IEC 27018, and equivalent.
• Peer-reviewed sources — journal articles, conference proceedings, and scholarly monographs.
• Authoritative industry sources — CISA, ENISA, NCSC, MITRE, and equivalent bodies; the major annual industry reports (Verizon DBIR, Microsoft DDR, and equivalent).
• Vendor documentation — where necessary, but should not form the primary basis for technical arguments.

Use of diagrams and tables

Diagrams and tables are encouraged, and are particularly important for technical question 1 (threat modelling), technical question 2 (cloud architecture), and technical question 5 (defence-in-depth). Diagrams should be your own work, should be clearly labelled, and should be referenced in the text.

Word count

The word count includes the main body of your answers but excludes the title page, table of contents, references, appendices, and figure captions. Each part has its own word count range — please observe both.

07 Overall marking rubric

Assignment 2 is marked out of 100. The overall mark comprises the weighted total of the Part A and Part B criteria, scaled to the assignment weight.

Grade descriptors

08 Academic integrity

This assignment must be your own work. You must not:

• Copy from another student. Collaboration on the assignment is not permitted except where explicitly approved by the instructor.
• Copy from published sources without citation. All use of others' work — including paraphrasing and summarising — must be properly cited. Copying passages verbatim without quotation and citation is plagiarism.
• Reuse work submitted for another course. Submission of substantially the same work for multiple courses is not permitted without prior approval.
• Use generative AI to produce the assignment. The use of AI tools is permitted for specific purposes as set out below — but the intellectual work must be your own.

All submissions will be checked through plagiarism detection software. Suspected cases of academic misconduct will be handled in accordance with the university's academic integrity policy.

09 Use of AI tools

The use of generative AI tools in this course is permitted within defined boundaries. The purpose of these boundaries is to ensure that your learning — and your assessed work — reflect your own understanding and your own intellectual effort.

Permitted uses

• Editing and proofreading. Using AI to check grammar, spelling, clarity, and consistency.
• Structural suggestions. Using AI to suggest how a section might be structured — which you then implement in your own words.
• Research assistance. Using AI to suggest search terms, to identify possible sources, or to generate questions — provided you then locate and read the original sources yourself.
• Explaining concepts. Using AI to help you understand a concept you are struggling with — provided you then apply the concept yourself.
• Generating counterarguments. Using AI to suggest counterarguments to your thesis — which you then evaluate yourself and incorporate if appropriate.

Not permitted

• Generating assignment text. Submitting AI-generated text as your own work, in whole or in part.
• Generating analysis or arguments. Using AI to produce the analysis, the arguments, the design decisions, or the conclusions of your assignment.
• Generating citations. Including citations to sources you have not read, or that AI has generated without verification.
• Completing any assessed intellectual work. Any part of the assignment that requires you to understand, to analyse, to design, or to conclude must be your own work.

Disclosure

Where you have used AI tools in completing this assignment, you must disclose the use in a short statement at the end of the assignment:

• Which AI tools you used.
• For which purposes you used them.
• How the output was used — for example, "used for grammar checking," "used to suggest structural options I then evaluated."
• Confirmation that the intellectual work — the research, the analysis, the design, the argument, and the conclusions — is your own.

Failure to disclose AI use where it has occurred may be treated as academic misconduct.

10 Support and resources

Course resources

• Unit 3 lessons — risk fundamentals, threat modelling, vulnerability assessment, malware and ransomware, social engineering, advanced persistent threats, and supply chain — Lessons 3.1–3.7.
• Unit 4 lessons — security architecture principles, defence in depth, network security protocols, VPNs, firewalls, segmentation, IDS/IPS, and SIEM/XDR/SOC — Lessons 4.1–4.7.
• Unit 5 lessons — operating system, endpoint, application, database, cloud, container, mobile, IoT, and critical infrastructure security — Lessons 5.1–5.8.
• Unit resources pages — the Unit 3 resources, Unit 4 resources, and Unit 5 resources — with recommended standards, papers, and industry sources.
• Unit discussions — the Unit 3 forum, Unit 4 forum, and Unit 5 forum — where you can discuss the material with classmates.

