Module 2 · Unit 3 · Unit Overview
COMP 6660 · Enterprise Cybersecurity Unit 3 — Threats, Risks, Vulnerabilities, and Cyber Attacks
The analytical foundation for enterprise security. This page explains what the unit covers, how the seven lessons fit together, and what students are expected to be able to do at the end.
01 Purpose of this unit
Defensive decisions are only as good as the threat and risk analysis that precedes them. Unit 3 builds that analytical discipline.
Unit 1 established what must be protected and why. Unit 3 addresses the next question: against whom, and how? The unit has two halves. The first half — Lessons 3.1 to 3.3 — develops the analytical methods: risk fundamentals, threat modelling, and vulnerability assessment. The second half — Lessons 3.4 to 3.7 — applies those methods to specific attack classes: malware and ransomware, social engineering and phishing, advanced persistent threats, insider threats, and supply-chain compromise.
The unit deliberately begins from risk rather than from tools. Graduate students who arrive from operational roles often have strong intuitions about what attacks look like but limited exposure to the structured methods used to prioritise defences. Unit 3 corrects that imbalance. It treats risk as a governed quantity — likelihood and impact framed against a stated risk appetite — not as a severity score on a scanner report.
The attack-class lessons that follow are not catalogues of exploits. Each lesson examines an attack class through its lifecycle, its indicators, and the points at which detection or disruption is possible. Students are expected to be able to reason about where a defence belongs, not merely to recognise a piece of malware when they see it.
Unit 3 is the analytical foundation for the rest of Module 2. The threat and risk vocabulary developed here is used directly in Unit 4 (architecture and detection) and Unit 5 (platform security), and it is the conceptual basis for Assignment 2.
Where this unit leads
The risk and threat-modelling methods introduced in Lessons 3.1–3.3 are reused throughout Module 2 and revisited in Module 3 as a governance concern. Students who skip or skim these lessons typically produce control-by-control analysis in later units rather than risk-based reasoning.
02 Topics covered
The unit addresses seven topics, each corresponding to one lesson. The topics are grouped into two blocks: analytical methods (3.1–3.3) and attack classes (3.4–3.7).
| Block | Topic | Focus |
|---|---|---|
| Analysis | Cybersecurity risk fundamentals | Risk terminology, likelihood and impact, risk appetite, and the limits of qualitative scoring. |
| Threat modeling methodologies | Structured approaches to identifying assets, adversaries, attack paths, and trust boundaries. | |
| Vulnerability assessment techniques | Scanning, penetration testing, CVSS scoring, and prioritising remediation by real risk. | |
| Attack classes | Malware and ransomware | Malware families and delivery chains, and the evolution of ransomware into an enterprise crisis. |
| Social engineering and phishing | Human-centred attack vectors, pretexting, business email compromise, and countermeasures. | |
| Advanced persistent threats | Nation-state and sophisticated criminal campaigns, dwell time, lateral movement, and detection. | |
| Insider threats and supply chain security | Malicious, negligent, and compromised insiders; third-party and software supply-chain risk. |
Reading strategy
Complete Lessons 3.1–3.3 before starting the attack-class lessons. The risk and threat-modelling vocabulary developed there is used repeatedly in Lessons 3.4–3.7 and again in Unit 4. Students who dive directly into the ransomware lesson tend to treat it as a standalone topic rather than as one instance of a broader risk pattern.
03 Lessons in this unit
Unit 3 contains seven lessons. Each provides readings, a set of core concepts, worked examples where useful, and one or more applied activities.
Lesson 3.1 — Cybersecurity Risk Fundamentals
Introduces risk as a governed quantity expressed against a stated risk appetite, and explains why qualitative severity scoring so often misleads enterprise decision-makers.
Topics
- Risk terminology
- Likelihood and impact
- Risk appetite and tolerance
- Risk treatment: avoid, mitigate, transfer, accept
Objectives
- Explain how risk is framed and quantified.
- Distinguish between technical severity and enterprise risk.
