Overview
This course examines the methods, tools, governance, and professional judgment required to evaluate information-system security and respond to suspected incidents. Topics include threat modeling, risk assessment, security controls, attack surfaces, vulnerability management, identity and access management, network and endpoint security, logging, monitoring, and security policy.
Students develop defensible auditing practices, including defining scope and objectives, inventorying assets and controls, collecting and preserving evidence, reviewing configurations, conducting vulnerability scans, testing controls, applying sampling methods, mapping findings to compliance requirements, writing reports, and planning remediation. Incident response coverage includes preparation, detection and analysis, triage, containment, eradication, recovery, post-incident review, crisis communication, business continuity, and coordination with legal, privacy, management, vendors, and affected users.
Practical work uses authorized laboratory environments and introduces digital forensics concepts including chain of custody, evidence preservation, timeline construction, indicators of compromise, log analysis, and introductory interpretation of memory and disk artifacts. Emphasis is placed on rules of engagement, professional ethics, privacy, accurate documentation, calibrated conclusions, and avoidance of harm. A capstone simulation integrates audit planning, controlled incident analysis, incident recording, stakeholder briefing, and development of a measurable remediation and prevention plan aligned with recognized security frameworks.
Learning Outcomes
- Identify and prioritize information-system risks using threat models, asset inventories, vulnerability findings, and business impact considerations.
- Evaluate technical and administrative security controls against defined objectives, risks, policies, and recognized security frameworks.
- Design and conduct defensible audit procedures, including evidence collection, configuration review, control testing, sampling, and compliance mapping.
- Interpret security logs, monitoring data, vulnerability reports, and introductory forensic artifacts while distinguishing evidence from inference.
- Construct a documented incident timeline and diagnose likely attack activity, scope, impact, and confidence limits.
- Select and justify containment, eradication, recovery, continuity, and communication actions for suspected security incidents.
- Preserve, document, and manage digital evidence according to chain-of-custody requirements and applicable privacy obligations.
- Produce concise, accurate audit and incident reports that communicate findings, uncertainty, risk, and recommended actions to technical and nontechnical stakeholders.
- Synthesize audit and incident findings into measurable remediation, prevention, and governance improvements.
Timetable
| Type | Length | Frequency | Period |
|---|---|---|---|
| Lecture | 2 hours | Weekly | All semester |
| Lab | 2 hours | Weekly | All semester |
| Tutorial | 1 hour | Fortnightly | All semester |
Assessment Schedule
| Type | Description | Weighting |
|---|---|---|
| Assignment | Risk assessment and control evaluation report | 15.00% |
| Deliverable | Audit procedures and evidence documentation | 15.00% |
| Assignment | Incident analysis and timeline exercise | 15.00% |
| Test | Practical security auditing test | 15.00% |
| Capstone | Capstone audit and incident response simulation | 25.00% |
| Exam | Final examination | 15.00% |
Prerequisites
Teaching Staff & Programs
This course is delivered jointly by faculty from the participating programs listed below. In line with the Douchewater Way, the University of Sexology tailors core instruction directly to each cohort's specific discipline — adapting curriculum to program needs rather than forcing students into a one-size-fits-all model. Learn more about our approach at The Douchewater Way.