USQ LogoCourse specification
The current and official versions of the course specifications are available on the web at
Please consult the web for updates that may occur during the year.

CIS2005 Principles of Information Security

Semester 2, 2012 On-campus Toowoomba
Units : 1
Faculty or Section : Faculty of Business and Law
School or Department : School of Information Systems
Version produced : 30 December 2013

Contents on this page


Examiner: Jianming Yong
Moderator: Angela Howard

Other requisites

Students who have not previously completed CIS1000 or CSC1401 at USQ will need to have prior knowledge/experience with introductory computing concepts. Students are required to have access to a personal computer, e-mail capabilities and Internet access to UConnect. Current details of computer requirements can be found at


The amount of data and information stored electronically is growing exponentially. At the individual, organisational and societal level there is an increasing reliance on networks, the Internet and information systems to store and provide this information with the appropriate level of confidentiality, integrity and availability. Hence it is vitally important that business analysts recognise the need to ensure that corporate information, information systems and networks are appropriately secure from unintentional and intentional threats from both authorised and unauthorised users while still maintaining a high level of service.


The increased reliance on information technology and communications (ICT) technology and in particular Internet protocol based (IP) networks including the Internet to enhance business functions and store information means students must have an understanding of the vulnerabilities and threats which systems face and the controls or countermeasures which can prevent or limit their effect. It is a goal of this course for students to develop skills and knowledge to evaluate information security situations, identify specific issues and clearly communicate appropriate recommendations. The ongoing commitment to information systems security including ethical and privacy considerations that organisations need to take is also stressed in this course.


On successful completion of this course, students should be able to:

  1. have a strong understanding of information security vulnerabilities and threats and the controls which can be implemented to mitigate their effect
  2. understand the need for information security
  3. describe various network related threats and controls as covered in this course
  4. discuss the legal privacy and ethical issues that can play a part in information security
  5. understand that incidents can still occur and have knowledge of procedures to be put in place to facilitate appropriate disaster recovery and business continuity
  6. recognise the ongoing commitment to information security that is imperative for organisations to maintain reasonably secure information systems and IT infrastructure and understand the concept of continual improvement.


Description Weighting(%)
1. Network security 21.00
2. Compliance and operational security 18.00
3. Threats and vulnerabilities 21.00
4. Application, data and host security 16.00
5. Access control and identity management 13.00
6. Cryptography 11.00

Text and materials required to be purchased or accessed

ALL textbooks and materials available to be purchased can be sourced from USQ's Online Bookshop (unless otherwise stated). (

Please contact us for alternative purchase options from USQ Bookshop. (

  • Conklin, WMA, White, G, Williams, D, Davis, R & Cothren, C 2011, All in one CompTIA security+ exam guide (exam SY0-301), 3rd edn, McGraw-Hill, New York.
    (includes CD.)
  • Summers, J & Smith, B 2010, Communication skills handbook, 3rd edn, John Wiley & Sons, Milton, Queensland.
  • All students will need access to a PC word processing and spreadsheet package. Any package will suffice.
  • Students also need MS Windows to view multimedia materials.

Reference materials

Reference materials are materials that, if accessed by students, may improve their knowledge and understanding of the material in the course and enrich their learning experience.
  • Cheswick, WR, Bellovin, SM & Rubin, AD 2003, Firewalls and Internet security: repelling the wily hacker, 2nd edn, Addison-Wesley, Boston, Massachusetts.
  • Pfleeger, CP & Pfleeger, SL 2007, Security in computing, 4th edn, Prentice Hall, Upper Saddle River, New Jersey.
  • Stewart, J 2011, CompTIA Security+ review guide: exam SY0-301, 2nd edn, John Wiley, Hoboken, New Jersey.
    (includes CD.)
  • Whitman, M & Mattford, H 2011, Principles of information security, Cengage Learning, Boston, Massachusetts.
  • Wysopal, C, et al 2006, The art of software security testing: identifying software security flaws, Addison-Wesley, New York.

Student workload requirements

Activity Hours
Laboratory or Practical Classes 26.00
Lectures 26.00
Private Study 103.00

Assessment details

Description Marks out of Wtg (%) Due Date Notes
ASSIGNMENT 1 100 5 03 Aug 2012 (see note 1)
ASSIGNMENT 2 100 15 31 Aug 2012 (see note 2)
ASSIGNMENT 3 100 30 12 Oct 2012 (see note 3)
EXAMINATION - PART A 30 15 End S2 (see note 4)

  1. online quiz - multiple-choice questions
  2. practical report - SAP Security
  3. case study report
  4. The examination is scheduled to be held in the end-of-semester examination period. Students will be advised of the official examination date for Exam (Parts A, B and C) after the timetable has been finalised. The total working time for Exam (Parts A, B and C) is 2 hours.

