Software runs everything. The question is no longer whether a system will be targeted, but when, and whether it was built to withstand the attempt. This module takes that premise seriously, treating security not as a compliance checkbox but as a first-class design concern embedded throughout the development lifecycle.
The module is organised around a core conviction: most security failures are not the result of sophisticated attackers, but of predictable design choices made under pressure, without a systematic method for reasoning about adversaries. Students learn that method, from threat modelling at the requirements stage through secure design patterns to code-level vulnerabilities and testing strategies, so they can carry a security mindset into any software context.
Why it matters
The attack surface of modern software has expanded dramatically. Web applications handle sensitive data for millions of users. Mobile apps run on devices that hold personal, financial, and health data. Connected systems in critical infrastructure, healthcare, and finance depend on software that was not always designed with hostile use in mind. The cost of a breach, measured in regulatory exposure, reputational damage, and human harm, has never been higher.
Standards such as NIST and OWASP exist because the industry learned these lessons the hard way. This module teaches students to engage with those standards not as bureaucratic requirements but as accumulated knowledge about what goes wrong and why.
Module design
The module follows the software development lifecycle as its organising structure. Students encounter security concerns in the same order they would encounter them in practice: at the requirements stage, through architecture and design, during implementation, and in testing. Each phase introduces new tools and techniques, unified by a consistent threat-modelling mindset.
The aim is that students finish the module not with a list of vulnerability names they have memorised, but with a way of reading software: a habit of asking, at every stage, what an adversary could exploit here, and what design choices would make that harder.
Topics
- Security concepts in the software development lifecycle (SDLC)
- Threat modelling and risk assessment
- Secure software requirements and design principles
- Trusted computing and software architecture
- Common vulnerability classes: SQL injection, XSS, buffer overflow
- Malware: types, behaviour, and defences
- Industry standards and best practices: NIST and OWASP
- Legal and ethical responsibilities in software engineering
- Security testing and code review
What students leave with
Students can identify and articulate security risks at each stage of a development project, apply recognised frameworks for structuring security decisions, recognise common vulnerability patterns in code and design, and engage with the legal and ethical dimensions of building software used by real people. These are not specialist security skills but baseline expectations for any professional software engineer working in a connected world.