COMP 6660 · Enterprise Cybersecurity Unit 5 — Enterprise Systems and Infrastructure Security

01 Purpose of this unit

Most modern breaches are not defeated at a single control — they cross platforms. Unit 5 examines security at each layer of the enterprise estate and, more importantly, at the boundaries between them.

Units 3 and 4 built the analytical and architectural foundations. Unit 5 applies them. The unit is structured in two movements. The first — Lessons 5.1 to 5.4 — covers the traditional compute stack: operating systems, endpoints, applications, and databases. This is the material most practitioners encounter first, and it remains essential. But it is no longer where most enterprise risk sits.

The second movement — Lessons 5.5 to 5.8 — addresses the platforms that now host most enterprise workloads. Cloud security is examined through the shared responsibility model, cloud identity, misconfiguration, and cloud-native controls. Container and virtualisation security covers image provenance, orchestration hardening, runtime protection, and hypervisor risk. Mobile and IoT security extends the estate to devices the enterprise does not fully control. The unit closes with critical infrastructure security: OT/IT convergence, industrial control systems, regulatory obligations, and national resilience.

Throughout, the unit emphasises that enterprise estates are heterogeneous and interconnected. A single breach frequently crosses several of the platforms studied here, and controls that work well in one context often fail in another. Students are expected to be able to reason about platform-specific risk and to recommend controls that account for the boundaries between platforms, not merely within them.

02 Topics covered

The unit addresses eight topics, each corresponding to one lesson. The topics are grouped into two blocks: the traditional compute stack (5.1–5.4) and modern platforms (5.5–5.8).

03 Lessons in this unit

Unit 5 contains eight lessons. Each provides readings, a set of core concepts, worked examples where useful, and one or more applied activities.

04 Key concepts

The concepts below are introduced or reinforced in Unit 5. Each is used again in Module 3, particularly in the governance, incident-response, and resilience discussions.

Hardening

The process of reducing the attack surface of a system by removing unnecessary services, closing unused ports, disabling default accounts, and applying secure configuration baselines.

Least privilege

The principle that a subject should be granted only the minimum access necessary to perform its function, and only for as long as necessary. Applies to users, services, applications, and administrative accounts alike.

Endpoint Detection and Response (EDR)

A class of tools that continuously monitor endpoint activity, detect suspicious behaviour, and support investigation and response. Complements — and in many enterprises partially replaces — traditional antivirus.

DevSecOps

The integration of security practices into development and operations pipelines, so that security is embedded throughout delivery rather than added at the end. Emphasises automation, dependency scanning, and continuous testing.

Shared responsibility model

The division of security responsibilities between a cloud provider and its customer. The provider secures the cloud (the underlying infrastructure); the customer secures what they put in it (data, identities, configurations, applications).

Cloud misconfiguration

Incorrect configuration of cloud resources — public storage buckets, overly permissive identity policies, exposed management interfaces — that creates risk without any exploitation of a software vulnerability. The most common cause of cloud-related breaches.

Container image provenance

Knowledge of the origin, contents, and integrity of a container image. Weak provenance — building from unverified base images, pulling from untrusted registries — introduces supply-chain risk into every deployment.

Orchestration hardening

Securing container orchestration platforms (Kubernetes and equivalents): controlling access to the control plane, limiting pod privileges, enforcing network policies, and managing secrets securely.

BYOD (Bring Your Own Device)

The practice of allowing employees to use personal devices for work. Extends the enterprise estate to devices the organisation does not own or fully control, and creates tension between user privacy and enterprise security.

IoT constraint

The technical limitations — processing power, memory, battery, physical accessibility — that prevent many IoT devices from supporting standard enterprise security controls. Requires compensating controls at the network and platform level.

OT/IT convergence

The integration of operational technology (industrial control systems, building management, medical devices) with enterprise IT networks. Creates governance and architectural problems because OT was designed for availability and safety, not confidentiality.

Critical infrastructure

Systems and assets whose disruption would have serious consequences for national security, economy, public health, or safety. Typically subject to sector-specific regulation and expected to meet higher resilience standards than general enterprise systems.

05 How this unit is assessed

06 Study guidance