Standards and frameworks

• NIST CSF 2.0 — the Cybersecurity Framework.
• NIST SP 800-30 — Guide for Conducting Risk Assessments.
• NIST SP 800-37 — the Risk Management Framework.
• NIST SP 800-53 — Security and Privacy Controls.
• NIST SP 800-61 — Computer Security Incident Handling Guide.
• NIST SP 800-154 — Guide to Data-Centric System Threat Modeling.
• NIST SP 800-161 — Cybersecurity Supply Chain Risk Management.
• NIST SP 800-207 — Zero Trust Architecture.
• MITRE ATT&CK — the adversary tactics and techniques knowledge base.
• ISO/IEC 27001, 27002, 27017, 27018 — the ISMS standard and cloud-specific extensions.
• CISA #StopRansomware — the US Cybersecurity and Infrastructure Security Agency's ransomware guidance.
• ENISA Threat Landscape — the EU agency's annual threat assessment.
• OWASP — threat modelling, application security, and API security guidance.
• Cloud provider well-architected frameworks — AWS, Azure, and Google Cloud security guidance.

Academic skills support

• Library services — for help with literature search, with database access, and with source evaluation.
• Writing centre — for help with academic writing, with structure, and with referencing.
• Study skills support — for help with time management, with reading strategies, and with exam preparation.
• Accessibility services — for support with any adjustments you require.

Contact

• Course instructor — for questions about the assignment brief, about content, or about extensions. Contact through Brightspace or at the address provided in the syllabus.
• Teaching assistants — for questions about course material and about assignment expectations. Contact details are available in Brightspace.
• Technical support — for problems with Brightspace or with submission.

11 Preparation checklist

Use the checklist below to plan and to verify your work. It is not exhaustive, but it identifies the principal requirements.

Before you begin

• Read the assignment brief in full.
• Review Unit 3, Unit 4, and Unit 5 lessons and the unit resources pages.
• Identify the specific lessons that address each question.
• Plan your time — this assignment requires 25–30 hours of focused work.
• Locate the standards and frameworks you will need.

Research paper (Part A)

• Read at least 10 scholarly or authoritative sources — of which at least 5 are peer-reviewed or from standards bodies.
• Take notes with citations as you read.
• Develop a clear thesis — the paper's original argument.
• Structure the paper with clear sections and logical progression.
• Engage with contested issues — such as ransom payment and regulation — rather than merely surveying.
• Include a conclusion that follows from the analysis.
• Check the word count (2,000–2,500 words, excluding references and appendices).

Technical questions (Part B)

• Answer all five questions.
• Each answer is approximately 300–400 words.
• Each answer addresses all components of the question.
• Design decisions are justified with reference to the course material and to published guidance.
• Trade-offs and limitations are acknowledged.
• Diagrams are included where appropriate — particularly for questions 1, 2, and 5.
• Total word count for Part B is 1,500–2,000 words.

Formatting and referencing

• Title page with name, student ID, course code, assignment title, submission date, and word count.
• Table of contents with page numbers.
• Both parts are clearly identified.
• Every citation is matched by a full reference.
• Every reference is cited in the text.
• Consistent referencing style throughout (APA 7th, IEEE, or Harvard).
• Consistent formatting throughout.
• PDF file name is correct (COMP660_Assignment2_LastName_FirstName.pdf).

Integrity and disclosure

• All work is your own.
• All sources are cited.
• Where AI tools have been used, the use is disclosed in accordance with the requirements set out above.
• You have read and understood the academic integrity policy.

Final submission

• Assignment is submitted through Brightspace as a single PDF.
• Submission is before the due date — or an extension has been approved.
• You have kept a copy of your submission.