Module 1 · Unit 2 · Unit Overview
COMP 6660 · Enterprise Cybersecurity Unit 2 — Core Cybersecurity Technologies and Access Control
The technologies that enforce enterprise security policy. This page explains what the unit covers, how the seven lessons fit together, and what students are expected to be able to do at the end.
01 Purpose of this unit
Unit 2 answers the question Unit 1 leaves open: given a set of enterprise assets and a set of security objectives, how does the organisation actually enforce its security policy?
The answer, in the enterprise, is cryptography, identity, and access control. Unit 2 addresses all three. It is the technical counterpart to Unit 1's strategic framing, and the two units together constitute Module 1.
The unit is deliberately structured in two halves. The first half — Lessons 2.1 to 2.4 — covers cryptography. It begins with the foundational security properties that cryptographic systems must satisfy and the role of key management, then compares symmetric algorithms (DES, Triple DES, AES) with asymmetric algorithms (RSA, elliptic-curve cryptography, Diffie–Hellman). It concludes with digital signatures and public key infrastructure, which assemble the primitives into trust infrastructure.
The second half — Lessons 2.5 to 2.7 — covers identity and access. It examines identity and access management across the identity lifecycle, including provisioning, de-provisioning, and federation; evaluates authentication mechanisms (MFA, single sign-on) and access-control models (RBAC, ABAC); and concludes with Zero Trust — the paradigm that unifies identity, least privilege, continuous verification, and micro-segmentation.
Throughout the unit, the emphasis is on evaluation and selection, not on implementation. Students are expected to be able to compare algorithms and architectures against enterprise requirements and to justify their choices — not to write cryptographic code or configure identity systems.
Where this unit leads
The cryptographic and access-control material in Unit 2 is applied in Module 2 within network, cloud, and platform contexts, and it underpins the governance and compliance discussions in Module 3. Zero Trust, in particular, is the research focus of Assignment 1 and reappears throughout the course.
02 Topics covered
The unit addresses seven topics, each corresponding to one lesson. The topics are grouped into two blocks: cryptography (2.1–2.4) and identity/access (2.5–2.7).
| Block | Topic | Focus |
|---|---|---|
| Cryptography | Cryptographic foundations | Encryption, key management, and the security principles cryptography must satisfy. |
| Symmetric cryptography | DES, Triple DES, and AES — comparing algorithms and selecting them appropriately. | |
| Asymmetric cryptography | RSA, elliptic-curve cryptography, and Diffie–Hellman key exchange. | |
| Digital signatures and PKI | Certificates, certificate authorities, and trust models. | |
| Identity & access | Identity and access management | IAM architecture, identity lifecycle, federation, and identity governance. |
| Authentication and authorization | MFA, SSO, RBAC, and ABAC — comparing access-control models. | |
| Zero Trust | Continuous verification, least privilege, and micro-segmentation applied to enterprise environments. |
Reading strategy
Complete Lessons 2.1–2.4 before starting Lesson 2.5. The identity and access material assumes a working understanding of the cryptographic primitives — particularly digital signatures and PKI — introduced in the first half of the unit. Students who try to read Unit 2 out of order typically find the IAM material harder than it needs to be.
03 Lessons in this unit
Unit 2 contains seven lessons. Each provides readings, a set of core concepts, worked examples where useful, and one or more applied activities.
Lesson 2.1 — Cryptographic Foundations
Introduces cryptographic systems as engineering artifacts with predictable failure modes: weak key management, poor mode selection, and unrotated credentials.
Topics
- Encryption
- Key management
- Security principles
Objectives
- Explain cryptographic requirements.
- Evaluate cryptographic applications.
Lesson 2.2 — Symmetric Cryptography
Compares the major symmetric algorithms and the trade-offs that determine which to select for a given enterprise workload.
Topics
- DES (Data Encryption Standard)
- Triple DES (3DES)
- AES (Advanced Encryption Standard)
Objectives
- Compare symmetric algorithms.
- Select encryption algorithms appropriately.
Lesson 2.3 — Asymmetric Cryptography
Examines public-key cryptography and the trade-offs between RSA, elliptic curve cryptography, and Diffie–Hellman key exchange.
Topics
- RSA
- Elliptic Curve Cryptography (ECC)
- Diffie–Hellman key exchange
Objectives
- Explain public-key cryptography.
- Evaluate asymmetric algorithms.
Lesson 2.4 — Digital Signatures and PKI
Assembles cryptographic primitives into trust infrastructure: how enterprises establish, validate, and revoke digital trust.
Topics
- Certificates
- Certificate authorities
- Trust models
Objectives
- Explain PKI architecture.
- Validate digital trust mechanisms.
Lesson 2.5 — Identity and Access Management
Addresses IAM as an architectural discipline: how identity is created, governed, federated, and eventually retired across the enterprise.
Topics
- Identity and access management (IAM)
- Identity lifecycle
- Federation
Objectives
- Design IAM solutions.
- Explain identity governance.
Lesson 2.6 — Authentication and Authorization
Compares authentication mechanisms and access-control models, and evaluates their effectiveness against modern credential-based attacks.
Topics
- Multi-factor authentication (MFA)
- Single sign-on (SSO)
- Role-based access control (RBAC)
- Attribute-based access control (ABAC)
Objectives
- Compare access-control models.
- Select authentication approaches.
Lesson 2.7 — Zero Trust Principles
Introduces the architectural paradigm that unifies identity, least privilege, continuous verification, and micro-segmentation — and connects directly to the research focus of Assignment 1.
Topics
- Continuous verification
- Least privilege
- Micro-segmentation
Objectives
- Explain Zero Trust.
- Apply Zero Trust concepts to enterprises.
