CAB443 Systems Security
To view more information for this unit, select Unit Outline from the list below. Please note the teaching period for which the Unit Outline is relevant.
| Unit code: | CAB443 |
|---|---|
| Prerequisite(s): | IFB103 and IAB246 (IAB246 can be studied in the same semester) |
| Assumed Knowledge: | 1. Familiarity with principles of systems design. 2. Well-developed understanding of the multifaceted aspects of cybersecurity, having studied the evolving cyber threat landscape and its impact on individuals and organizations. |
| Credit points: | 12 |
| Timetable | Details in HiQ, if available |
| Availabilities |
|
Unit Outline: Semester 1 2027, Gardens Point, Internal
| Unit code: | CAB443 |
|---|---|
| Credit points: | 12 |
| Pre-requisite: | IFB103 and IAB246 (IAB246 can be studied in the same semester) |
| Assumed Knowledge: | 1. Familiarity with principles of systems design. 2. Well-developed understanding of the multifaceted aspects of cybersecurity, having studied the evolving cyber threat landscape and its impact on individuals and organizations. |
Overview
Systems security focuses on the organisational practices that ensure the security requirements of systems, which are composed of interconnected components and connections and the networking software that supports those interconnections. More specifically, systems security requires a holistic design thinking approach to systems. This includes the importance of security policy models, as well as organised identification and authentication processes. Systems security also addresses system access control, system management, system control processes, system recovery and system security documentation.
Learning Outcomes
On successful completion of this unit you will be able to:
- Discuss the importance of system thinking in the provision of system security to meet organisational needs.
- Explain the major components of system security, noting the relationships between them.
- Make fully justified recommendations for the most appropriate security models for specific organisational contexts and business environments.
- Analyse applications of AI in organisations, and evaluate the impact (positive and negative) on system security.
- Discuss the ethical issues associated with various system security design choices, and the effects on a diverse range of stakeholders including Aboriginal and Torres Straits Islander peoples.
- Collaborate with others in a team environment to write a report for a client, using appropriate and professional language, addressing the impact of AI use on the system security for a case study organisation.
Content
This unit covers five (5) distinct areas which define systems security:
System Thinking
- What is a system? - Holistic approaches; Security of systems – general purpose and special purpose; Fundamental principles & ethics; Systems engineering artifacts to inform security risk management; threat models; vulnerability models.
System Management
- Techniques for including security considerations throughout the management of a system; Policy models – such as Clark Wilson, Bell LaPadula, Chinese Wall, Biba; System lifecycle – commissioning, operation, decommissioning; Patching and vulnerability lifecycle; Usability and automation considerations; documentation for security & assurance
Identity Management
- Identity management and authentication principles; Multi-factor authentication; Authentication mechanisms: knowledge based, object based, biometrics; Authentication in Distributed Systems (e.g. Needham-Schroeder Protocol, Kerberos, SAML, OAuth);
System Access
- Authorisation and Access Control defined; Access control approaches and authorisation (RBAC, DAC, MAC, ...); Access control implementation: Physical and Logical, ACL, Matrix; Monitoring system access - logs
System Control
- Policies; Privacy and accountability; Tools to support accountability in isolated and distributed systems; intrusion detection: principles, models (anomaly based, rule-based, signature based, specification-based techniques); examples of attacks and indicators of compromise; recovery resilience
The unit concludes with examples of common system architectures such as virtual machines, ICS, IoT, Embedded systems, Autonomous systems, Mobile systems.
Learning Approaches
- Weekly lectures introduce theoretical aspects of system security relevant to the weekly topic.
- Tutorials reinforce lecture content and demonstrate real-world applications.
- Online resources (such as reading materials) will help you enhance your understanding of the theoretical concepts introduced in this unit.
Feedback on Learning and Assessment
- self-assess your responses to provided question sets and presented material
- formative peer assessment of your tutorial preparation
- formative in-class feedback provided by unit staff during tutorial classes
- feedback on your assessment items via the rubric and written feedback, individually and during scheduled review sessions
- private consultation (through appointment) with teaching staff
Assessment
Overview
This unit introduces foundational system security concepts and principles, so the assessment is largely based around the knowledge acquired throughout the semester. Assessment tasks include assignments (both individual and group) and a final exam. You should be able to work both independently and as a productive and cooperative team member.
The assignments in this unit offer a comprehensive exploration of system security concepts and practices. Students will investigate the relationship between people, processes, and technology in shaping system security, while considering ethical and privacy implications and the benefits of diversity and inclusion.
