Module 1 · Unit 1 · Unit Overview
COMP 6660 · Enterprise Cybersecurity Unit 1 — Foundations of Enterprise Cybersecurity
The vocabulary, principles, and frameworks on which the whole course rests. This page explains what the unit covers, why it is sequenced first, and how each lesson fits together.
01 Purpose of this unit
Unit 1 establishes what enterprise cybersecurity is, what it protects, and why it matters to the organisation as a whole. It is sequenced first because every later unit in the course assumes the vocabulary introduced here.
Graduate students often arrive in a cybersecurity course with strong technical intuitions and limited exposure to the strategic and managerial dimensions of the field. Unit 1 deliberately begins from the business problem rather than from the technology. It positions cybersecurity as a discipline shaped by enterprise digitisation — cloud platforms, mobile devices, third-party services, and operational technology — and by the pressures of cost, regulation, and reputational risk.
The unit then builds the conceptual apparatus required for analysis. Students learn to identify and classify the assets an enterprise must protect, work through the security objectives that define what "secure" means in a given context, and survey the threat landscape through its principal actors and motivations. Recognised frameworks and models — NIST CSF, NIST RMF, ISO/IEC 27001, and defence-in-depth — are compared and evaluated against organisational needs. The unit closes with documented enterprise breaches, used to identify success and failure factors and to show the organisational consequences of security failure.
By the end of the unit, students should be able to reason about enterprise cybersecurity in the language of risk and governance, not only in the language of controls and tools. That capability is essential for the rest of COMP 6660.
Where this unit leads
The asset, risk, and framework vocabulary introduced in Unit 1 is used throughout Module 2 (threat modelling and architecture) and Module 3 (governance, compliance, and resilience). Students who skip or skim Unit 1 typically struggle to frame later assignments in terms of risk.
02 Topics covered
The unit addresses six topics, each corresponding to one lesson. The topics are sequenced so that each builds on the vocabulary of the previous one.
| Topic | Focus |
|---|---|
| Evolution and digitisation | How cybersecurity has changed as enterprise systems have moved from a perimeter model to a distributed, cloud-centric model. |
| Enterprise information assets | What must be protected: data, information systems, critical infrastructure, and intellectual property. |
| Security objectives and principles | The CIA triad, authenticity, accountability, privacy, and non-repudiation. |
| Threat landscape | Cybercrime, nation-state actors, hacktivism, and insider threats — and the motivations behind each. |
| Frameworks and models | NIST CSF, NIST RMF, ISO/IEC 27001, and defence-in-depth: how they compare and when to use each. |
| Enterprise case studies | Documented breaches analysed for lessons learned, failure factors, and organisational impact. |
Reading strategy
Topics 1–3 establish vocabulary that is used continuously. Read them with care and take notes on the definitions. Topics 4–6 are more analytical and can be read with a case study or current news item in mind — a running example of a real enterprise makes the framework comparison in Lesson 1.5 much easier to apply.
03 Lessons in this unit
Unit 1 contains six lessons. Each provides readings, a set of core concepts, worked examples where useful, and one or more applied activities.
Lesson 1.1 — Introduction to Enterprise Cybersecurity
Introduces enterprise cybersecurity as a distinct discipline shaped by enterprise digitisation, and frames it as a business issue rather than a purely technical one.
Topics
- Evolution of cybersecurity
- Enterprise digitization
- Threat landscape
- Cybersecurity as a business issue
Objectives
- Define enterprise cybersecurity.
- Explain cybersecurity's strategic importance.
- Distinguish enterprise cybersecurity from traditional IT security.
Lesson 1.2 — Enterprise Information Assets
Defines the assets that enterprise cybersecurity exists to protect and introduces classification as the basis for control selection.
Topics
- Data assets
- Information systems
- Critical infrastructure
- Intellectual property
Objectives
- Identify enterprise assets requiring protection.
- Classify organizational information assets.
Lesson 1.3 — Cybersecurity Objectives and Principles
Establishes the security objectives that define what "secure" means in a given enterprise context, and how to apply them to scenarios.
Topics
- CIA triad (confidentiality, integrity, availability)
- Authenticity
- Accountability
- Privacy
- Non-repudiation
Objectives
- Explain cybersecurity objectives.
- Apply security principles to enterprise scenarios.
Lesson 1.4 — Enterprise Threat Landscape
Surveys the principal threat actors and their motivations, building the adversary picture that Unit 3 in Module 2 will develop in depth.
Topics
- Cybercrime
- Nation-state actors
- Hacktivism
- Insider threats
Objectives
- Identify major threat actors.
- Analyse modern attack motivations.
Lesson 1.5 — Security Frameworks and Models
Compares the dominant cybersecurity frameworks and the defence-in-depth architectural model, and provides a basis for selecting among them.
Topics
- NIST Cybersecurity Framework (CSF)
- NIST Risk Management Framework (RMF)
- ISO/IEC 27001
- Defense-in-depth
Objectives
- Compare cybersecurity frameworks.
- Select frameworks for organizational needs.
