IFN635 Cyber Security and Governance


To view more information for this unit, select Unit Outline from the list below. Please note the teaching period for which the Unit Outline is relevant.


Unit Outline: Semester 1 2026, Gardens Point, Internal

Unit code:IFN635
Credit points:12
Pre-requisite:IFN583 OR ((IFN551 or IFQ551) and (IFN553 or IFQ553)) OR admission to IN17
Equivalent:IFN541
Coordinator:Gowri Ramachandran | g.ramachandran@qut.edu.au
Disclaimer - Offer of some units is subject to viability, and information in these Unit Outlines is subject to change prior to commencement of the teaching period.

Overview

Cybersecurity is the practice of safeguarding an organisation's critical infrastructure from cyber threats, including ransomware, malware, and phishing. Critical infrastructure encompasses IT components (software, platforms, computing infrastructure, networks, devices) and physical spaces. Infrastructure attacks have increased the need for cyber risk management skills. This unit builds on Computer Systems and Security (IFN583) and offers a broad introduction to cybersecurity and governance frameworks, covering security practices across people, processes, and technology. Topics include threat assessment, risk management, incident response, security compliance, awareness initiatives, and cloud security. You will learn from real-world case studies to prepare for roles as cybersecurity professionals, gaining theoretical knowledge and practical skills to detect, investigate, and remediate cyberattacks. This unit also prepares you for advanced studies in the cybersecurity major.

Learning Outcomes

On successful completion of this unit you will be able to:

  1. Discuss the impact of people, processes and technology on information security, both for individuals and organisations including ethical and privacy considerations.
  2. Analyse the evolving cyber threat landscape and its impact on individuals and organizations, considering ethical and privacy considerations.
  3. Apply relevant cybersecurity frameworks and strategies within the organizational context to enhance information security.
  4. Conduct a cybersecurity risk assessment for an organization, identifying potential vulnerabilities and threats.
  5. Prioritize and employ appropriate risk assessment tools and methodologies to categorize identified risks for effective treatment.
  6. Collaborate in a team environment to idenity and recommend appropriate security practices.

Content

This unit introduces you to the multifaceted aspects of cybersecurity, exploring the evolving cyber threat landscape and its impact on individuals and organisations. You will learn to apply cybersecurity frameworks and strategies within the organizational context to enhance information security and conduct thorough cybersecurity risk assessments, identifying vulnerabilities and threats. You will be exposed to different risk management and security management frameworks, methods, tools, and techniques used for vulnerability and threat management, governance frameworks, enterprise risk management, incident management, and disaster recovery in an organizational context. Through the unit, you will develop important employability skills, such as communication and learn to work as an effective team member. Guest lecturers will highlight career opportunities, including the skills needed to succeed in this field.

Learning Approaches

You can expect to spend 10-15 hours per week preparing for and attending scheduled classes, completing assessment tasks, and engaging in independent study and consolidation of your learning. The unit uses pre-recorded lectures, practical exercises, and some case studies to develop your understanding of the theory and practice of information security management in organisations.

The pre-recorded lectures and activities will provide you with the knowledge and skills to address the cyber security landscape of organisations.

Tutorials will be conducted face-to-face on campus. They will be group activities based on identifying, analysing, assessing, and addressing the information security risks in large-scale organisations. The tutorials build directly on the material presented in the pre-recorded lectures and will involve detailed instruction sheets for undertaking the required tasks. They are designed to support class instruction, group work, and class reflection.

The QUT Canvas site will be used for lecture notes, tutorial materials, and reading resources, and will act as the central place for all course-related information.

This unit emphasises practical skills and artefact-driven learning. You will actively engage in hands-on exercises, supplemented by readings and discussions from the development community, to gain real-world experience and prepare for future challenges.

Feedback on Learning and Assessment

You can obtain feedback on their progress throughout the unit through the following mechanisms:

  • Class and group-based feedback on workshop exercises
  • Written feedback on the formative phase of assessment tasks
  • Written feedback on summative phases of assessment tasks, including a rubric
  • General verbal feedback will be provided to the entire class on assessment tasks

You will receive feedback and results on each assessment task prior to the submission of the next assessment task

Assessment

Overview

The assignments in this unit offer a comprehensive exploration of critical cybersecurity concepts and practices. You will investigate how people, processes, and technology shape information security landscapes, while also considering ethical and privacy implications.  

You will analyse the dynamic cyber threat landscape, emphasising its impact on individuals and organisations by incorporating ethical and privacy considerations. They also need to apply relevant cybersecurity frameworks to strengthen organisational security.

The assignments also focus on practical risk assessment and mitigation strategies, where you will conduct a detailed cybersecurity risk assessment, prioritise identified risks, and develop actionable recommendations for stakeholders. Through collaborative teamwork, you will refine your ability to articulate security recommendations to both technical and non-technical audiences.

