module specification

This module is designed to introduce principles underlying computer and network security auditing, securing, and penetration testing. It also introduces tools used to assess and validate the security posture of a network and its applications. This module will mainly employ experiential learning. The students will learn through a series of theory-based lectures and associated practical classes and workshops based on each of the module’s topics. Students will develop their skills by applying their knowledge and techniques to discover vulnerabilities and develop exploits in a range of real-world scenarios. Directed and independent study activities will underpin the materials presented and provide opportunities for students to put theory into practice in real-world use cases.

There is extensive exposure to network/system threats and vulnerabilities. Students will assess the various security and configuration features required to secure networks and systems. This module also focuses on guiding students for further specialisation in vendor-neutral security certification programs such as GIAC, ISC, EC-Council, ISACA networking with industry experts and engaging in professional bodies such as BCS-ISSG.

The aim of the module is:

• To provide students with knowledge of the fundamental principles and techniques employed in auditing systems, securing networks and penetration testing.

• To create awareness of the need for security in computer and communications systems.

• To appraise a security policy and network security posture.

• To enable students to assess security risks and be able to apply appropriate mechanisms to counter the risks

Week 1: Overview and fundamentals of penetration testing - reconnaissance techniques, scanning & sniffing tools

Week 2: Penetration testing guidance and standards

Week 3: Cyber Security standards and governance frameworks such as ISO-27001, PCI-DSS, HIPAA, NIST-CSF, CSA-CCM

Week 4: Vulnerability scanning and management tools (Nessus/Open-VAS)

Week 5: Determine vulnerabilities in software and protocols used in web and mail servers

Week 6: Basics of Social Engineering; Fuzzing (Network TCP/IP, Application, Authentication), Reverse Engineering (COFF/PE and ELF Formats, Static and Dynamic Analysis, Simulation and debugging).

Week 7: Pen-testing active directory environments

Week 8: Vulnerability Development for Unix and Windows (Heap/Stack overflows, Integer smashing, Shellcode, Exception creation overflows)

Week 9 : Tools and frameworks (e.g., Metasploit and Post-Exploitation Attack Frameworks)

Week 10: Methods to bypass AV tools on Targets and Chained exploits and Scripting (e.g., Python / Ruby/ Bash)

Week 11: Security analysis of embedded systems (e.g. firmware, JTAG) and Internet of Things (IoT)

Week 12: ICT exam and Coursework support session

A combination of lectures and extensive hands-on practical will be applied to the delivery of this module.  

Lectures will focus on the fundamental principles and techniques employed in auditing, securing and penetration testing of information and network systems. Workshops and coursework project will give students opportunities to understand, practice and peer-review how the theory can be applied in a real-world environment. Self-assessments will help students to revise and reflect on the theory learnt. 

Students are also encouraged to spend extra time for unsupervised study and practice.

On successful completion of the module, the student will be able to:

LO1. Evaluate the security risks presented by computer networks and systems

LO2. To understand the requirements of the delivery of a penetration testing service (e.g., blue team/red team).

LO3. To manage the creation and delivery of a penetration testing service.

LO4. Explain different security frameworks and methods, and understand their significance in a secure environment.

LO5. Use security auditing and penetration testing tools and techniques, in securing systems, and assess the protections provided by each tool and technique.

https://rl.talis.com/3/londonmet/lists/2CD54460-C1FA-7221-47F3-61472DC9B7A8.html?lang=en&login=