Students will demonstrate knowledge and application of common organisational practices that ensure the security requirements of systems are met, and that diverse stakeholder viewpoints are considered. The assignments focus on practical system security solutions. Through collaborative teamwork, students refine their ability to develop a roadmap for improving system security and to articulate system security recommendations to technical and non-technical audiences.
Independent work is required to complete some assessment items. For these items, although you may discuss the assessment topics with others, the work you submit for assessment must be your own individual effort. It is your responsibility to ensure that your work is completed in a timely manner. For group assessment tasks it is the responsibility of all group members to ensure the work is completed.
Unit Grading Scheme
7- point scale
Assessment Tasks
Assessment: Research Paper
In this assignment, you will produce a research paper outlining the concepts and principles underlining systems security. The paper will discuss core challenges and opportunities related to system security that must be understood by organisations as they implement secure business applications.
This assignment is intended to demonstrate mastery of foundational knowledge and understanding of system security principles that will then be applied in the group assignment (Assessment task 2).
The ethical and responsible use of generative artificial intelligence (GenAI) tools is authorised in this assessment. See the relevant assessment details in Canvas for specific guidelines.
This assignment is eligible for the 48-hour late submission period and assignment extensions.
Assessment: Group Report
In this assignment, you will be presented with a case study of an organisation undertaking a major IT project that includes the use of AI. You will work in a team to identify and analyse issues associated with the IT project, taking into account a variety of diverse stakeholders - both internal and external. You must apply your knowledge of system security to compare and contrast a range of solutions and make clear recommendations appropriate for the business environment (relating to system security). You will write a professional report to be presented to senior management of the case study organisation.
The ethical and responsible use of generative artificial intelligence (GenAI) tools is authorised in this assessment. See the relevant assessment details in Canvas for specific guidelines.
This assignment is eligible for the 48-hour late submission period and assignment extensions.
Assessment: Final Examination
You will be expected to physically attend an examination centre to take a written examination. For internal students this will be held on a QUT Campus. The examination will test your knowledge of the CAB443 learning material from across the semester: Weeks 1-13.
The use of generative artificial intelligence (GenAI) tools is prohibited during this assessment.
The late submission period does not apply and no assignment extensions are available.
Academic Integrity
Academic integrity is a commitment to undertaking academic work and assessment in a manner that is ethical, fair, honest, respectful and accountable.
The Academic Integrity Policy sets out the range of conduct that can be a failure to maintain the standards of academic integrity. This includes, cheating in exams, plagiarism, self-plagiarism, collusion and contract cheating. It also includes providing fraudulent or altered documentation in support of an academic concession application, for example an assignment extension or a deferred exam.
You are encouraged to make use of QUT’s learning support services, resources and tools to assure the academic integrity of your assessment. This includes the use of text matching software that may be available to assist with self-assessing your academic integrity as part of the assessment submission process.
Breaching QUT’s Academic Integrity Policy or engaging in conduct that may defeat or compromise the purpose of assessment can lead to a finding of student misconduct (Code of Conduct – Student) and result in the imposition of penalties under the Management of Student Misconduct Policy, ranging from a grade reduction to exclusion from QUT.
Requirements to Study
Costs
No extraordinary charges and costs are associated with the requirements of this unit.
Resources
Risk Assessment Statement
There are no extraordinary risks associated with the classroom/ lecture activities in this unit.
Course Learning Outcomes
This unit is designed to support your development of the following course/study area learning outcomes.IN01 Bachelor of Information Technology
- Demonstrate a broad theoretical and technical knowledge of well-established and emerging IT disciplines, with in-depth knowledge in at least one specialist area aligned to multiple ICT professional roles.
Relates to: ULO2, Research Paper, Final Examination - Critically analyse and conceptualise complex IT challenges and opportunities using modelling, abstraction, ideation and problem-solving to generate, evaluate and justify recommended solutions.
Relates to: ULO3, Group Report, Final Examination - Demonstrate an understanding of the role of IT in enabling business outcomes and how business realities shape IT decisions.
Relates to: ULO1, ULO3, Research Paper, Group Report - Assess the risks and potential of artificial intelligence (and other disruptive emerging technologies) within an organisation and leverage AI knowledge and skills to solve IT challenges, improve productivity and add value.