Lesson 1.6 — Enterprise Cybersecurity Case Studies
Applies the unit's concepts to documented enterprise breaches, using them to identify what goes wrong in practice and what organisations can learn.
Topics
- Major breaches
- Lessons learned
- Security failures
- Organizational impacts
Objectives
- Analyse enterprise breaches.
- Identify success and failure factors.
Suggested order
Read Lessons 1.1–1.3 in sequence without interruption. The definitions of assets, objectives, and principles are used repeatedly in the rest of the unit and in Unit 2. Lessons 1.4–1.6 can be read in any order after that, though many students find Lesson 1.5 easier if Lesson 1.4 has been completed first.
04 Key concepts
The concepts below are introduced or reinforced in Unit 1. Each is used again later in the course, so it is worth capturing them in your own words as you work through the lessons.
- Enterprise cybersecurity
- The set of technologies, architectures, governance frameworks, risk methodologies, and operational practices used to protect an enterprise's information assets and the systems and services that depend on them. Distinguished from traditional IT security by its strategic scope, enterprise-wide accountability, and integration with business risk.
- Information asset
- Any data, system, service, or capability whose compromise would harm the enterprise. Includes data assets, information systems, critical infrastructure, and intellectual property.
- CIA triad
- Confidentiality (information is accessible only to those authorised), integrity (information is accurate and unaltered), and availability (information and systems are accessible when required). The foundational objectives of information security.
- Authenticity, accountability, non-repudiation
- Authenticity: the assurance that a subject or message is genuine. Accountability: the ability to attribute actions to specific subjects. Non-repudiation: the inability of a party to deny having performed an action.
- Threat actor
- An individual or group that poses a threat to enterprise assets. Principal categories include cybercriminals, nation-state actors, hacktivists, and insiders.
- Risk
- The combination of the likelihood of a threat event and its potential impact on the enterprise. Expressed against a stated risk appetite.
- Security framework
- A structured set of practices, controls, and outcomes used to organise and assess an enterprise security programme. NIST CSF, NIST RMF, and ISO/IEC 27001 are the dominant examples.
- Defence-in-depth
- An architectural principle that places multiple, overlapping controls at different layers so that the failure of any single control does not compromise the enterprise.
- Security posture
- The overall state of an enterprise's security controls, processes, and culture at a given point in time. Assessed against frameworks such as NIST CSF and evaluated in Lesson 1.5.
05 How this unit is assessed
Forum 1 — Foundations of Enterprise Cybersecurity
Unit 1 hosts the first of six graded discussion forums. Contribute an initial posting of approximately 300–500 words that draws on the readings and scholarly sources, plus at least two meaningful responses to classmates.
Example discussion topics:
- Lessons learned from major cyber incidents.
- Emerging cybersecurity threats.
- Enterprise security challenges.
Assignment 1 — Foundations and Technologies
Unit 1 material contributes to Assignment 1 (20% of the final grade), which covers Units 1 and 2.
Research topic: Zero Trust Architecture for Modern Enterprises: Principles, Adoption Challenges, and Implementation Strategies.
Unit 1 concepts — particularly frameworks, risk, and asset classification — supply the analytical framing for the research essay and the design questions.
| Outcome | Assessed by |
|---|---|
| Explain cybersecurity objectives and principles | Forum 1; Assignment 1; Final exam Part A |
| Define enterprise information assets | Forum 1; Assignment 1 |
| Analyse cybersecurity risks affecting organizations | Forum 1; Assignment 1; Final exam Parts A and B |
| Evaluate cybersecurity frameworks and models | Forum 1; Assignment 1; Final exam Part A |
| Assess organizational cybersecurity posture | Forum 1; Assignment 1 |
06 Study guidance
How long should Unit 1 take?
Budget approximately 20–25 hours across the two weeks allotted to the unit. This includes reading, note-taking, the lesson activities, the Forum 1 contribution and peer responses, and the start of Assignment 1.
Do I need to memorise the frameworks?
You should be able to describe what each framework is for, how they differ, and when you would choose one over another. You should not attempt to memorise every control in NIST CSF or ISO/IEC 27001 — the assessment focuses on your ability to compare, select, and apply frameworks, not to recall their content exhaustively.
How does Unit 1 relate to Unit 2?
Unit 1 answers what must be protected and why. Unit 2 answers how — through cryptography, identity, and access control. The two units are designed to be read in sequence. You will find Unit 2 much easier if you have completed Unit 1 first, particularly Lessons 1.2 and 1.3.
What should I do if I already work in cybersecurity?
You may find parts of Unit 1 familiar. Even so, do not skip it. The unit's value for experienced practitioners is its emphasis on framing — expressing security problems in terms of assets, risk, and frameworks. That framing is what separates graduate-level analysis from operational practice, and it is what Assignment 1 and the final examination assess.
Where are the authoritative unit outcomes and mapping?
The Unit 1 learning outcomes page contains the full outcome statements and their mapping to the module and course learning outcomes. The course syllabus carries the authoritative assessment scheme and schedule.
Next
Continue to Unit 2 — Core Cybersecurity Technologies and Access Control, which begins with cryptographic foundations in Lesson 2.1.