COMP 6660 · Enterprise Cybersecurity Course Syllabus

01 Course overview

Course description

COMP 6660: Enterprise Cybersecurity examines the technologies, architectures, governance frameworks, risk-management methodologies, and operational practices used to secure modern enterprise environments. Students explore cybersecurity from technical, managerial, strategic, and research perspectives. Topics include enterprise security architecture, cryptography, identity and access management, cyber threats and vulnerabilities, cloud and infrastructure security, cybersecurity governance, risk management, compliance, security operations, incident response, business continuity, and emerging cybersecurity challenges.

Students develop both practical and scholarly competencies through critical analysis, case studies, independent research, and applied cybersecurity design activities.

Course approach

COMP 6660 is designed for practitioners and graduates who wish to develop the capability to reason about enterprise cybersecurity at a senior level. The course combines conceptual understanding with applied design — you will examine the frameworks and standards that govern enterprise security, apply cryptographic and architectural concepts to realistic scenarios, and reason through the governance, risk, and resilience dimensions of enterprise security strategy.

The course assumes no prior background in cybersecurity beyond the prerequisite course, but it expects graduate-level analytical capability, the ability to read scholarly and technical material critically, and the willingness to reason from first principles.

02 Instructor and contact

Communication expectations

• Instructor response. The instructor aims to respond to emails and forum posts within two business days. Responses may take longer at peak periods (e.g. before assessment deadlines).
• Office hours. The instructor holds virtual office hours — announced in Brightspace — for synchronous questions and discussion.
• Questions about content. Post content-related questions in the course forums where possible — this benefits all students and reduces the burden on the instructor's inbox.
• Questions about assessment. Questions about assignments, the examination, or grades should be directed to the instructor by email.
• Administrative matters. Questions about enrolment, extensions, or examinations should be directed to the course administrator.
• Professional communication. All communication should be professional — clear, respectful, and concise. Include your student ID and the course code in email communication.

03 Course learning outcomes

Upon successful completion of this course, students will be able to:

The CLOs are mapped to the course modules, units, lessons, and assessments. The full mapping is available on the course learning outcomes page.

Alignment with programme outcomes

COMP 6660 contributes to the following programme-level outcomes for the Master of Science in Computing and Information Systems:

• Demonstrate advanced knowledge and critical understanding of a specialised area of computing.
• Apply advanced technical and analytical skills to the solution of complex problems.
• Conduct independent research and communicate findings at a scholarly level.
• Evaluate the ethical, legal, and societal implications of computing practice.
• Demonstrate professional and scholarly integrity in academic and professional practice.

04 Course structure

The course consists of 3 modules, 6 units, and 36 lessons. Each lesson includes reading material, learning activities, key concepts, and self-check questions. Each unit includes a discussion forum and a set of resources.

Module and unit structure

Unit and lesson detail

Lesson structure

Each lesson follows a consistent structure:

• Introduction — establishing the framing and connecting the lesson to the previous material.
• Learning objectives — what you should be able to do by the end of the lesson.
• Numbered sections — the substantive content, organised around the lesson's theme.
• Key concepts — the terms used in the lesson, defined.
• Activities — applied exercises that test your understanding and prepare you for the assessment.
• Self-check — questions to test your recall and understanding.
• Summary — the essential points of the lesson.

05 Materials and resources

Required materials

There is no required textbook for COMP 6660. All lesson content is provided within the course. The lessons reference standards, papers, and industry publications that you will locate and read as part of your study.

Recommended texts

The following texts provide broader coverage of the topics examined in the course. They are recommended for students who wish to read beyond the course material:

• Computer Security: Principles and Practice — Stallings and Brown. A widely used graduate text covering the technical foundations.
• Security Engineering — Ross Anderson (available online). A comprehensive treatment of security engineering, with substantial material on enterprise contexts.
• The Cyber Risk Handbook — Domenic Antonucci. A practical treatment of cyber risk management in the enterprise.
• Zero Trust Networks — Gilman and Barth. A practical treatment of Zero Trust architecture.
• Enterprise Security Architecture — Sherwood, Clark, and Lynas. A foundational text on security architecture in the enterprise.

