Module overview · Units 1–2 · 13 Lessons
COMP 6660 · Enterprise Cybersecurity Module 1 — Foundations and Technologies
The conceptual and technical foundation of the course. Module 1 establishes why enterprise cybersecurity is a business problem, what must be protected, which frameworks govern the response, and how cryptography, identity, and access control actually enforce security policy.
01 Purpose and position in the course
Module 1 answers the questions that every later module assumes: what is enterprise cybersecurity, what is being protected, against whom, and with what technologies.
Graduate courses in cybersecurity frequently fail in one of two directions. Some begin immediately with tools and exploits, producing students who can describe an attack but cannot justify a security investment to a board. Others begin with governance and policy, producing students who can write a framework document but cannot evaluate whether a proposed control actually works. Module 1 deliberately avoids both failures by pairing strategy with technology inside a single, tightly sequenced block of study.
Unit 1 establishes the strategic and analytical foundation. It positions cybersecurity as a business issue shaped by enterprise digitisation, defines and classifies the assets that require protection, and develops the core security objectives — confidentiality, integrity, availability, authenticity, accountability, privacy, and non-repudiation. Students survey the modern threat landscape, compare the dominant security frameworks (NIST CSF, NIST RMF, ISO/IEC 27001) and the defence-in-depth architectural model, and apply all of this to documented enterprise breaches.
Unit 2 establishes the technical foundation. It moves from cryptographic primitives through public key infrastructure to identity and access management, authentication, authorization, and Zero Trust. The unit treats cryptography not as a mathematical curiosity but as an engineering discipline with predictable failure modes: weak key management, poor mode selection, expired certificates, and identity systems that cannot be de-provisioned.
Together the two units supply the vocabulary used in every subsequent module. Module 2 assumes students can reason about trust boundaries, authentication strength, and layered controls. Module 3 assumes students understand that governance decisions ultimately resolve into technical controls. Module 1 is where that chain of reasoning begins.
| Module | 1 — Foundations and Technologies |
|---|---|
| Units | Unit 1 — Foundations of Enterprise Cybersecurity Unit 2 — Core Cybersecurity Technologies and Access Control |
| Lessons | 13 (6 in Unit 1, 7 in Unit 2) |
| Discussion forums | Forum 1 — Foundations of Enterprise Cybersecurity Forum 2 — Identity, Access Control, and Zero Trust |
| Assessment | Assignment 1 — Enterprise Cybersecurity Foundations and Technologies (20%) |
| Recommended weeks | Weeks 1–5 |
| Estimated study time | Approximately 60–70 hours across the module |
02 Module learning outcomes
Module 1 contributes to the course learning outcomes through a set of module outcomes drawn from the two units. Upon successful completion of the module, students will be able to:
Foundations
- Explain the scope, objectives, principles, and strategic importance of enterprise cybersecurity.
- Identify and classify enterprise information assets requiring protection.
- Analyse cybersecurity risks affecting organizations.
- Compare cybersecurity frameworks and models, and select those suited to organisational needs.
- Assess organizational cybersecurity posture.
Threat landscape
- Identify major threat actors and analyse modern attack motivations.
- Analyse enterprise breaches and identify success and failure factors.
- Apply security principles to enterprise scenarios.
Core technologies
- Explain core cryptographic principles and evaluate cryptographic applications.
- Compare symmetric and asymmetric algorithms, and select encryption algorithms appropriately.
- Explain PKI architecture and validate digital trust mechanisms.
Identity & access
- Design identity and access management solutions and explain identity governance.
- Compare access-control models and select authentication approaches.
- Explain Zero Trust and apply Zero Trust concepts to enterprises.
Mapping to course learning outcomes
Module 1 introduces and partially develops CLO1 (scope and strategic importance), CLO2 (threats and risk), CLO3 (cryptography and access control), CLO4 (architecture and controls), and CLO5 (applying principles to enterprise systems). It also gives students their first structured practice in CLO9 (scholarly research and communication) through Assignment 1 and the two discussion forums. The authoritative mapping is published on the Module 1 learning outcomes page.
03 Structure and recommended sequence
The module runs across the first five weeks of the course. The sequence below is recommended rather than mandatory, but the two units build on one another: Unit 2 assumes the asset, risk, and framework vocabulary established in Unit 1.
