Module 2 · Unit 3 · Outcomes & Mapping
COMP 6660 · Enterprise Cybersecurity Unit 3 Learning Outcomes
The authoritative learning outcomes for Unit 3 — Threats, Risks, Vulnerabilities, and Cyber Attacks — together with their lesson coverage, module mapping, and assessment alignment.
01 Unit learning outcomes
Upon completion of Unit 3, students will be able to:
U3.1 — Threat analysis
- Conduct structured threat analysis and threat modelling for enterprise environments.
- Identify assets, adversaries, attack paths, and trust boundaries.
U3.2 — Risk and vulnerability assessment
- Assess risks and vulnerabilities using recognised methodologies and evidence.
- Prioritise remediation by real risk rather than raw severity counts.
U3.3 — Attack techniques
- Evaluate attack techniques across malware, ransomware, social engineering, APTs, insider threats, and supply-chain compromise.
- Explain attack lifecycles and the points at which detection or disruption is possible.
U3.4 — Mitigation strategies
- Recommend mitigation strategies proportionate to assessed risk.
- Justify control selection against enterprise context.
How to read these outcomes
The outcomes above are the authoritative statements for Unit 3. They are verified by Forum 3, Assignment 2, and Parts B and C of the final examination. Their relationship to the module outcomes and course learning outcomes appears in Sections 03 and 04 below.
02 Lesson coverage
| Outcome | Introduced in | Developed in |
|---|---|---|
| U3.1 — Threat analysis | Lesson 3.2 | Lessons 3.2–3.3 |
| U3.2 — Risk and vulnerability assessment | Lesson 3.1 | Lessons 3.1–3.3 |
| U3.3 — Attack techniques | Lesson 3.4 | Lessons 3.4–3.7 |
| U3.4 — Mitigation strategies | Lesson 3.3 | Lessons 3.4–3.7 |
03 Mapping to module outcomes
| Unit outcome | Module outcomes supported |
|---|---|
| U3.1 — Threat analysis | M2.1 (threat analysis and modelling) |
| U3.2 — Risk and vulnerability assessment | M2.2 (risk and vulnerability assessment) |
| U3.3 — Attack techniques | M2.3 (attack technique evaluation) |
| U3.4 — Mitigation strategies | M2.4 (mitigation strategies) |
04 Mapping to course learning outcomes
| CLO | Statement | Coverage in Unit 3 |
|---|---|---|
| CLO1 | Define scope, objectives, principles, and strategic importance. | Reinforced |
| CLO2 | Analyse threats, vulnerabilities, risks, and attack vectors. | Developed and assessed |
| CLO3 | Evaluate cryptographic, authentication, authorization, and access-control technologies. | Applied (credential attacks) |
| CLO4 | Design and assess enterprise cybersecurity architectures and controls. | Introduced (control placement) |
| CLO5 | Apply cybersecurity principles to secure enterprise systems and services. | Introduced (mitigation design) |
| CLO6 | Develop governance, risk, compliance, and policy frameworks. | Introduced (risk frameworks) |
| CLO7 | Evaluate incident response, continuity, and resilience strategies. | Not addressed (Module 3) |
| CLO8 | Assess emerging cybersecurity technologies, trends, and challenges. | Introduced (ransomware, APTs) |
| CLO9 | Conduct scholarly research and communicate findings effectively. | Practised (Forum 3; Assignment 2) |
05 Assessment alignment
| Outcome | Forum 3 | Assignment 2 | Final exam |
|---|---|---|---|
| U3.1 — Threat analysis | ✓ | ✓ | ✓ |
| U3.2 — Risk and vulnerability assessment | ✓ | ✓ | ✓ |
| U3.3 — Attack techniques | ✓ | ✓ | ✓ |
| U3.4 — Mitigation strategies | — | ✓ | ✓ |
06 Progression
- U3.1–U3.2 — Analysis Reused in Unit 4 (architecture design) and Module 3, Lesson 6.3, where risk becomes a governance concern.
- U3.3 — Attack techniques Applied in Unit 4 (detection) and Unit 5 (platform-specific threats), and revisited in Module 3, Lesson 6.7 (incident response).
- U3.4 — Mitigation strategies Developed in Unit 4 (control selection) and integrated in Assignment 2 and the final examination.
How do the risk frameworks here differ from Module 3?
Unit 3 treats risk as an analytical problem: how to identify, model, and assess it. Module 3, Lesson 6.3 treats risk as a governance problem: how to structure risk management as an organisational process, who owns treatment decisions, and how risk is reported to the board. Both perspectives are examinable.
Do I need to handle live malware for this unit?
No. The unit examines attack classes conceptually. You are not required to handle live malware or perform penetration tests. The emphasis is on understanding attack lifecycles and identifying where defences belong.
Where can I find the module-level outcomes?
Module outcomes are published on the Module 2 learning outcomes page.