Unit Grading Scheme

7- point scale

Assessment Tasks

Assessment: Cybersecurity Risk Assessment and Recommendations

For this Assignment, you will conduct a cyber security risk assessment for a real-world organisation, identifying potential vulnerabilities and threats. You need to identify and prioritise risks by employing appropriate assessment tools and methodologies. You will collaboratively work in small teams to develop written security recommendations for technical and non-technical audiences in the organisation.

The deliverables of this assignment include: a cyber security risk assessment report detailing identified vulnerabilities, threats, an overview assessment tools used, risks identified and risk treatment strategies. You will prepare a report by including your findings and recommendations for different stakeholders in the organisation.

The ethical and responsible use of generative artificial intelligence (GenAI) tools is authorised in this assessment. See the relevant assessment details in Canvas for specific guidelines.

This assignment is eligible for the 48-hour late submission period and assignment extensions. 

Weight: 50
Length: 10 pages, excluding title, table of content, and references
Individual/Group: Individual and group
Due (indicative): Week 7
Related Unit learning outcomes: 4, 5, 6

Assessment: Incident Response Plan, including Oral Defence

You will design and develop an incident response plan for this assignment, including people, processes, and technology. The deliverables include a plan document outlining recommendations for handling cyber incidents. You will also defend your plan through an Oral Q&A session.

The ethical and responsible use of generative artificial intelligence (GenAI) tools is authorised in this assessment. See the relevant assessment details in Canvas for specific guidelines.

This assignment is eligible for the 48-hour late submission period and assignment extensions. 

Weight: 50
Length: 10 Pages, excluding title, table of content, and references, and 20 minute oral defence.
Individual/Group: Individual and group
Due (indicative): Week 13
Related Unit learning outcomes: 1, 2, 3, 6

Academic Integrity

Academic integrity is a commitment to undertaking academic work and assessment in a manner that is ethical, fair, honest, respectful and accountable.

The Academic Integrity Policy sets out the range of conduct that can be a failure to maintain the standards of academic integrity. This includes, cheating in exams, plagiarism, self-plagiarism, collusion and contract cheating. It also includes providing fraudulent or altered documentation in support of an academic concession application, for example an assignment extension or a deferred exam.

You are encouraged to make use of QUT’s learning support services, resources and tools to assure the academic integrity of your assessment. This includes the use of text matching software that may be available to assist with self-assessing your academic integrity as part of the assessment submission process.

Breaching QUT’s Academic Integrity Policy or engaging in conduct that may defeat or compromise the purpose of assessment can lead to a finding of student misconduct (Code of Conduct – Student) and result in the imposition of penalties under the Management of Student Misconduct Policy, ranging from a grade reduction to exclusion from QUT.

Resources

There is no required textbook for this unit. However, this unit may where appropriate, make use of the selected chapters from textbooks, journals, and magazines. Students are encouraged to obtain a copy of these materials from the library. Where possible, materials will be made available online through QUT Readings.

Risk Assessment Statement

There are no out-of-the-ordinary risks associated with studying this unit

Course Learning Outcomes

This unit is designed to support your development of the following course/study area learning outcomes.

IN17 Graduate Certificate in Communication for Information Technology

  1. Demonstrate an advanced knowledge of information technology disciplines.
    Relates to: ULO1, ULO3, Cybersecurity Risk Assessment and Recommendations
  2. Critically analyse complex IT problems and opportunities and use creativity and problem-solving skills to generate solutions.
    Relates to: ULO2, ULO5, Cybersecurity Risk Assessment and Recommendations, Incident Response Plan, including Oral Defence
  3. Employ industry-best practice, IT methods, tools and techniques to develop and implement IT systems, processes and/or software.
    Relates to: ULO3, ULO4, ULO5, Cybersecurity Risk Assessment and Recommendations, Incident Response Plan, including Oral Defence
  4. Work effectively in both self-directed and collaborative contexts.
    Relates to: ULO6, Cybersecurity Risk Assessment and Recommendations, Incident Response Plan, including Oral Defence
  5. Communicate effectively in IT professional contexts using written, visual and oral formats.
    Relates to: ULO6, Cybersecurity Risk Assessment and Recommendations, Incident Response Plan, including Oral Defence
  6. Critically reflect on the social, cultural, ethical and diversity issues related to the IT field.
    Relates to: ULO1, ULO2, Cybersecurity Risk Assessment and Recommendations, Incident Response Plan, including Oral Defence