Important assessment information

  1. Attendance requirements:
    It is the students' responsibility to attend and participate appropriately in all activities (such as lectures, tutorials, laboratories and practical work) scheduled for them, and to study all material provided to them or required to be accessed by them to maximise their chance of meeting the objectives of the course and to be informed of course-related activities and administration.

  2. Requirements for students to complete each assessment item satisfactorily:
    To satisfactorily complete an individual assessment item a student must achieve at least 50% of the marks. (Depending upon the requirements in Statement 4 below, students may not have to satisfactorily complete each assessment item to receive a passing grade in this course.)

  3. Penalties for late submission of required work:
    If students submit assignments after the due date without prior approval of the examiner, then a penalty of 5% of the total marks gained by the student for the assignment may apply for each working day late up to ten working days at which time a mark of zero may be recorded.

  4. Requirements for student to be awarded a passing grade in the course:
    To be assured of receiving a passing grade a student must achieve at least 50% of the total weighted marks available for the course.

  5. Method used to combine assessment results to attain final grade:
    The final grades for students will be assigned on the basis of the aggregate of the weighted marks obtained for each of the summative assessment items in the course.

  6. Examination information:
    This is a restricted examination. Candidates are allowed access to specific materials during the examination. The only materials that candidates may use in the examination for this course are (i) Writing materials: non-electronic and free from material which could give the student an unfair advantage in the examination; (ii) Translation dictionaries: with the Examiner's approval, candidates may, take an appropriate non-electronic translation dictionary into the examination. This will be subject to perusal and, if it is found to contain annotations or markings that could give the candidate an unfair advantage, it may be removed from the candidate's possession until the appropriate disciplinary action is completed.

  7. Examination period when Deferred/Supplementary examinations will be held:
    Any Deferred or Supplementary examinations for this course will be held during the next examination period.

  8. University Student Policies:
    Students should read the USQ policies: Definitions, Assessment and Student Academic Misconduct to avoid actions which might contravene University policies and practices. These policies can be found at

Assessment notes

  1. Assignments: (i) The due date for an assignment is the date by which a student must despatch the assignment to the USQ. The onus is on the student to provide proof of the despatch date, if requested by the examiner. (ii) Students must retain a copy of each assignment submitted for assessment. This must be produced within 24 hours if required by the examiner. (iii) In accordance with university policy, the examiner may grant an extension of the due date of an assignment in extenuating circumstances. (iv) The examiner will normally only accept assignments which are electronically submitted through the USQ Study Desk for this course. Students who are unable to meet this submission requirement should contact the examiner of the course to negotiate alternative arrangements. (v) Students who do not have regular access to postal services or who are otherwise disadvantaged by these regulations may be given special consideration. They should contact the examiner to negotiate such special arrangements. (vi) In the event that a due date for an assignment falls on a local public holiday in their area, such as a show holiday, the due date for the assignment will be the next day. Students are to note on the assignment cover the date of the public holiday for the examiner's convenience.

  2. Course weightings: Course weightings of topics should not be interpreted as applying to the number of marks allocated to questions testing those topics in an examination paper.

  3. Referencing in assignments: Harvard (AGPS) is the referencing system required in this course. Students should use Harvard (AGPS) style in their assignments to format details of the information sources they have cited in their work. The Harvard (AGPS) style to be used is defined by the USQ Library's referencing guide at

  4. Make-up work: Students who have undertaken all of the required assessments in a course but who have failed to meet some of the specified objectives of a course within the normally prescribed time may be awarded the temporary grade: IM (Incomplete - Make up). An IM grade will only be awarded when, in the opinion of the examiner, a student will be able to achieve the remaining objectives of the course after a period of non-directed personal study.

  5. Deferred work: Students who, for medical, family/personal, or employment-related reasons, are unable to complete an assignment or to sit for an examination at the scheduled time may apply to defer an assessment in a course. Such a request must be accompanied by appropriate supporting documentation. One of the following temporary grades may be awarded: IDS (Incomplete - Deferred Examination); IDM (Incomplete Deferred Make-up); IDB (Incomplete - Both Deferred Examination and Deferred Make-up).

Other requirements

  1. E-mail and Internet access: Students will require access to e-mail and Internet access to UConnect for this course.