Standards and frameworks

The course draws heavily on published standards and frameworks. You will be expected to consult them as part of your study. The following are the principal references:

• NIST SP 800-53 — Security and Privacy Controls for Information Systems and Organizations.
• NIST Cybersecurity Framework (CSF) 2.0 — the organising framework for security programmes.
• NIST SP 800-37 — the Risk Management Framework.
• NIST SP 800-30 — Guide for Conducting Risk Assessments.
• NIST SP 800-61 — Computer Security Incident Handling Guide.
• NIST SP 800-207 — Zero Trust Architecture.
• NIST SP 800-63-3 — Digital Identity Guidelines.
• ISO/IEC 27001 — Information Security Management Systems.
• ISO/IEC 27002 — Information Security Controls.
• ISO/IEC 27005 — Information Security Risk Management.
• ISO/IEC 22301 — Business Continuity Management Systems.
• ISO/IEC 22316 — Organizational Resilience.
• IEC 62443 — Industrial Automation and Control Systems Security.
• PCI DSS — Payment Card Industry Data Security Standard.
• COBIT — the ISACA IT Governance Framework.
• MITRE ATT&CK — the adversary tactics and techniques knowledge base.

Academic and industry sources

The course expects you to engage with peer-reviewed research and with authoritative industry publications. The following are examples of the sources you should consult:

• Academic journals and conferences — IEEE Security & Privacy, Computers & Security, Journal of Cybersecurity, ACM CCS, USENIX Security, and equivalents.
• Standards bodies and national agencies — NIST, CISA, ENISA, NCSC, and their equivalents.
• Industry publications — annual threat reports (Verizon DBIR, Microsoft Digital Defense Report), analyst publications, and the major security vendors' research publications.
• Sector regulators — financial regulators, health regulators, energy regulators, and their published guidance.

06 Delivery and technology

Delivery mode

COMP 6660 is delivered as an online, paced course through Brightspace. Course material, discussions, assignments, and assessment are all accessed through Brightspace. The course is paced — meaning that material and assessments are released on a schedule, and that there are defined deadlines — rather than self-paced.

Technology requirements

• Internet access. Reliable internet access for accessing Brightspace, for accessing external sources, and for participating in the course discussions.
• Computer. A modern computer capable of running a current web browser, of reading PDF documents, and of producing documents in PDF format.
• Software. A word processor capable of producing PDF output; a PDF reader; a web browser.
• Communication. A microphone and camera for the synchronous elements of the course (optional but recommended).
• Invigilation. For the final examination, access to the university's online invigilation platform, or attendance at an approved in-person examination centre.

Learning activities

• Reading. The lessons provide the primary material. You will also read published sources — standards, papers, and industry publications — as part of your study.
• Applied exercises. Each lesson includes activities that apply the material to realistic scenarios.
• Self-check. Each lesson includes self-check questions to test your understanding.
• Discussion forums. Each unit includes a discussion forum where you engage with the material and with your peers. The discussion forums form part of the assessment (see Section 7).
• Written assignments. Three written assignments develop and assess your capability to research, to reason, and to design across the course material.
• Final examination. The final examination is the summative assessment of your learning across the whole course.

Pacing and workload

COMP 6660 is designed for approximately 12–15 hours of study per week over 14 weeks, for a total of 180–200 hours. The workload is distributed as follows:

• Reading and lesson content — approximately 6–8 hours per week.
• Applied exercises and self-check — approximately 2–3 hours per week.
• Discussion participation — approximately 1–2 hours per week.
• Assignment preparation — additional hours in the weeks before assignment deadlines (approximately 25–30 hours per assignment).

07 Assessment scheme

COMP 6660 is assessed through three written assignments, an online participation component, and a final examination. Each component assesses different dimensions of the course learning outcomes.