Suggested order
Read the seven lessons in sequence. Unlike Unit 1, Unit 2 is genuinely cumulative: each lesson assumes the one before it. Lessons 2.1–2.4 build cryptography; Lessons 2.5–2.7 apply it. If you fall behind, it is better to read them in two blocks with a short break in between than to interleave them.
04 Key concepts
The concepts below are introduced or reinforced in Unit 2. They are used again in Module 2, where cryptographic and access-control choices are evaluated within network, cloud, and platform contexts.
- Encryption
- The transformation of plaintext into ciphertext using an algorithm and a key, such that the plaintext cannot be recovered without the key. Used to protect confidentiality in transit and at rest.
- Key management
- The set of practices for generating, distributing, storing, rotating, and revoking cryptographic keys. Weak key management — not weak algorithms — is the most common cause of cryptographic failure in enterprises.
- Symmetric cryptography
- Encryption using a single shared secret key for both encryption and decryption. Fast and well suited to bulk data. AES is the modern standard; DES and Triple DES are legacy.
- Asymmetric cryptography
- Encryption using a mathematically related key pair: a public key that can be widely distributed and a private key that is kept secret. Slower than symmetric cryptography but enables key exchange and digital signatures. RSA and elliptic-curve cryptography are the dominant algorithms.
- Digital signature
- A cryptographic mechanism that provides authenticity, integrity, and non-repudiation for a message or document by signing it with a private key that can be verified with the corresponding public key.
- Public key infrastructure (PKI)
- The set of roles, policies, and procedures used to create, manage, distribute, and revoke digital certificates. Certificate authorities are the trust anchors within a PKI.
- Identity and access management (IAM)
- The set of processes and technologies used to create, manage, and govern digital identities and their access to enterprise resources. Includes the identity lifecycle, provisioning and de-provisioning, and federation.
- Federation
- The mechanism by which an identity established in one security domain is trusted in another. Enables single sign-on across organisational boundaries but introduces dependency on the trustworthiness of external identity providers.
- Multi-factor authentication (MFA)
- Authentication requiring more than one distinct factor (something the user knows, has, or is). Substantially more resistant to credential-based attacks than single-factor authentication.
- Access-control model
- A structure defining how access decisions are made. RBAC bases decisions on roles; ABAC bases them on attributes of the subject, resource, and environment. RBAC is easier to administer; ABAC is more expressive.
- Zero Trust
- An architectural paradigm in which no subject or device is trusted by default, regardless of network location. Enforces least privilege, continuous verification, and micro-segmentation. Replaces perimeter-based trust models.
05 How this unit is assessed
Forum 2 — Identity, Access Control, and Zero Trust
Unit 2 hosts the second graded discussion forum. Contribute an initial posting of approximately 300–500 words supported by scholarly sources, plus at least two meaningful responses to classmates.
Example discussion topics:
- Zero Trust adoption experiences.
- MFA effectiveness.
- IAM challenges.
Assignment 1 — Foundations and Technologies
Unit 2 material is heavily weighted in Assignment 1 (20% of the final grade), which covers Units 1 and 2.
Research topic: Zero Trust Architecture for Modern Enterprises: Principles, Adoption Challenges, and Implementation Strategies.
Technical questions drawn from Unit 2:
- Design a Zero Trust Architecture for a distributed enterprise.
- Compare AES and RSA for enterprise applications.
- Design an IAM solution for a healthcare organization.
- Evaluate authentication mechanisms for preventing credential-based attacks.
- Analyse how Zero Trust contributes to confidentiality, integrity, availability, and accountability.
| Outcome | Assessed by |
|---|---|
| Explain core cryptographic principles | Forum 2; Assignment 1 (Q2); Final exam Part B |
| Evaluate authentication technologies | Forum 2; Assignment 1 (Q4); Final exam Part B |
| Design access-control solutions | Assignment 1 (Q3); Final exam Part B |
| Apply identity-management approaches | Forum 2; Assignment 1 (Q3); Final exam Part B |
06 Study guidance
How long should Unit 2 take?
Budget approximately 40–45 hours across the three weeks allotted to the unit. This includes reading, note-taking, the lesson activities, the Forum 2 contribution and peer responses, and the bulk of Assignment 1. Unit 2 is the largest single unit in Module 1 by study time.
How technical is the cryptography material?
The unit does not require prior cryptography coursework and does not involve implementing algorithms. It focuses on the security properties cryptographic systems must satisfy, the trade-offs between major algorithms, and the failure modes that matter in enterprises. Students who want deeper mathematical treatment will find it in the recommended readings listed in Unit 2 resources.
Do I need to memorise the algorithms?
You should be able to compare AES and RSA, explain when each is appropriate, describe the role of key length and mode selection, and identify common cryptographic failure modes. You should not attempt to memorise the internal workings of the algorithms — the assessment focuses on evaluation and selection, not implementation.
How does Zero Trust relate to the rest of the course?
Zero Trust is one of the course's recurring research themes. It is the research focus of Assignment 1, a key architectural concept in Module 2 (Units 4 and 5), and an explicit integration point in Assignment 3 in Module 3. The Zero Trust material in Lesson 2.7 is therefore worth reading particularly carefully.
What should I do before starting Assignment 1?
Complete both units and both discussion forums. Assignment 1 expects you to integrate framework analysis (Lesson 1.5), cryptographic evaluation (Lessons 2.1–2.4), and access-control design (Lessons 2.5–2.7) within a single Zero Trust research essay and five technical questions.
Where are the authoritative unit outcomes and mapping?
The Unit 2 learning outcomes page contains the full outcome statements and their mapping to the module and course learning outcomes. The course syllabus carries the authoritative assessment scheme and schedule.
Next
After completing Assignment 1, continue to Module 2 — Threats, Architecture, and Infrastructure Protection, which begins with threat and risk analysis in Unit 3.