Information Security Syllabus

The exact syllabus differs by qualification. The following areas represent a balanced Information Security curriculum.

Computer fundamentals

Students learn computer components, number systems, software types, storage, peripherals and basic troubleshooting. Diploma programmes may include assembly, maintenance and operating-system installation.

Mathematics and discrete structures

Engineering programmes include calculus, matrices, probability, statistics and discrete Mathematics. Information Security uses logic, modular arithmetic, probability, graphs and algorithms in cryptography, risk analysis, authentication and secure computing.

Programming

C, Python, Java or another language may be taught. Programming builds logical ability and later supports secure applications, monitoring scripts, log analysis, testing and automation.

Python is particularly useful for interacting with APIs, processing logs and automating repeated analysis. Students should first learn clean programming, error handling and safe secret management before using security libraries.

Data structures and algorithms

Security tools and applications depend on efficient tables, queues, graphs, search methods and complexity analysis. Students need these foundations to understand software behaviour, detection methods and the performance limits of protective controls.

Digital electronics and computer organisation

These subjects explain gates, processors, memory, buses and input-output. Hardware knowledge helps students understand network interfaces, appliances, servers and embedded network devices.

Operating systems

Operating Systems covers processes, memory, file systems, permissions, input-output and concurrency. Linux laboratory work is especially valuable because many servers, network tools and appliances use Linux-based environments.

Students should practise users and groups, services, logs, files, permissions, shell commands and basic scripting. System changes must be documented and tested.

Information Security principles

Students study confidentiality, integrity, availability, authenticity, accountability, privacy and resilience. They learn about assets, threats, vulnerabilities, controls, defence in depth and the difference between risk reduction and absolute guarantees. Security objectives must support legitimate users and business operations.

Information lifecycle and classification

Information passes through creation, collection, storage, use, sharing, archiving and disposal. Classification connects sensitivity with handling rules for access, copying, transmission, retention and destruction. Students examine digital data as well as printed records and verbal information.

Threat modelling and security architecture

Threat modelling identifies valuable assets, trust boundaries, possible misuse and practical controls before a system is built. Security architecture connects identity, endpoints, applications, networks, data, cloud services and monitoring. Students learn to document assumptions and residual risk.

Network and communication security

Students still need protocols, addressing, segmentation, firewalls, secure remote access, wireless protection and traffic analysis. The objective is to understand where information flows and where controls can fail, rather than train only for device configuration.

Operating-system security

System security covers users, privileges, services, processes, files, updates, secure configuration, endpoint protection, logging and recovery. Laboratory work may compare a default installation with a hardened baseline and document the operational effect of each change.

Database and data security

Database security includes authentication, authorisation, roles, encryption, backups, logging, masking and protection against unsafe queries. Students learn that data remains exposed when broad access, weak retention or insecure exports bypass a well-configured database.

Vulnerability management

Vulnerability management includes asset discovery, authorised assessment, validation, risk-based prioritisation, remediation and closure evidence. A scanner result is a starting point, not a complete risk decision. Teams must consider exposure, exploitability, business importance and compensating controls.

Security testing and ethical practice

Security testing may examine configuration, applications or agreed infrastructure inside a written scope. Students learn rules of engagement, evidence handling, safe test methods and responsible reporting. No course or tool authorises testing a public, college or employer system without permission.

Malware and malicious behaviour

Students may study malware types, persistence, delivery, command activity and indicators from a defensive perspective. Analysis should use isolated environments and prepared samples under qualified supervision. Learners must never distribute live malicious code or attempt infection outside the laboratory.

Security monitoring and analytics

Monitoring subjects cover log sources, collection, normal behaviour, alerts, correlation, detection logic and dashboards. Students learn that missing context, unsynchronised time and poor asset inventories can lead to false conclusions. Detection quality is more important than producing the largest number of alerts.

Information-security management systems

Management-system study explains policy hierarchy, governance, scope, risk treatment, control ownership, competence, performance review and continual improvement. Students learn how leadership, resources and evidence support security beyond the technical team.