Assignment 1 — Enterprise Cybersecurity Foundations and Technologies (20%)

Coverage: Unit 1 and Unit 2.
Research topic: Zero Trust Architecture for Modern Enterprises: Principles, Adoption Challenges, and Implementation Strategies.
Technical questions: Zero Trust architecture design; AES vs RSA comparison; IAM for a healthcare organisation; authentication mechanisms for credential-based attacks; Zero Trust's contribution to the CIA triad and accountability.

Assignment 2 — Enterprise Threat Analysis and Security Architecture (20%)

Coverage: Unit 3, Unit 4, and Unit 5.
Research topic: Ransomware as an Enterprise Threat: Evolution, Defense Strategies, and Organizational Resilience.
Technical questions: Threat-modelling exercise; secure cloud-migration architecture; IDS/IPS/SIEM/XDR comparison; supply-chain cyberattack analysis; defence-in-depth strategy for a financial institution.

Assignment 3 — Enterprise Security Governance and Cyber Resilience (20%)

Coverage: Unit 6 and integrated course concepts.
Research topic: Cybersecurity Governance and Risk Management in Large Enterprises: Integrating NIST CSF, ISO/IEC 27001, and Zero Trust Principles.
Technical questions: Cybersecurity governance framework for a university; cybersecurity risk assessment for critical infrastructure; enterprise ransomware incident-response plan; business continuity and disaster recovery strategy; evaluation of AI opportunities and risks in enterprise cybersecurity.

Online participation (10%)

The online participation component is intended to foster scholarly discussion, professional knowledge sharing, critical reflection, and collaborative learning. Participation takes place asynchronously through discussion forums integrated within the Brightspace learning environment.

Students participate in six structured discussion forums, aligned with the six course units. For each forum, students are expected to make one substantive initial contribution (approximately 300–500 words, with scholarly sources and original analysis), and at least two meaningful peer responses.

The full participation rubric is provided on the online participation page.

Final examination (30%)

The final examination is the comprehensive, summative assessment of your learning across the whole course. It is invigilated, closed-book, and 3 hours in duration (plus 15 minutes of reading time).

Full details — including the format, the marking rubric, and preparation guidance — are available on the final examination page.

08 Grading

Grading scale

Pass requirements

• Course pass. The minimum passing grade for a graduate course is C−. However, the programme may require a higher minimum grade — check the programme regulations.
• Examination pass. In addition to the course pass requirement, students must achieve a minimum of 50% on the final examination. Students who achieve a passing grade in the coursework but do not achieve 50% on the examination may be required to sit a supplementary examination, in accordance with university policy.
• Assignment completion. All three assignments must be submitted to pass the course. Assignments that are not submitted will be recorded as zero, and the total mark may not meet the course pass requirement.
• Integrity. Any confirmed breach of academic integrity may result in a mark of zero on the assessment, in a mark of zero on the course, or in more serious disciplinary action — in accordance with university policy.

Feedback and marks

• Feedback. Assignments are returned with written feedback within two weeks of the submission deadline. Feedback identifies your strengths, the areas where you could improve, and the reasons for the mark awarded.
• Marks. Marks are posted in Brightspace. The weighted total is available once all marks are entered.
• Queries. If you believe a mark is incorrect, first review the feedback and the marking rubric. If you still have a concern, contact the instructor within one week of receiving the mark.
• Re-marking. Formal re-marking is available in accordance with university policy.

09 Weekly schedule

The following schedule provides a guide to the pacing of the course. The exact dates for each week — and the exact deadlines for the assessments — are published in Brightspace at the start of term.

Assessment deadlines

The assignment deadlines are published at the start of term in Brightspace. The following general guidelines apply:

• Assignment 1 — due at the end of Week 5.
• Assignment 2 — due at the end of Week 10.
• Assignment 3 — due at the end of Week 13.
• Online participation — assessed on a rolling basis throughout the term, with the final contribution required by the end of Week 13.
• Final examination — scheduled by the examinations office during the examination period following Week 14.

Dates are for guidance only. The exact dates are published in the Brightspace course shell.