Lesson 3.2 — Threat Modeling Methodologies
Examines structured approaches to identifying assets, adversaries, attack paths, and trust boundaries — the discipline that makes control selection defensible rather than reactive.
Topics
- Threat modelling methods
- Assets and adversaries
- Attack paths
- Trust boundaries
Objectives
- Conduct structured threat analysis.
- Identify attack paths and trust boundaries.
Lesson 3.3 — Vulnerability Assessment Techniques
Introduces scanning, penetration testing, and CVSS scoring — and the practical problem of prioritising remediation when the vulnerability count exceeds the capacity to fix.
Topics
- Scanning techniques
- Penetration testing
- CVSS scoring
- Remediation prioritisation
Objectives
- Assess vulnerabilities using recognised techniques.
- Prioritise remediation by real risk rather than raw counts.
Lesson 3.4 — Malware and Ransomware
Examines malware families and delivery chains, and the evolution of ransomware from a nuisance to an enterprise crisis involving exfiltration, extortion, and organisational disruption.
Topics
- Malware families
- Delivery chains
- Ransomware lifecycle
- Double extortion and enterprise impact
Objectives
- Evaluate malware and ransomware techniques.
- Recommend mitigation strategies proportionate to risk.
Lesson 3.5 — Social Engineering and Phishing
Examines the human-centred attack vectors that remain the most reliable initial-access mechanism for enterprise attackers.
Topics
- Pretexting
- Phishing and spear-phishing
- Business email compromise
- Human factors and countermeasures
Objectives
- Evaluate social engineering techniques.
- Recommend countermeasures that reduce reliance on user vigilance.
Lesson 3.6 — Advanced Persistent Threats
Introduces long-dwell, low-signature campaigns waged by nation-states and sophisticated criminal groups, and the detection problem they pose for enterprise security operations.
Topics
- APT campaigns
- Dwell time
- Lateral movement
- Detection challenges
Objectives
- Evaluate advanced attack techniques.
- Identify detection opportunities across the attack lifecycle.
Lesson 3.7 — Insider Threats and Supply Chain Security
Examines risk from within the enterprise — malicious, negligent, and compromised insiders — and from third-party services, software dependencies, and managed providers.
Topics
- Insider threat types
- Third-party risk
- Software supply chain
- Vendor assurance
Objectives
- Evaluate insider and supply-chain risk.
- Recommend mitigation strategies.
Suggested order
Read Lessons 3.1–3.3 in sequence without interruption. They establish the analytical vocabulary used throughout the rest of the unit. Lessons 3.4–3.7 can be read in any order after that, though many students find Lesson 3.4 (ransomware) the most natural starting point because it connects directly to Assignment 2.
04 Key concepts
The concepts below are introduced or reinforced in Unit 3. Each is used again in Unit 4 (architecture and detection), Unit 5 (platform security), and Module 3 (governance and resilience).
- Risk
- The combination of the likelihood of a threat event and its potential impact on the enterprise, framed against a stated risk appetite. Expressed in business terms, not merely technical severity.
- Risk appetite and tolerance
- Risk appetite is the amount and type of risk an organisation is willing to accept in pursuit of its objectives. Tolerance is the acceptable variation around that appetite. Both are set by governance, not by security teams.
- Threat modelling
- A structured method for identifying assets, adversaries, attack paths, and trust boundaries within a system or enterprise. Produces a defensible basis for control selection.
- Trust boundary
- A line in a system architecture where the level of trust changes — for example, between an internal network and an external service, or between a user session and a backend system. Controls are placed at trust boundaries.
- Vulnerability assessment
- The systematic identification and evaluation of weaknesses in systems, applications, and configurations. Distinct from penetration testing, which attempts to exploit vulnerabilities to demonstrate real impact.
- CVSS
- Common Vulnerability Scoring System. Provides a numerical severity score for a vulnerability. Useful as an input to prioritisation but does not by itself determine enterprise risk — exposure, asset value, and compensating controls must also be considered.
