CT7006 - Security Auditing and Penetration Testing (2024/25)
| Module specification | Module approved to run in 2024/25 | ||||||||||||
| Module title | Security Auditing and Penetration Testing | ||||||||||||
| Module level | Masters (07) | ||||||||||||
| Credit rating for module | 20 | ||||||||||||
| School | School of Computing and Digital Media | ||||||||||||
| Total study hours | 200 | ||||||||||||
|
|||||||||||||
| Assessment components |
|
||||||||||||
| Running in 2024/25(Please note that module timeslots are subject to change) |
|
Module summary
This module is designed to introduce principles underlying computer and network security auditing, securing, and penetration testing. It also introduces tools used to assess and validate security posture of a network and its applications. There is an extensive exposure to network threats and vulnerabilities. Students will assess the various security and configuration features required to secure networks.
This module also focuses on guiding students for further specialisation in vendor-neutral security certification programs such as GIAC, ISC, EC-Council, ISACA and networking with industry experts and engage in professional bodies such as BCS-ISSG.
The aim of the module is:
• To provide students with knowledge of the fundamental principles and techniques employed in auditing, securing networks and penetration testing.
• To create awareness of the need for security in computer and communications systems.
• To appraise a security policy and network security posture.
• To enable students to assess security risks and be able to apply appropriate mechanisms to counter the risks
Prior learning requirements
Successful completion of level 6 or equivalent. Available for Study Abroad? NO
Syllabus
Internet and Web security
Security policy design and implementation
Network security auditing and validation of security policy assumptions
Security auditing standards, procedures and toolkits
IT governance frameworks such as COBIT, ITIL, and ISO 17799/27001
Overview and fundamentals of penetration testing - reconnaissance techniques, scanning & sniffing tools
Penetration testing guidance and standards
TCP/IP and encryption techniques.
Types of attacks and countermeasures
Known vulnerabilities in software and protocols used in web and mail servers
Inherited vulnerably of Windows and Linux
Incident handling
Balance of independent study and scheduled teaching activity
A combination of lectures and extensive hands-on practical will be applied to the delivery of this module.
Lectures will focus on the fundamental principles and techniques employed in auditing, securing and penetration testing of information and network systems. Workshops and coursework project will give students opportunities to understand, practice and peer-review how the theory can be applied in a real-world environment. Self-assessments will help students to revise and reflect on the theory learnt.
Students are also encouraged to spend extra time for unsupervised study and practice.
Learning outcomes
On successful completion of the module, the student will be able to:
LO1. Evaluate the security risks presented by computer networks.
LO2. Understand IT governance frameworks and security modelling techniques.
LO3. Identify, implement and deploy a Security Policy, engaging with the Cyber Security community.
LO4. Explain different security protocols and encryption methods, and understand their significance in a secure environment.
LO5. Use security auditing and penetration testing tools and techniques, in securing a network based on the security policy, and assess the protections provided by each tool and technique.