Security audit and assurance

Audit examines whether stated controls are designed appropriately and operating as expected. Learners practise defining criteria, sampling evidence, interviewing owners and writing clear findings. An audit result provides assurance within its scope and time period; it does not prove that no future incident can occur.

Privacy and data protection

Privacy subjects consider personal data, purpose, transparency, access, retention, sharing, rights and breach handling. Information Security supplies many protective measures, while privacy also involves legal and ethical decisions about whether and why information should be processed.

Third-party and supply-chain security

Organisations rely on cloud providers, software vendors, contractors and processors. Students learn due diligence, contractual requirements, access control, software dependencies, monitoring and exit planning. A supplier's certificate is useful evidence but not a substitute for understanding the service and its risks.

Business continuity and disaster recovery

Continuity planning identifies critical activities, dependencies, recovery priorities and acceptable disruption. Disaster recovery focuses on restoring technology and data. Exercises, backup restoration and communication tests reveal whether written plans can work under pressure.

Physical and personnel security

Information can be exposed through unlocked rooms, discarded documents, visitor access, lost devices or misuse by trusted people. Students study physical zones, records handling, onboarding, awareness, role changes and offboarding while respecting labour, privacy and legal requirements.

Security awareness and human factors

Awareness programmes should help people make safer decisions rather than blame them for every incident. Effective training is relevant to roles, tested for understanding and supported by usable processes. Designers must consider workload and avoid controls that push staff toward unsafe workarounds.

Cryptography and key management

Cryptography subjects introduce symmetric and asymmetric encryption, hashes, message authentication, digital signatures, certificates and key exchange. Students should understand the security objective, assumptions and operational challenge of protecting keys. Creating a personal encryption method without expert review is unsafe.

Secure software development

Secure development covers requirements, threat modelling, input validation, authentication, authorisation, session handling, dependency management, code review and security testing. Security should be integrated into design and delivery instead of added just before release.

Identity and access management

IAM subjects examine digital identity, multi-factor authentication, single sign-on, roles, privileges, federation and account lifecycle. Students learn least privilege and periodic access review. Identity systems are security-critical because compromised credentials are a common route into organisations.

Digital forensics

Digital forensics introduces evidence identification, acquisition, preservation, analysis and reporting. Work must follow legal authority and chain-of-custody procedures. Laboratory exercises use prepared datasets or authorised devices; students must not collect another person’s data without permission.

Security operations and incident response

Students learn log collection, alert triage, event correlation, incident classification, containment, eradication, recovery and post-incident learning. A good response plan defines roles, communication, evidence handling and escalation before a crisis occurs.

Governance, risk and compliance

GRC connects technology with policy, risk assessment, audits, third-party management, privacy and legal obligations. Students learn that compliance is evidence of meeting particular requirements, not proof that every security risk has been removed.

Cloud and application security

Cloud security covers shared responsibility, identity, configuration, logging, encryption and workload protection. Application security examines web, mobile and API risks. Practical work should remain inside a deliberately isolated or explicitly authorised environment.

Typical laboratory activities

Postgraduate syllabus

Advanced programmes may cover modern cryptography, privacy engineering, security analytics, wireless protection, cloud and virtualisation security, secure coding, information-security management, digital forensics, advanced network defence, research methods and dissertation.

Project themes

• information classification and handling model for a fictional organisation;
• risk assessment and treatment plan for a small online service;
• secure coding review of a deliberately vulnerable application;
• role-based access and periodic review workflow;
• security monitoring dashboard using prepared, non-sensitive logs;
• cloud configuration assessment inside a student-owned account;
• privacy-aware data-flow map and retention proposal;
• incident-response tabletop with communication and evidence records;
• controlled anomaly classification with documented model limitations;
• backup restoration and disaster-recovery exercise.

Projects should use isolated or authorised environments. Credentials and private packet data must never be published in a student portfolio.