IN20 Master of Information Technology

  1. Demonstrate advanced specialist IT knowledge in at least one information technology discipline.
    Relates to: ULO1, ULO3, Cybersecurity Risk Assessment and Recommendations, Incident Response Plan, including Oral Defence
  2. Critically analyse complex IT problems and opportunities and use creativity and problem-solving skills to generate innovative and novel solutions that are convincingly justified.
    Relates to: ULO2, ULO5, Cybersecurity Risk Assessment and Recommendations, Incident Response Plan, including Oral Defence
  3. Integrate advanced, industry-best practice, IT methods, tools and techniques to develop and implement complex IT systems, processes and/or software.
    Relates to: ULO3, ULO4, ULO5, Cybersecurity Risk Assessment and Recommendations, Incident Response Plan, including Oral Defence
  4. Employ leadership and initiative in both self-directed and collaborative contexts to create value for others.
    Relates to: ULO6, Cybersecurity Risk Assessment and Recommendations, Incident Response Plan, including Oral Defence
  5. Communicate effectively in IT professional and scholarly contexts to specialist and non-specialist audiences using written, visual and oral formats.
    Relates to: ULO6, Cybersecurity Risk Assessment and Recommendations, Incident Response Plan, including Oral Defence
  6. Demonstrate business acumen and well-developed values, attitudes, behaviours and judgement in professional contexts.
    Relates to: ULO2, ULO4, Cybersecurity Risk Assessment and Recommendations, Incident Response Plan, including Oral Defence
  7. Create positive change through critically reflecting upon and actioning responses to the social, cultural, ethical, sustainability, legal and accessibility issues in the IT field, including how they relate to First Nations Australians and diverse populations.
    Relates to: ULO1, ULO2, Incident Response Plan, including Oral Defence

IN28 Master of Artificial Intelligence

  1. Demonstrate advanced specialist IT knowledge in Artificial Intelligence discipline.
    Relates to: Cybersecurity Risk Assessment and Recommendations
  2. Critically analyse complex Artificial Intelligence problems and opportunities and use creativity and problem-solving skills to generate innovative and novel solutions that are convincingly justified.
    Relates to: Cybersecurity Risk Assessment and Recommendations, Incident Response Plan, including Oral Defence
  3. Integrate advanced, industry-best practice, Artificial Intelligence methods, tools and techniques to develop and implement complex Artificial Intelligence systems, processes and/or software.
    Relates to: Cybersecurity Risk Assessment and Recommendations, Incident Response Plan, including Oral Defence
  4. Employ leadership and initiative in both self-directed and collaborative contexts to create value for others.
    Relates to: Cybersecurity Risk Assessment and Recommendations, Incident Response Plan, including Oral Defence
  5. Communicate effectively in Artificial Intelligence professional and scholarly contexts to specialist and non-specialist audiences using written, visual and oral formats.
    Relates to: Cybersecurity Risk Assessment and Recommendations, Incident Response Plan, including Oral Defence
  6. Demonstrate business acumen and well-developed values, attitudes, behaviours and judgement in professional contexts.
    Relates to: Cybersecurity Risk Assessment and Recommendations, Incident Response Plan, including Oral Defence
  7. Create positive change through critically reflecting upon and actioning responses to the social, cultural, ethical, sustainability, legal and accessibility issues in the Artificial Intelligence field, including how they relate to First Nations Australians and diverse populations.
    Relates to: Cybersecurity Risk Assessment and Recommendations

IN29 Master of Cyber Security

  1. Demonstrate advanced specialist IT knowledge in Cyber Security discipline.
    Relates to: Cybersecurity Risk Assessment and Recommendations
  2. Critically analyse complex Cyber Security problems and opportunities and use creativity and problem-solving skills to generate innovative and novel solutions that are convincingly justified.
    Relates to: Cybersecurity Risk Assessment and Recommendations, Incident Response Plan, including Oral Defence
  3. Integrate advanced, industry-best practice, Cyber Security methods, tools and techniques to develop and implement complex Cyber Security systems, processes and/or software.
    Relates to: Cybersecurity Risk Assessment and Recommendations, Incident Response Plan, including Oral Defence
  4. Employ leadership and initiative in both self-directed and collaborative contexts to create value for others.
    Relates to: Cybersecurity Risk Assessment and Recommendations, Incident Response Plan, including Oral Defence
  5. Communicate effectively in Cyber Security professional and scholarly contexts to specialist and non-specialist audiences using written, visual and oral formats.
    Relates to: Cybersecurity Risk Assessment and Recommendations, Incident Response Plan, including Oral Defence
  6. Demonstrate business acumen and well-developed values, attitudes, behaviours and judgement in professional contexts.
    Relates to: Cybersecurity Risk Assessment and Recommendations, Incident Response Plan, including Oral Defence
  7. Create positive change through critically reflecting upon and actioning responses to the social, cultural, ethical, sustainability, legal and accessibility issues in the Cyber Security field, including how they relate to First Nations Australians and diverse populations.
    Relates to: Cybersecurity Risk Assessment and Recommendations