- Malware
- Software designed to cause harm, gain unauthorised access, or otherwise interfere with the normal operation of a system. Includes viruses, worms, trojans, spyware, and ransomware.
- Ransomware
- Malware that encrypts or exfiltrates data and demands payment for its release or non-disclosure. Modern ransomware campaigns typically combine encryption with data theft and extortion, and target enterprise availability and reputation as much as confidentiality.
- Social engineering
- The manipulation of people into performing actions or divulging information. Relies on human cognitive biases rather than technical vulnerabilities, and is a common initial-access vector for enterprise attackers.
- Advanced persistent threat (APT)
- A long-dwell, well-resourced campaign, typically associated with nation-states or sophisticated criminal groups, that seeks persistent access to a target environment rather than immediate disruption.
- Insider threat
- Risk arising from individuals within the enterprise. Distinguishes malicious insiders (deliberate harm), negligent insiders (unintentional error), and compromised insiders (external actor using legitimate credentials).
- Supply chain risk
- Risk arising from third-party services, software dependencies, and managed providers. A single upstream compromise can propagate to thousands of downstream organisations simultaneously.
05 How this unit is assessed
Forum 3 — Threat Intelligence and Risk Management
Unit 3 hosts the third graded discussion forum. Contribute an initial posting of approximately 300–500 words supported by scholarly sources, plus at least two meaningful responses to classmates.
Example discussion topics:
- Risk assessment methodologies.
- Ransomware trends.
- Supply-chain attacks.
Assignment 2 — Threat Analysis and Security Architecture
Unit 3 material is weighted in Assignment 2 (20% of the final grade), which covers Units 3, 4, and 5.
Research topic: Ransomware as an Enterprise Threat: Evolution, Defense Strategies, and Organizational Resilience.
Technical questions drawn from Unit 3:
- Conduct a threat-modeling exercise.
- Analyze a supply-chain cyberattack scenario.
| Outcome | Assessed by |
|---|---|
| Conduct threat analysis | Forum 3; Assignment 2 (Q1); Final exam Parts B and C |
| Assess risks and vulnerabilities | Forum 3; Assignment 2 (Q1); Final exam Part C |
| Evaluate attack techniques | Forum 3; Assignment 2 (Q4); Final exam Part B |
| Recommend mitigation strategies | Assignment 2 (Q4); Final exam Part C |
06 Study guidance
How long should Unit 3 take?
Budget approximately 25–30 hours across the two weeks allotted to the unit. This includes reading, note-taking, the lesson activities, the Forum 3 contribution and peer responses, and the threat-modeling element of Assignment 2.
Do I need hands-on experience with malware or penetration testing?
No. The unit examines attack classes conceptually and analytically. You are not required to handle live malware or perform penetration tests. The emphasis is on understanding attack lifecycles and identifying where defences belong, not on executing attacks.
How do the risk frameworks in Lesson 3.1 differ from those in Module 3?
Lesson 3.1 treats risk as an analytical problem: how to identify, model, and assess it. Module 3, Lesson 6.3 treats risk as a governance problem: how to structure risk management as an organisational process, who owns treatment decisions, and how risk is reported to the board. Both perspectives are examinable, and Assignment 3 in Module 3 requires students to connect them.
What should I do before starting Assignment 2?
Complete all three units of Module 2 and all three forums. Assignment 2 integrates threat modelling (Lesson 3.2), attack-class analysis (Lessons 3.4–3.7), architecture design (Lessons 4.1–4.5), detection (Lessons 4.6–4.7), and platform security (Lessons 5.5–5.6).
Where are the authoritative unit outcomes and mapping?
The Unit 3 learning outcomes page contains the full outcome statements and their mapping to the module and course learning outcomes. The course syllabus carries the authoritative assessment scheme and schedule.
Next
Continue to Unit 4 — Enterprise Security Architectures and Technologies, which begins with security architecture principles in Lesson 4.1.