Information Security with a Year in Industry

Core Modules

Year 1

• Security Management and Methods

  In this module you will develop an understanding of the need for effective security management. You will look at alternative security strategies and examine methods for responding to security management problems. You will critically evaluate different approaches and consider security management requirements. Sessions will be delivered by a combination of security practitioners, information managers and academics and you will be encouraged to actively discuss the subject matter, engaging in an online discussion forum.

• Cryptography and Security Mechanisms

  In this module you will develop an understanding of the uses of cryptography. You will look at the basic cryptographic mechanisms used to provide core security services and examine differences between them, identifying situations in which they are most usefully employed. You will consider the issues that need to be addressed to secure an application, and evaluate the limitations of cryptography and methods for supporting it within a full security architecture.

Year 2

• Project (Year in Industry)

  The MSc in Information Security project is a major individual piece of work. It can be of academic nature and aimed at acquiring and demonstrating understanding and the ability to reason about a specific area of information security. Alternatively, the project work may document the ability to deal with a practical aspect of information security. Projects are assessed on the basis of the written report, and possibly on the basis of a demonstration or evaluation of an artefact such as a computer program. Alongside the project, a year in industry student undertakes work experience in the security industry for between 9 and 12 months, where they apply their skills and knowledge in the context of a suitable company/enterprise/organisation. The output from the work experience is a report that provides a factual and reflective discussion of the work experience. The report is written in a suitable professional format and includes description of the company and role undertaken, providing relevant information on skills and knowledge gained and reflection on the work experience.

Optional Modules

There are a number of optional course modules available during your degree studies. The following is a selection of optional course modules that are likely to be available. Please note that although the College will keep changes to a minimum, new modules may be offered or existing modules may be withdrawn, for example, in response to a change in staff. Applicants will be informed if any significant changes need to be made.

Year 1

• Legal and Regulatory Aspects of Information Security

  In this module you will develop an understanding of legal and regulatory risk management in the field of information security and secure e-commerce. You will look at legal obligations and liabilities between private parties, and the implications of government regulations for corporate risk management. You will examine law regulation and liability, voluntary obligations, legal treatment of dematerialised documents and problems of form, involuntary obligations such as negligence, understanding and managing multi-jurisdiction legal and regulatory risk where the laws of several countries apply simultaneously, and the legal treatment of electronic and digital signature systems. You will also consider intellectual property and associated risks, and the basics of data protection and privacy law.

• Cyber Crime

  In this module you will develop an understanding of computer crime and its history, looking at legal measures such as computer misuse, data protection, criminal damage, software piracy, forgery, and investigative powers. You will examine case studies with emphasis on investigations into hacking, computer misuse and forensics, considering malware such as computer viruses, denial of service attacks and trojan horses. You will also gain an insight into issues that may arise in the future for example, the expansion of the internet, pornography, unsuitable material, and social engineering.

• Smart Cards, RFIDs and Embedded Systems Security

  In this module you will develop an understanding of the applications of smart cards and security tokens and their use as assets in cyber security. You will look at the constituent components of common systems, analysing strengths and weaknesses in their manufacture and potential risks and security safeguards. You will consider the range of campabilities of SIM cards in smartphones and the main standards and applications of smarts cards for banking and finance. You will also examine the role of embedded smart card and RFID technology for passports, identity cards, and satellite TV, and the security measures that have protected past and current cards.

• Software Security

  In this module you will develop an understanding of the importance of security in the development of applications. You will look at poor programming practices and how they can be exploited, leading to catastrophic security breaches. You will consider the threat posed by malicious software and examine some of the newer research trends that are likely to influence software security work in the coming years.

• Digital Forensics

  In this module you will develop an understanding of the foundations and theoretical underpinnings of how data is generated, stored, transmitted, and used as evidence. You will look at the methods used for the collection and analysis of digital evidence, and consider how the integrity of the underlying data is maintained. You will examine the general and UK legal requirements for data storage, and consider the frameworks for the handling and processing of such evidence.

• Security Testing

  In this module you will develop an understanding of the common approaches and methodologies used for carrying out and managing security and penetration testing, including legal requirements for such audits. You will look at network protocols, relevant computer system architectures, and web application systems, considering their vulnerabilities, common forms of attack, and security technologies designed to mitigate these. You will gain practical experience of exploiting vulnerabilities to penetrate a system, learning how to design secure systems and defend them against intrusion.

• Cybersecurity to Critical Infrastructure Security

  In this module you will develop an understanding of the key areas of cyber security, with a particular focus on the critical national information (CNI) infrastructure. You will look at fault and attack models for information and cyber-physical systems, considering variants of attack trees. You will analyse large-scale networks and their robustness for both random failures and deliberate attacks, evaluating how key elements of the CNI, such as the internet and power and transport infrasturctures, can be captured by such models. You will also examine case studies of attacks by state actors and security problems in control systems protocols.

• Human Aspects of Information Security and Privacy

  In this module you will develop an understanding of the cultural, societal, political, psychological, and ethical implications of information security and privacy. You will explore the relationships between people and information systems from the perspective of security and privacy. You will critically reflect upon different methodologies that may assist security professionals in developing approaches to ensure that individuals make informed decisions about security and privacy. Sessions will be delivered by a combination of security and privacy practitioners, information managers and academics and you will be encouraged to actively engage in class discussions.