Module 1 · Unit 2 · Forum 2
COMP 6660 · Enterprise Cybersecurity Forum 2 — Identity, Access Control, and Zero Trust
The second graded discussion forum. Analyse the technologies that enforce enterprise security policy — cryptography, identity, access control, and Zero Trust — and evaluate their effectiveness in practice.
01 Forum overview
Forum 2 moves from the strategic and analytical foundations of Unit 1 to the technologies that enforce security policy. It is your opportunity to evaluate identity, access control, and Zero Trust in practice.
The forum runs asynchronously in Brightspace and is one of six graded forums contributing to the 10% online participation component. It draws particularly on Lessons 2.5, 2.6, and 2.7, though the cryptographic material in Lessons 2.1–2.4 provides essential context.
Forum 2 also rehearses the analytical moves that Assignment 1 requires. The assignment's technical questions ask you to design an IAM solution, evaluate authentication mechanisms, and analyse how Zero Trust contributes to confidentiality, integrity, availability, and accountability. Forum 2 is a natural place to develop and test your reasoning on those questions.
Where to post
The forum is hosted in Brightspace, in the Unit 2 Discussion topic under the Discussions tool. This page provides the prompts, requirements, and rubric.
02 Discussion prompts
Choose one of the following prompts for your initial contribution.
Prompt A — Zero Trust adoption experiences
Zero Trust is widely endorsed as an architectural direction, but adoption varies substantially across enterprises. Drawing on scholarly literature, industry reports, and (where appropriate) your own professional context, analyse:
- which Zero Trust principles enterprises adopt first, and why;
- the practical obstacles to full adoption — legacy systems, organisational structure, cost, skills;
- whether the term "Zero Trust" is being used consistently, or whether vendor marketing has diluted it;
- what a realistic Zero Trust roadmap looks like for a mid-sized enterprise.
Support your analysis with at least three scholarly or authoritative sources.
Prompt B — MFA effectiveness and limits
Multi-factor authentication is one of the most effective controls against credential-based attacks, yet attackers continue to bypass it. Analyse:
- the mechanisms through which MFA can be defeated (real-time phishing proxies, MFA fatigue, SIM swapping, session hijacking);
- which MFA approaches are most resistant and why (for example, phishing-resistant FIDO2/WebAuthn versus SMS OTP);
- how enterprises should select and deploy MFA for different user populations;
- what MFA does not protect against, and what compensating controls are needed.
Support your analysis with at least three scholarly or authoritative sources.
Prompt C — IAM challenges in complex enterprises
Identity and access management is often described as the foundation of modern enterprise security, yet IAM programmes routinely struggle. Analyse a specific IAM challenge, such as:
- managing the identity lifecycle across a heterogeneous system landscape;
- governing privileged access and administrative accounts;
- integrating federated identity with third-party providers while preserving assurance;
- reconciling least privilege with the operational reality of role accumulation.
Situate your analysis within the concepts from Lessons 2.5–2.7 and support it with scholarly or authoritative sources.
03 Participation requirements
Forum 2 requires both an initial contribution and peer responses. The requirements are the same as for every forum in the course.
Initial contribution
One substantive posting of approximately 300–500 words that:
- demonstrates understanding of the Unit 2 readings;
- incorporates at least three scholarly sources;
- contributes original analysis;
- links theory to enterprise practice.
Peer responses
At least two meaningful responses to classmates that:
- extend the discussion;
- critically evaluate ideas;
- present alternative perspectives;
- introduce supporting evidence or examples.
Simple agreement is not sufficient.
04 Grading rubric
| Criterion | Weight | What it measures |
|---|---|---|
| Relevance and quality of contributions | 30% | Direct engagement with the prompt, accurate use of Unit 2 concepts, and topical focus. |
| Critical analysis and reflection | 30% | Evaluation, comparison, critique, and original insight rather than summary. |
| Integration of research evidence | 20% | Scholarly and authoritative sources integrated into the argument. |
| Engagement with peers | 20% | Peer responses that extend the discussion and introduce new perspectives. |
| Total | 100% | Contributes to the 10% course participation component. |
05 Alignment with unit outcomes
| Outcome | How the forum addresses it |
|---|---|
| U2.1 — Cryptographic principles | Prompt B discusses phishing-resistant authentication, which rests on cryptographic mechanisms. |
| U2.2 — Authentication technologies | Prompt B directly addresses MFA selection and deployment. |
| U2.3 — Access-control design | Prompts A and C examine least privilege, role accumulation, and segmentation. |
| U2.4 — Identity management | Prompt C addresses the identity lifecycle, federation, and privileged access. |
| CLO9 — Scholarly communication | All prompts require scholarly argument supported by sources. |
06 Guidance for a strong contribution
Should I choose Prompt A if I work in a mature security organisation?
Prompt A can be strong for practitioners, but only if the contribution goes beyond describing your employer's programme. The rubric rewards critical analysis, which means evaluating trade-offs, identifying limits, and comparing your experience with the literature.
How current should my sources be?
Aim for a mix of foundational and recent sources. Cryptographic and identity standards are relatively stable, so foundational texts remain useful. Attack techniques and MFA bypass methods evolve quickly, so prefer sources from the last two to three years for those elements.
Can I cite industry reports or only academic papers?
Both. Industry reports from recognised organisations (ENISA, NIST, MITRE, Verizon, Microsoft, Google) are often the most authoritative source for current attack trends. Academic papers are stronger for conceptual framing. A good contribution typically uses both.
How does Forum 2 help with Assignment 1?
Assignment 1 requires you to design a Zero Trust Architecture, compare AES and RSA, design an IAM solution, and evaluate authentication mechanisms. Forum 2 exercises exactly the reasoning those questions require, and the peer discussion often surfaces perspectives worth carrying into the assignment.
Do I need to respond to peers who chose a different prompt?
Yes — responding to classmates who chose different prompts is often the most valuable part of the forum, because it exposes you to perspectives your own prompt would not have surfaced. Aim for at least one response to a different prompt if possible.
Next
After posting to Forum 2, review the Assignment 1 brief and begin work on the research essay and technical questions.