INFORMATION SECURITY MANAGEMENT - 2023/4

Module Overview

Security is probably the greatest challenge for computer and information system in the near future. Many users have lost data due to viruses, both on home and business computers. Most of us have seen a range of emails messages attempting different kinds of fraud. Vulnerabilities are everywhere. Some are obvious or well-known; others are obscure and harder to spot. Security is not limited to secrecy and confidentiality, but also involves problems like integrity, availability, and effectiveness of information. Moreover, security issues can potentially affect all of us, from innocent home users to companies and even governments.

Security is not just a technical problem but needs to be embedded throughout an organisation to be effective. As such good security solutions build on a complete understanding of the values at stake, and the supporting business processes and requirements. This includes people as well as information systems and physical resources. Consequently, raising security awareness and embedding security within roles and policies is as important, if not more, as secure software. In short, secure solutions can only be implemented with both good technical skills and a good understanding of cultures and people skills.

This module aims at raising the awareness for the wide range of security issues present in today’s connected world and the managerial and organisational challenges a business must face when building a secure solution.

Module provider

Computer Science and Electronic Eng

Module Leader

DRAGAN Catalin (CS & EE)

Number of Credits: 15

ECTS Credits: 7.5

Framework: FHEQ Level 7

Module cap (Maximum number of students): N/A

Module Availability

Semester 1

Prerequisites / Co-requisites

None

Module content

Content includes:

• Introduction to Information Security
  
  
  
  • The business need for security:
  
  
  • Confidentiality, availability, integrity et al
  
  
  • Components of an information system
  
  
  • Regulatory environment
  
  
  
  


• System and security development lifecycles


• Risk Management
  
  
  
  • Risk Management terminology: Agents, threats, vulnerabilities, etc
  
  
  • Risk Identification, assessment (quantitative and qualitative)
  
  
  • Risk appetite and residual risk
  
  
  • Selecting a risk control strategy
  
  
  
  


• Planning for Security
  
  
  
  • Methodologies for Information Security Evaluation and Assurance
  
  
  • ISO 27000, Common Criteria, NIST
  
  
  • Security education and training
  
  
  • Continuity strategies
  
  
  
  


• The role of cryptography in security
  
  
  
  • Cryptographic algorithms and their application
  
  
  • Cryptographic tools, PKI, digital signatures
  
  
  • Examples of secure protocols
  
  
  
  


• Security technologies:
  
  
  
  • Firewalls and VPNs
  
  
  • Intrusion detection, scanning and analysis tools
  
  
  • Physical security controls
  
  
  
  


• Implementing Information Security
  
  
  
  • Information security project management
  
  
  • Technical aspects & Non-technical aspects
  
  
  • Security operations
  
  
  
  

Assessment pattern

Alternative Assessment

N/A

Assessment Strategy

The assessment strategy is designed to provide students with the opportunity to demonstrate that they have achieved the module learning outcomes.

Thus, the summative assessment for this module consists of:

• one in-semester class test addressing L01 and L03


• one final examination addressing L02, L04, and L05

Module aims

• The aim of the module is to equip the students with the analytical skills and knowledge to assess security in systems and organisations, and to incorporate appropriate levels of security in the various steps of a systems lifecycle.

Learning outcomes

Methods of Teaching / Learning

The learning and teaching strategy is designed to help students achieve the learning outcomes of the module through

• in-class discussions of case studies and news articles


• in-class group exercises


• individual directed study and background reading

• Lectures


• Tutorial, workshop or lab sessions


• Online formative tests to give feedback on understanding and progress

Indicated Lecture Hours (which may also include seminars, tutorials, workshops and other contact time) are approximate and may include in-class tests where one or more of these are an assessment on the module. In-class tests are scheduled/organised separately to taught content and will be published on to student personal timetables, where they apply to taken modules, as soon as they are finalised by central administration. This will usually be after the initial publication of the teaching timetable for the relevant semester.

Reading list

https://readinglists.surrey.ac.uk
Upon accessing the reading list, please search for the module using the module code: COMM037

Other information

Digital Capabilities
Computer Security is vital to all aspects of life and this module teaches both theory and practical skills to secure a system at the organisational level. It teaches students how to reason about and develop systems that are secure from the ground up. These skills are now fundamental to developing any large-scale computer system. 

Employability
This module provides a standards-based approach to security that allows students to reason about assets and risks associated with these assets. Students are equipped with theory and practical problem-solving skills that allow them to work with and reason about security in computer and networked systems at the organisational level. Students will learn about securing business assets and assessing and managing risk in computer systems. These skills are highly valuable to employers.

Global and Cultural Skills
Computer Science is a global language and the tools and languages used on this module can be used internationally. This module allows students to develop skills that will allow them to reason about and develop secure applications with global reach and collaborate with their peers around the world. The global standards-based approach allows students to apply their skills internationally.

Resourcefulness and Resilience
This module involves practical problem-solving skills that teach a student how to reason about security in complex hardware and software systems taking a standards-based approach that is applicable to a wide range of everyday problems. Students are presented with realistic scenarios and work with their peers to identify assets and manage and mitigate risk.

Please note that the information detailed within this record is accurate at the time of publishing and may be subject to change. This record contains information for the most up to date version of the programme / module for the 2023/4 academic year.