Relates to: ULO4, Group Report - Critically reflect, using a human-centric approach, on the social, cultural, ethical, privacy, legal, sustainability, and accessibility issues shaping the development and use of IT, including respecting the perspectives and knowledge systems of Aboriginal and Torres Strait Islander peoples, ensuring IT solutions empower and support people with disabilities, and fostering inclusive and equitable digital technologies that serve diverse communities.
Relates to: ULO5, Group Report, Final Examination
Unit Outline: Semester 1 2027, Online
| Unit code: | CAB443 |
|---|---|
| Credit points: | 12 |
| Pre-requisite: | IFB103 and IAB246 (IAB246 can be studied in the same semester) |
| Assumed Knowledge: | 1. Familiarity with principles of systems design. 2. Well-developed understanding of the multifaceted aspects of cybersecurity, having studied the evolving cyber threat landscape and its impact on individuals and organizations. |
Overview
Systems security focuses on the organisational practices that ensure the security requirements of systems, which are composed of interconnected components and connections and the networking software that supports those interconnections. More specifically, systems security requires a holistic design thinking approach to systems. This includes the importance of security policy models, as well as organised identification and authentication processes. Systems security also addresses system access control, system management, system control processes, system recovery and system security documentation.
Learning Outcomes
On successful completion of this unit you will be able to:
- Discuss the importance of system thinking in the provision of system security to meet organisational needs.
- Explain the major components of system security, noting the relationships between them.
- Make fully justified recommendations for the most appropriate security models for specific organisational contexts and business environments.
- Analyse applications of AI in organisations, and evaluate the impact (positive and negative) on system security.
- Discuss the ethical issues associated with various system security design choices, and the effects on a diverse range of stakeholders including Aboriginal and Torres Straits Islander peoples.
- Collaborate with others in a team environment to write a report for a client, using appropriate and professional language, addressing the impact of AI use on the system security for a case study organisation.
Content
This unit covers five (5) distinct areas which define systems security:
System Thinking
- What is a system? - Holistic approaches; Security of systems – general purpose and special purpose; Fundamental principles & ethics; Systems engineering artifacts to inform security risk management; threat models; vulnerability models.
System Management
- Techniques for including security considerations throughout the management of a system; Policy models – such as Clark Wilson, Bell LaPadula, Chinese Wall, Biba; System lifecycle – commissioning, operation, decommissioning; Patching and vulnerability lifecycle; Usability and automation considerations; documentation for security & assurance
Identity Management
- Identity management and authentication principles; Multi-factor authentication; Authentication mechanisms: knowledge based, object based, biometrics; Authentication in Distributed Systems (e.g. Needham-Schroeder Protocol, Kerberos, SAML, OAuth);
System Access
- Authorisation and Access Control defined; Access control approaches and authorisation (RBAC, DAC, MAC, ...); Access control implementation: Physical and Logical, ACL, Matrix; Monitoring system access - logs
System Control
- Policies; Privacy and accountability; Tools to support accountability in isolated and distributed systems; intrusion detection: principles, models (anomaly based, rule-based, signature based, specification-based techniques); examples of attacks and indicators of compromise; recovery resilience
The unit concludes with examples of common system architectures such as virtual machines, ICS, IoT, Embedded systems, Autonomous systems, Mobile systems.
Learning Approaches
- Weekly lectures introduce theoretical aspects of system security relevant to the weekly topic.
- Tutorials reinforce lecture content and demonstrate real-world applications.
- Online resources (such as reading materials) will help you enhance your understanding of the theoretical concepts introduced in this unit.
Feedback on Learning and Assessment
- self-assess your responses to provided question sets and presented material
- formative peer assessment of your tutorial preparation
- formative in-class feedback provided by unit staff during tutorial classes
- feedback on your assessment items via the rubric and written feedback, individually and during scheduled review sessions
- private consultation (through appointment) with teaching staff
Assessment
Overview
This unit introduces foundational system security concepts and principles, so the assessment is largely based around the knowledge acquired throughout the semester. Assessment tasks include assignments (both individual and group) and a final exam. You should be able to work both independently and as a productive and cooperative team member.
The assignments in this unit offer a comprehensive exploration of system security concepts and practices. Students will investigate the relationship between people, processes, and technology in shaping system security, while considering ethical and privacy implications and the benefits of diversity and inclusion.
Students will demonstrate knowledge and application of common organisational practices that ensure the security requirements of systems are met, and that diverse stakeholder viewpoints are considered. The assignments focus on practical system security solutions. Through collaborative teamwork, students refine their ability to develop a roadmap for improving system security and to articulate system security recommendations to technical and non-technical audiences.