- Unit 1, Lessons 1.1–1.3 — Vocabulary Enterprise cybersecurity as a business issue; assets and their classification; the CIA triad, authenticity, accountability, privacy, and non-repudiation.
- Unit 1, Lessons 1.4–1.6 — Landscape and frameworks Threat actors and motivations; NIST CSF, NIST RMF, ISO/IEC 27001, and defence-in-depth; enterprise breach case studies.
- Forum 1 — Foundations of Enterprise Cybersecurity Initial contribution plus two peer responses. Draws on the Unit 1 readings and scholarly sources.
- Unit 2, Lessons 2.1–2.4 — Cryptography Cryptographic foundations and key management; symmetric algorithms (DES, 3DES, AES); asymmetric algorithms (RSA, ECC, Diffie–Hellman); digital signatures and PKI.
- Unit 2, Lessons 2.5–2.7 — Identity and access IAM and the identity lifecycle; federation; MFA, SSO, RBAC and ABAC; Zero Trust principles and their application.
- Forum 2 — Identity, Access Control, and Zero Trust Initial contribution plus two peer responses, connecting Zero Trust theory to enterprise adoption experience.
- Assignment 1 — Enterprise Cybersecurity Foundations and Technologies Research essay on Zero Trust Architecture plus five applied technical questions drawn from Units 1 and 2. Worth 20% of the final grade.
Pacing guidance
Weeks 1–2 cover Unit 1; weeks 3–5 cover Unit 2 with time reserved for Assignment 1. Students who prefer to read ahead should still complete Unit 1 before beginning Unit 2 — the framework comparison in Lesson 1.5 is used again in the Zero Trust discussion in Lesson 2.7.
04 Units in detail
Unit 1 — Foundations of Enterprise Cybersecurity
Introduces enterprise cybersecurity as a strategic business concern, defines the assets that require protection, establishes the core security objectives and principles, surveys the modern threat landscape, and applies recognised frameworks and models to real enterprise breaches.
Unit learning outcomes
- Explain cybersecurity objectives and principles.
- Define enterprise information assets.
- Analyse cybersecurity risks affecting organizations.
- Evaluate cybersecurity frameworks and models.
- Assess organizational cybersecurity posture.
| Lesson | Title | Core topics |
|---|---|---|
| 1.1 | Introduction to Enterprise Cybersecurity | Evolution of cybersecurity; enterprise digitization; threat landscape; cybersecurity as a business issue |
| 1.2 | Enterprise Information Assets | Data assets; information systems; critical infrastructure; intellectual property |
| 1.3 | Cybersecurity Objectives and Principles | CIA triad; authenticity; accountability; privacy; non-repudiation |
| 1.4 | Enterprise Threat Landscape | Cybercrime; nation-state actors; hacktivism; insider threats |
| 1.5 | Security Frameworks and Models | NIST CSF; NIST RMF; ISO 27001; defense-in-depth |
| 1.6 | Enterprise Cybersecurity Case Studies | Major breaches; lessons learned; security failures; organizational impacts |
Unit 2 — Core Cybersecurity Technologies and Access Control
Examines the cryptographic, identity, and access-control technologies that enforce enterprise security policy — from encryption algorithms and key management through PKI, IAM, authentication and authorization models, and the principles of Zero Trust.
Unit learning outcomes
- Explain core cryptographic principles.
- Evaluate authentication technologies.
- Design access-control solutions.
- Apply identity-management approaches.
| Lesson | Title | Core topics |
|---|---|---|
| 2.1 | Cryptographic Foundations | Encryption; key management; security principles |
| 2.2 | Symmetric Cryptography | DES; Triple DES; AES |
| 2.3 | Asymmetric Cryptography | RSA; ECC; Diffie-Hellman |
| 2.4 | Digital Signatures and PKI | Certificates; certificate authorities; trust models |
| 2.5 | Identity and Access Management | IAM; identity lifecycle; federation |
| 2.6 | Authentication and Authorization | MFA; SSO; RBAC; ABAC |
| 2.7 | Zero Trust Principles | Continuous verification; least privilege; micro-segmentation |
05 Key concepts and recurring themes
Certain ideas introduced in Module 1 recur throughout COMP 6660. Students who internalise them early will find Modules 2 and 3 substantially easier.
