CC7180 - Security Auditing and Penetration Testing (2022/23)
| Module specification | Module approved to run in 2022/23 | ||||||||||||
| Module title | Security Auditing and Penetration Testing | ||||||||||||
| Module level | Masters (07) | ||||||||||||
| Credit rating for module | 20 | ||||||||||||
| School | School of Computing and Digital Media | ||||||||||||
| Total study hours | 200 | ||||||||||||
|
|||||||||||||
| Assessment components |
|
||||||||||||
| Running in 2022/23(Please note that module timeslots are subject to change) |
|
Module summary
This module is designed to introduce principles underlying computer and network security auditing, securing, and penetration testing. It also introduces tools used to assess and validate security posture of a network and its applications. There is an extensive exposure to network threats and vulnerabilities. Students will assess the various security and configuration features required to secure networks.
This module also focuses on guiding students for further specialisation in vendor-neutral security certification programs such as GIAC, ISC, EC-Council, ISACA and networking with industry experts and engage in professional bodies such as BCS-ISSG.
The aim of the module is:
• To provide students with knowledge of the fundamental principles and techniques employed in auditing, securing networks and penetration testing.
• To create awareness of the need for security in computer and communications systems.
• To appraise a security policy and network security posture.
• To enable students to assess security risks and be able to apply appropriate mechanisms to counter the risks
Syllabus
• Internet and Web security
• Security policy design and implementation
• Network security auditing and validation of security policy assumptions
• Security auditing standards, procedures and toolkits
• IT governance frameworks such as COBIT, ITIL, and ISO 17799/27001
• Overview and fundamentals of penetration testing - reconnaissance techniques, scanning & sniffing tools
• Penetration testing guidance and standards
• TCP/IP and encryption techniques.
• Types of attacks and countermeasures
• Known vulnerabilities in software and protocols used in web and mail servers
• Inherited vulnerably of Windows and Linux
• Incident handling
Balance of independent study and scheduled teaching activity
• A combination of lectures and extensive hands-on practical will be applied to the delivery of this module.
• Lectures will focus on the fundamental principles and techniques employed in auditing, securing and penetration testing of information and network systems. Workshops and coursework project will give students opportunities to understand, practice and peer-review how the theory can be applied in a real-world environment. Self assessments will help students to revise and reflect on the theory learnt.
• Students are also encouraged to spend extra time for unsupervised study and practice.
Learning outcomes
On successful completion of the module, the student will be able to:
LO1. Evaluate the security risks presented by computer networks.
LO2. Understand IT governance frameworks and security modelling techniques.
LO3. Identify, implement and deploy a Security Policy, engaging with the Cyber Security community.
LO4. Explain different security protocols and encryption methods, and understand their significance in a secure environment.
LO5. Use security auditing and penetration testing tools and techniques, in securing a network based on the security policy, and assess the protections provided by each tool and technique.
Assessment strategy
The assessment consists of two elements; unseen examination testing students understanding of the subject and assesses the LO1-5, and a research and practical based coursework (2500 Words) assessing learning outcomes LO1,4 and 5.
Ongoing formative feedback will be given in the class. Formative feedback will be given in person and also online.