COMP 6660 · Enterprise Cybersecurity Module 2 — Threats, Architecture, and Infrastructure Protection

01 Purpose and position in the course

Module 2 is where the course becomes technical. It asks how enterprises are actually attacked, how they are architected to resist and detect those attacks, and how the resulting controls are applied across the modern estate.

The module occupies the largest block of study in COMP 6660 — three units, twenty-two lessons, and roughly eleven weeks of the paced schedule. It is deliberately structured as a progression from analysis, through architecture, to application. Each unit prepares the ground for the next.

Unit 3 builds the adversary and risk picture. Students work through risk fundamentals, structured threat modelling, and vulnerability assessment before examining specific attack classes: malware and ransomware, social engineering and phishing, advanced persistent threats, insider threats, and supply-chain compromise. The unit stresses evidence-based mitigation rather than tool-centric thinking.

Unit 4 shifts from adversary to defender. It covers security architecture principles and defence-in-depth, network security protocols, virtual private networks, firewalls and segmentation, and detection technologies including IDS, IPS, SIEM, and XDR. The unit concludes with security operations centre practice — how detection, triage, and response actually run inside an enterprise.

Unit 5 applies these principles across the enterprise estate: operating systems, endpoints, applications, databases, cloud platforms, containers and virtualisation, mobile and IoT devices, and critical infrastructure. The unit stresses that most modern breaches cross these boundaries, and that cloud and platform security now dominate enterprise risk.

Module 2 supplies the technical vocabulary that Module 3's governance, incident-response, and resilience material assumes. Students who can reason about detection coverage, control placement, and platform risk will find the final module substantially easier.

02 Module learning outcomes

Module 2 contributes to the course learning outcomes through a set of module outcomes drawn from the three units. Upon successful completion of the module, students will be able to:

03 Structure and recommended sequence

The module runs across weeks 6–11 of the course. The three units are sequential: Unit 4 assumes the threat vocabulary from Unit 3, and Unit 5 assumes the architectural framing from Unit 4.

1. Unit 3, Lessons 3.1–3.3 — Analysis methods Risk fundamentals; threat modelling methodologies; vulnerability assessment and remediation prioritisation.
2. Unit 3, Lessons 3.4–3.7 — Attack classes Malware and ransomware; social engineering and phishing; advanced persistent threats; insider threats and supply-chain security.
3. Forum 3 — Threat Intelligence and Risk Management Initial contribution plus two peer responses on risk methodologies, ransomware trends, or supply-chain attacks.
4. Unit 4, Lessons 4.1–4.5 — Architecture and network controls Architecture principles; defence-in-depth; network security protocols; VPNs; firewalls and segmentation.
5. Unit 4, Lessons 4.6–4.7 — Detection and operations IDS, IPS, and threat detection; SIEM, XDR, and SOC operations.
6. Forum 4 — Enterprise Security Architectures Initial contribution plus two peer responses on architecture patterns, SOC implementation, or cloud security architectures.
7. Unit 5, Lessons 5.1–5.4 — Compute stack Operating system, endpoint, application, and database security.
8. Unit 5, Lessons 5.5–5.8 — Platforms and critical infrastructure Cloud security; container and virtualisation security; mobile and IoT security; critical infrastructure security.
9. Forum 5 — Systems and Infrastructure Security Initial contribution plus two peer responses on cloud governance, container security, or critical infrastructure protection.
10. Assignment 2 — Enterprise Threat Analysis and Security Architecture Research essay on ransomware as an enterprise threat plus five applied technical questions spanning Units 3–5. Worth 20% of the final grade.

04 Units in detail

05 Key concepts and recurring themes

The concepts below recur across all three units of Module 2 and into Module 3. They form the analytical toolkit students are expected to apply in Assignment 2 and the final examination.

Risk is not severity

A vulnerability rated critical by CVSS is not necessarily the organisation's most important problem. Likelihood, exposure, asset value, and the presence of compensating controls determine what should be fixed first.

Threat modelling precedes control selection

Structured threat modelling identifies assets, adversaries, attack paths, and trust boundaries. Without it, control selection becomes a product catalogue exercise disconnected from the actual attack surface.

Detection economics

Every alert has a cost — in analyst attention, tooling, and response capacity. Detection engineering is as much about reducing false positives and tuning coverage as it is about adding signatures.

Lateral movement and segmentation

Once inside, attackers move east–west between systems. Micro-segmentation, least-privilege service accounts, and identity-aware controls limit how far a single compromised host can reach.

Cloud changes the boundary

The shared responsibility model, cloud identity, and misconfiguration risk have displaced network location as the primary control plane. Most modern enterprise workloads now run on platforms the enterprise does not directly administer.

Supply chain is an enterprise-scale vulnerability

Trust in third-party services, software dependencies, and managed providers means that a single upstream compromise can propagate to thousands of downstream organisations simultaneously.

OT/IT convergence

Industrial control systems and operational technology were designed for availability and safety, not confidentiality. Connecting them to IT networks creates governance and architectural problems that no single control resolves.

06 How Module 2 is assessed

07 Study guidance