BS Cybersecurity

Threats, assets, and the record (S1H5H01) is a 45-credit course on BS Cybersecurity, with 450 notional learning hours. By the end, students can map one named system, write a threat model, and specify the controls that would stop the most likely path, using Threats, assets, and the record as the working context rather than a generic management example. The course is taught in three movements. First, students establish the terms and the decision the course is about. Second, they apply the method to a case, dataset, text, or design and compare it with a weaker alternative. Third, they revise the work after feedback and state what the conclusion cannot support. Preparation uses control catalogues, incident write-ups, and a short technical standard. Seminar time is for the decision, not for reading the materials aloud. Assessment is a defensive design with a test plan and a statement of residual risk. A pass requires a clear method, evidence a marker can check, and an explicit limit. Credit is not awarded for summary alone.

• Assets, trust boundaries, and the adversary model — Threats, assets, and the record
• Threat modelling and attack paths — Threats, assets, and the record
• Identity, logging, and segmentation — Threats, assets, and the record
• Detection, containment, and evidence — Threats, assets, and the record
• Residual risk and what a control does not stop — Threats, assets, and the record
• Defensive design, test plan, and after-action review — Threats, assets, and the record

Defensive architecture (S1GLI03) is a 45-credit course on BS Cybersecurity, with 450 notional learning hours. By the end, students can map one named system, write a threat model, and specify the controls that would stop the most likely path, using Defensive architecture as the working context rather than a generic management example. The course is taught in three movements. First, students establish the terms and the decision the course is about. Second, they apply the method to a case, dataset, text, or design and compare it with a weaker alternative. Third, they revise the work after feedback and state what the conclusion cannot support. Preparation uses control catalogues, incident write-ups, and a short technical standard. Seminar time is for the decision, not for reading the materials aloud. Assessment is a defensive design with a test plan and a statement of residual risk. A pass requires a clear method, evidence a marker can check, and an explicit limit. Credit is not awarded for summary alone.

• Assets, trust boundaries, and the adversary model — Defensive architecture
• Threat modelling and attack paths — Defensive architecture
• Identity, logging, and segmentation — Defensive architecture
• Detection, containment, and evidence — Defensive architecture
• Residual risk and what a control does not stop — Defensive architecture
• Defensive design, test plan, and after-action review — Defensive architecture

Privacy and the limit of the award (S1I9F05) is a 45-credit course on BS Cybersecurity, with 450 notional learning hours. By the end, students can map one named system, write a threat model, and specify the controls that would stop the most likely path, using Privacy and the limit of the award as the working context rather than a generic management example. The course is taught in three movements. First, students establish the terms and the decision the course is about. Second, they apply the method to a case, dataset, text, or design and compare it with a weaker alternative. Third, they revise the work after feedback and state what the conclusion cannot support. Preparation uses control catalogues, incident write-ups, and a short technical standard. Seminar time is for the decision, not for reading the materials aloud. Assessment is a defensive design with a test plan and a statement of residual risk. A pass requires a clear method, evidence a marker can check, and an explicit limit. Credit is not awarded for summary alone.

• Assets, trust boundaries, and the adversary model — Privacy and the limit of the award
• Threat modelling and attack paths — Privacy and the limit of the award
• Identity, logging, and segmentation — Privacy and the limit of the award
• Detection, containment, and evidence — Privacy and the limit of the award
• Residual risk and what a control does not stop — Privacy and the limit of the award
• Defensive design, test plan, and after-action review — Privacy and the limit of the award

Workplace project in Cybersecurity (S1HPG07) is a 45-credit course on BS Cybersecurity, with 450 notional learning hours. By the end, students can map one named system, write a threat model, and specify the controls that would stop the most likely path, using Workplace project in Cybersecurity as the working context rather than a generic management example. The course is taught in three movements. First, students establish the terms and the decision the course is about. Second, they apply the method to a case, dataset, text, or design and compare it with a weaker alternative. Third, they revise the work after feedback and state what the conclusion cannot support. Preparation uses control catalogues, incident write-ups, and a short technical standard. Seminar time is for the decision, not for reading the materials aloud. Assessment is a defensive design with a test plan and a statement of residual risk. A pass requires a clear method, evidence a marker can check, and an explicit limit. Credit is not awarded for summary alone.

• Assets, trust boundaries, and the adversary model — Workplace project in Cybersecurity
• Threat modelling and attack paths — Workplace project in Cybersecurity
• Identity, logging, and segmentation — Workplace project in Cybersecurity
• Detection, containment, and evidence — Workplace project in Cybersecurity
• Residual risk and what a control does not stop — Workplace project in Cybersecurity
• Defensive design, test plan, and after-action review — Workplace project in Cybersecurity