Independent work is required to complete some assessment items. For these items, although you may discuss the assessment topics with others, the work you submit for assessment must be your own individual effort. It is your responsibility to ensure that your work is completed in a timely manner. For group assessment tasks it is the responsibility of all group members to ensure the work is completed.
Unit Grading Scheme
7- point scale
Assessment Tasks
Assessment: Research Paper
In this assignment, you will produce a research paper outlining the concepts and principles underlining systems security. The paper will discuss core challenges and opportunities related to system security that must be understood by organisations as they implement secure business applications.
This assignment is intended to demonstrate mastery of foundational knowledge and understanding of system security principles that will then be applied in the group assignment (Assessment task 2).
The ethical and responsible use of generative artificial intelligence (GenAI) tools is authorised in this assessment. See the relevant assessment details in Canvas for specific guidelines.
This assignment is eligible for the 48-hour late submission period and assignment extensions.
Assessment: Group Report
In this assignment, you will be presented with a case study of an organisation undertaking a major IT project that includes the use of AI. You will work in a team to identify and analyse issues associated with the IT project, taking into account a variety of diverse stakeholders - both internal and external. You must apply your knowledge of system security to compare and contrast a range of solutions and make clear recommendations appropriate for the business environment (relating to system security). You will write a professional report to be presented to senior management of the case study organisation.
The ethical and responsible use of generative artificial intelligence (GenAI) tools is authorised in this assessment. See the relevant assessment details in Canvas for specific guidelines.
This assignment is eligible for the 48-hour late submission period and assignment extensions.
Assessment: Final Examination
You will be expected to physically attend an examination centre to take a written examination. For internal students this will be held on a QUT Campus. The examination will test your knowledge of the CAB443 learning material from across the semester: Weeks 1-13.
The use of generative artificial intelligence (GenAI) tools is prohibited during this assessment.
The late submission period does not apply and no assignment extensions are available.
Academic Integrity
Academic integrity is a commitment to undertaking academic work and assessment in a manner that is ethical, fair, honest, respectful and accountable.
The Academic Integrity Policy sets out the range of conduct that can be a failure to maintain the standards of academic integrity. This includes, cheating in exams, plagiarism, self-plagiarism, collusion and contract cheating. It also includes providing fraudulent or altered documentation in support of an academic concession application, for example an assignment extension or a deferred exam.
You are encouraged to make use of QUT’s learning support services, resources and tools to assure the academic integrity of your assessment. This includes the use of text matching software that may be available to assist with self-assessing your academic integrity as part of the assessment submission process.
Breaching QUT’s Academic Integrity Policy or engaging in conduct that may defeat or compromise the purpose of assessment can lead to a finding of student misconduct (Code of Conduct – Student) and result in the imposition of penalties under the Management of Student Misconduct Policy, ranging from a grade reduction to exclusion from QUT.
Requirements to Study
Costs
No extraordinary charges and costs are associated with the requirements of this unit.
Resources
Risk Assessment Statement
There are no extraordinary risks associated with the classroom/ lecture activities in this unit.
Course Learning Outcomes
This unit is designed to support your development of the following course/study area learning outcomes.IN01 Bachelor of Information Technology
- Demonstrate a broad theoretical and technical knowledge of well-established and emerging IT disciplines, with in-depth knowledge in at least one specialist area aligned to multiple ICT professional roles.
Relates to: ULO2, Research Paper, Final Examination - Critically analyse and conceptualise complex IT challenges and opportunities using modelling, abstraction, ideation and problem-solving to generate, evaluate and justify recommended solutions.
Relates to: ULO3, Group Report, Final Examination - Demonstrate an understanding of the role of IT in enabling business outcomes and how business realities shape IT decisions.
Relates to: ULO1, ULO3, Research Paper, Group Report - Assess the risks and potential of artificial intelligence (and other disruptive emerging technologies) within an organisation and leverage AI knowledge and skills to solve IT challenges, improve productivity and add value.
Relates to: ULO4, Group Report - Critically reflect, using a human-centric approach, on the social, cultural, ethical, privacy, legal, sustainability, and accessibility issues shaping the development and use of IT, including respecting the perspectives and knowledge systems of Aboriginal and Torres Strait Islander peoples, ensuring IT solutions empower and support people with disabilities, and fostering inclusive and equitable digital technologies that serve diverse communities.
Relates to: ULO5, Group Report, Final Examination