10 Research integration

Throughout the course, students critically examine the following research areas — each unit incorporates current research literature, industry frameworks, standards, regulations, and enterprise case studies to ensure graduate-level depth and relevance:

• Zero Trust Architectures.
• Cloud Security.
• Artificial Intelligence and Cybersecurity.
• Security Operations Centres.
• Threat Intelligence.
• Cyber Risk Quantification.
• Supply Chain Security.
• Cybersecurity Governance.
• Digital Sovereignty.
• Critical Infrastructure Protection.

The three written assignments include a research paper component — providing structured opportunities to engage with the scholarly and industry literature on the topics examined in the course.

11 Course policies

Late submissions

• Standard late penalty. A penalty of 5% of the assignment mark per calendar day late applies to assignments submitted after the deadline, to a maximum of five days. Assignments more than five days late will not be accepted unless an extension has been approved.
• Extensions. Requests for extension must be submitted to the course instructor before the deadline, with a reasonable explanation. Extensions may be granted for illness, for family emergency, or for other extenuating circumstances. Supporting documentation may be required.
• Deferred examination. Where a student is unable to sit the final examination due to illness or other extenuating circumstances, a deferred examination may be granted in accordance with university policy. Applications must be supported by appropriate documentation and submitted within the required timeframe.
• Technology failure. Where a technical problem prevents submission, contact the instructor immediately. Do not assume that an extension will be granted because a problem occurred — communicate promptly and keep evidence.

Communication and conduct

• Professional communication. All communication in the course — including discussion forum posts and emails — should be professional, respectful, and constructive.
• Discussion forum conduct. The discussion forums are professional spaces for scholarly engagement. Contributions should be substantive, supported by evidence, and respectful of others. Personal attacks, harassment, and unprofessional conduct are not permitted.
• Response expectations. The instructor aims to respond to questions within two business days. Do not expect immediate responses outside of normal working hours.
• Escalation. Where a student has a concern about the course — or about instructor conduct — they should first raise the matter with the instructor. If the concern cannot be resolved, escalate to the programme administrator.

Recordings and privacy

• Recording. Recording of synchronous sessions is not permitted without the instructor's prior consent. Where sessions are recorded for the benefit of all students, the recording is made available in Brightspace.
• Privacy. Personal information collected as part of the course is handled in accordance with the university's privacy policy and applicable privacy law.
• Confidentiality. Information shared within the course — including in discussion forums — should be treated as confidential to the course community.

12 Academic integrity

Academic integrity is fundamental to the scholarly enterprise — and to professional practice in cybersecurity. You are expected to complete all assessment in this course in accordance with the university's academic integrity policy.

What academic integrity requires

• Your own work. All submitted assessment must be your own work.
• Proper citation. All use of others' work — including paraphrasing and summarising — must be properly cited.
• No unauthorised collaboration. Collaboration on assessment is not permitted except where explicitly approved by the instructor.
• No reuse of work. Submission of the same work for multiple courses is not permitted without prior approval.
• Honest representation. Where AI tools have been used, the use must be disclosed (see Section 13).
• Examination integrity. The final examination must be completed without unauthorised assistance, without unauthorised materials, and without unauthorised communication.

Academic misconduct

Academic misconduct includes — but is not limited to — the following:

• Plagiarism — presenting others' work as your own.
• Cheating on an examination — using unauthorised materials or assistance.
• Unauthorised collaboration on assessment.
• Submission of work completed by another person.
• Impersonation — sitting an examination on behalf of another person, or having another person sit it on your behalf.
• Fabrication — inventing data, sources, or evidence.
• Misrepresentation — misrepresenting your work, your capabilities, or your circumstances.
• Facilitating misconduct — assisting another student to commit academic misconduct.

Consequences

Confirmed academic misconduct may result in one or more of the following consequences, in accordance with university policy:

• A mark of zero on the assessment.
• A mark of zero on the course.
• Suspension or expulsion from the programme.
• Revocation of a degree or credential.

All written submissions will be checked through plagiarism detection software. Suspected cases of academic misconduct will be handled in accordance with the university's academic integrity policy — including the student's right to respond to allegations.

13 Use of AI tools

The use of generative AI tools in COMP 6660 is permitted within defined boundaries. The purpose of these boundaries is to ensure that your learning — and your assessed work — reflect your own understanding and your own intellectual effort.

