Information security is not a collection of tools and configurations. It is a discipline with a rigorous mathematical and conceptual foundation, and the best practitioners understand why their tools work, not just how to use them. This module is designed for postgraduate students who want to operate at that level: technically confident, able to reason about security properties from first principles, and equipped to engage with both implementation and policy.
Why it matters
The vulnerabilities and attacks that dominate the security landscape, from ransomware and supply chain compromises to state-sponsored intrusion, are not mysteries. They exploit known classes of weakness: poor key management, misconfigured access controls, undetected lateral movement, and the gap between a security policy and what actually runs in production. A postgraduate-level understanding of information security means understanding those weaknesses at the level of the underlying mechanisms, not just the threat names.
Module design
The module opens with the mathematical core: cryptography in depth, covering symmetric and asymmetric schemes, stream and block ciphers, hash functions, digital signatures, and key management. These are not prerequisites to skip over; they are the vocabulary for reasoning about everything that follows. The module then moves through the application of those primitives in real systems: authentication and access control, software security and vulnerability classes, network defence (firewalls and intrusion detection), and the policy and legal structures that govern how security is enforced and adjudicated.
The aim is that students finish able to evaluate security claims rather than simply accept them, whether those claims come from a vendor, a standards body, or a piece of code.
Topics
- Security design principles and the security landscape
- Symmetric cryptography: stream ciphers, block ciphers, DES, and successors
- Asymmetric cryptography: RSA and public-key infrastructure
- Hash functions and message authentication codes
- Digital signatures and non-repudiation
- Key management: distribution, rotation, and trust hierarchies
- Authentication mechanisms and access control models
- Software security: vulnerability classes and defensive patterns
- Malware: taxonomy, detection, and analysis techniques
- Firewalls: architectures, rule design, and limitations
- Intrusion detection and security monitoring
- The NIST Cyber Security Framework
- Security policy formation, enforcement, and audit
- Cybercrime, law, and ethics in information security
What students leave with
Students leave with a command of the technical foundations that underpin information security practice, the ability to analyse vulnerability scenarios from first principles, and the conceptual vocabulary to engage with security research, standards, and professional practice. At postgraduate level, the goal is not competency in a fixed set of tools but the analytical capability to evaluate new problems as the field evolves.