- Cyber risk as a business quantity
- Risk is expressed as a combination of likelihood and impact, framed against a stated risk appetite, and communicated in terms that support investment decisions. Technical severity alone does not determine priority.
- Assets before controls
- Controls are selected in response to identified assets and assessed risk. Starting from a product catalogue rather than an asset inventory produces security spending that cannot be justified or measured.
- Layered defence and trust boundaries
- Defence-in-depth assumes that any single control can fail. The architecture question is where trust boundaries sit and which controls are placed at each one.
- Identity as the new perimeter
- As enterprise workloads move to cloud and remote access becomes standard, authentication and authorization displace network location as the primary security boundary. This theme culminates in Zero Trust.
- Cryptography as engineering, not mathematics
- AES, RSA, and elliptic-curve cryptography are rarely broken. The systems built around them routinely are — through weak key management, poor mode selection, misconfigured PKI, or unrotated credentials.
- Compliance is not security
- Frameworks such as ISO/IEC 27001 and NIST CSF provide structure and assurance, but an organisation can be fully compliant and still be breached. Frameworks guide judgement; they do not replace it.
Research integration
Module 1 draws on current research literature, industry frameworks, standards, and enterprise case studies. Recurring research themes include Zero Trust Architecture, cloud security, AI and cybersecurity, cyber risk quantification, and cybersecurity governance. Each is revisited in later modules at greater depth.
06 How Module 1 is assessed
20%
Assignment 1
Enterprise Cybersecurity Foundations and Technologies. Covers Units 1 and 2. Research essay on Zero Trust Architecture plus five applied technical questions.
~3%
Forums 1 & 2
Two of the six graded discussion forums contributing to the 10% online participation component.
Part A
Final examination
Unit 1 and Unit 2 concepts supply much of the foundational material for Part A (20%) of the final examination.
Assignment 1 — research topic
Zero Trust Architecture for Modern Enterprises: Principles, Adoption Challenges, and Implementation Strategies.
Technical questions include:
- Design a Zero Trust Architecture for a distributed enterprise.
- Compare AES and RSA for enterprise applications.
- Design an IAM solution for a healthcare organization.
- Evaluate authentication mechanisms for preventing credential-based attacks.
- Analyse how Zero Trust contributes to confidentiality, integrity, availability, and accountability.
Discussion forums
Each forum requires an initial contribution of approximately 300–500 words, supported by scholarly sources, plus at least two meaningful peer responses. Simple agreement statements are not sufficient.
- Forum 1 — Foundations of Enterprise Cybersecurity. Lessons learned from major incidents; emerging threats; enterprise security challenges. Open →
- Forum 2 — Identity, Access Control, and Zero Trust. Zero Trust adoption experiences; MFA effectiveness; IAM challenges. Open →
The full rubric is published on the online participation page.
07 Study guidance
How long should each lesson take?
Budget approximately four to six hours per lesson, including readings, note-taking, and the lesson activities. The two forums and Assignment 1 require additional time. Module 1 as a whole sits within the 60–70 hour range of the 180–200 hours estimated for the full course.
Should I read Unit 1 before Unit 2?
Yes. Unit 1 establishes the vocabulary — assets, risk, frameworks, trust boundaries — that Unit 2 uses when evaluating cryptographic and access-control choices. Reading Unit 2 first tends to produce tool-focused analysis rather than risk-based reasoning.
How technical is Unit 2?
Unit 2 assumes graduate-level computing literacy but does not require prior cryptography coursework. The emphasis is on evaluating and selecting algorithms and architectures, not on implementing them. Students who want deeper mathematical treatment will find it in the recommended readings listed in Unit 2 resources.
What should I do before starting Assignment 1?
Complete both units and both discussion forums. The assignment expects you to integrate framework analysis (Lesson 1.5), cryptographic evaluation (Lessons 2.1–2.4), and access-control design (Lessons 2.5–2.7) within a single Zero Trust research essay and five technical questions.
Where do I find the authoritative outcomes and mappings?
The Module 1 learning outcomes page contains the full outcome statements and their mapping to the nine course learning outcomes. The course syllabus carries the authoritative assessment scheme and schedule.
Next module
After Assignment 1, continue to Module 2 — Threats, Architecture, and Infrastructure Protection, which begins with threat and risk analysis in Unit 3.