Permitted uses

• Editing and proofreading. Using AI to check grammar, spelling, clarity, and consistency in your writing.
• Structural suggestions. Using AI to suggest how a section might be structured — which you then implement in your own words.
• Research assistance. Using AI to suggest search terms, to identify possible sources, or to generate questions — provided you then locate and read the original sources yourself.
• Explaining concepts. Using AI to help you understand a concept you are struggling with — provided you then apply the concept yourself.
• Generating counterarguments. Using AI to suggest counterarguments to your thesis — which you then evaluate yourself.

Not permitted

• Generating assignment text. Submitting AI-generated text as your own work, in whole or in part.
• Generating analysis or arguments. Using AI to produce the analysis, the arguments, the design decisions, or the conclusions of your assessment.
• Generating citations. Including citations to sources you have not read, or that AI has generated without verification.
• Completing assessed intellectual work. Any part of the assessment that requires you to understand, to analyse, to design, or to conclude must be your own work.
• Use in the final examination. Generative AI tools are not permitted in any form during the final examination.

Disclosure

Where you have used AI tools in completing an assignment, you must disclose the use in a short statement at the end of the assignment:

• Which AI tools you used.
• For which purposes you used them.
• How the output was used.
• Confirmation that the intellectual work — the research, the analysis, the design, the argument, and the conclusions — is your own.

Failure to disclose AI use where it has occurred may be treated as academic misconduct.

14 Accessibility

Athabasca University is committed to providing an accessible and inclusive learning environment. Students who require accommodations — for a disability, for a medical condition, or for other reasons — should contact Accessibility Services as early as possible.

Available accommodations

• Examination accommodations. Extended time, assistive technology, alternate formats, or separate examination arrangements.
• Assignment accommodations. Extensions, alternate assignment formats, or other adjustments.
• Course material accommodations. Alternate formats of course material — large print, screen-reader compatible, audio.
• Communication accommodations. Where the standard communication channels present barriers, alternate channels can be arranged.

Accommodations are arranged in advance — and examination accommodations in particular must be arranged well before the examination period. Contact Accessibility Services for further information, and confirm that the instructor has been informed of the approved accommodations.

Inclusive practice

The course is designed with inclusive practice in mind — the material is provided in accessible formats, the discussion forums provide multiple modes of participation, and the assessment is designed to permit demonstration of capability across a range of strengths. If you encounter a barrier to your learning, contact the instructor — we are committed to removing barriers wherever possible.

15 Student support

Academic support

• Library services. For help with literature search, with database access, with source evaluation, and with research skills.
• Writing centre. For help with academic writing, with structure, with argumentation, and with referencing.
• Study skills support. For help with time management, with reading strategies, with note-taking, and with examination preparation.
• Math and statistics support. For help with quantitative methods — relevant to the risk quantification material in the course.
• Technology support. For help with Brightspace, with course tools, and with submission.

Wellbeing support

• Counselling services. For support with the personal and emotional dimensions of study — including stress, anxiety, and workload.
• Health and wellness. For support with physical and mental health.
• Peer support. For connection with other students.

Financial and administrative support

• Financial aid. For help with the financial dimensions of study.
• Academic advising. For help with programme planning and with course selection.
• Registrar's office. For help with enrolment, with records, and with graduation.

Contact details for all support services are available on the university's website and in the Brightspace course shell.

16 Syllabus revision

This syllabus is the authoritative description of COMP 6660 for the current term. The course instructor may make minor adjustments to the schedule, to the assessment deadlines, or to the material — where necessary, and where doing so benefits the course. Any significant change will be communicated through Brightspace, with sufficient notice.

The version of the syllabus published in Brightspace at the start of term is the version that governs the course for that term. Where this page and the Brightspace version differ, the Brightspace version takes precedence.

Acknowledgement

By enrolling in COMP 6660, you acknowledge that you have read this syllabus, that you understand the requirements set out within it, and that you agree to comply with the assessment scheme, the course policies, and the academic integrity requirements described here.