Computer Security

Course Description

CIS4360 – Computer Security is a 3-credit upper-division introduction to information security: the threats, the defenses, the cryptographic building blocks underneath them, and the practical discipline of securing systems that were mostly not designed to be secure. Titles vary — it appears as Computer and Information Security at the University of Florida, Introduction to Computer Security at UNF and FAMU, and Applied Cybersecurity at Daytona State College — and, as the numbering warning below explains, those titles reflect a real difference in what the course is.

Content covers security fundamentals — confidentiality, integrity, availability, threat modeling, and risk; cryptography — symmetric and asymmetric encryption, hashing, digital signatures, key exchange, and certificates; authentication and access control — passwords, multi-factor authentication, and access control models; software security — buffer overflows, injection, input validation, and secure coding; web security — XSS, CSRF, SQL injection, and session handling; network security — protocols, firewalls, intrusion detection, VPNs, and TLS; operating system security — privileges, hardening, and isolation; malware — types, propagation, and analysis basics; social engineering — phishing and the human attack surface; incident response and forensics at an introductory level; security operations — logging, monitoring, and detection; policy, compliance, and governance; and law and ethics — including the legal boundaries around security testing.

Learning Outcomes

Required Outcomes

• Apply the confidentiality, integrity, and availability model to a system.
• Construct a threat model and assess risk for a given environment.
• Describe symmetric and asymmetric cryptography and select appropriately.
• Describe cryptographic hashing and its correct uses.
• Explain digital signatures, certificates, and public key infrastructure.
• Describe key exchange and why key management is the hard part.
• Evaluate authentication mechanisms including multi-factor approaches.
• Apply access control models and the principle of least privilege.
• Identify common software vulnerabilities including memory and injection flaws.
• Apply secure coding practices including input validation and output encoding.
• Identify and mitigate common web application vulnerabilities.
• Describe network attacks and appropriate defenses.
• Configure or evaluate firewall and intrusion detection approaches.
• Describe TLS and how transport security is established.
• Harden an operating system and describe isolation mechanisms.
• Classify malware types and describe propagation and defense.
• Describe social engineering techniques and organizational countermeasures.
• Describe the incident response lifecycle.
• Describe logging, monitoring, and detection practices.
• Describe security policy, compliance frameworks, and governance.
• Describe the legal and ethical boundaries of security testing.

Optional Outcomes

• Complete hands-on laboratory exercises in a controlled environment.
• Participate in a capture-the-flag exercise.
• Prepare for the CompTIA Security+ certification.
• Describe cloud security considerations.
• Describe cryptographic protocol analysis in greater depth.
• Complete a security assessment project.

Major Topics

Required Topics

• Security fundamentals — CIA triad, threats, and risk.
• Threat modeling — adversaries, assets, and attack surface.
• Symmetric cryptography — block ciphers and modes.
• Asymmetric cryptography — public key methods and uses.
• Hashing — properties, correct uses, and password storage.
• Signatures and PKI — certificates and trust.
• Key management — exchange, storage, and rotation.
• Authentication — factors, protocols, and failure modes.
• Access control — models and least privilege.
• Memory safety — buffer overflows and mitigations.
• Injection — SQL, command, and input validation.
• Web vulnerabilities — XSS, CSRF, and sessions.
• Secure coding — practices and review.
• Network attacks — spoofing, interception, and denial.
• Network defenses — firewalls, IDS/IPS, and segmentation.
• TLS — handshake, trust, and common failures.
• OS security — privileges, hardening, and isolation.
• Malware — taxonomy, propagation, and ransomware.
• Social engineering — phishing and human factors.
• Incident response — the lifecycle and forensics basics.
• Monitoring — logging, SIEM, and detection.
• Policy and compliance — frameworks and governance.
• Law and ethics — authorization and legal boundaries.

Optional Topics

• Hands-on laboratory exercises.
• Capture-the-flag competition.
• Security+ certification preparation.
• Cloud security.
• Protocol analysis.
• Security assessment project.

Resources & Tools

• Computer Security: Principles and Practice (Stallings & Brown), Pearson — the most common text for this course.
• Security Engineering (Ross Anderson) — free online from the author; the best book in the field on why security fails in practice rather than in theory.
• OWASP — free; the Top Ten, cheat sheets, and testing guides. The practical reference for web security and widely used by employers.
• NIST publications (SP 800 series, the Cybersecurity Framework) — free; the basis of most compliance work in the United States.
• MITRE ATT&CK — free; the standard taxonomy of adversary behavior, and increasingly expected knowledge.
• TryHackMe, Hack The Box, and OverTheWire — free tiers; legal, sanctioned practice environments.
• Kali Linux and VirtualBox — free; the standard lab setup. Practice only in your own isolated lab.
• Wireshark — free; packet analysis, and the fastest way to make network concepts concrete.
• CompTIA Security+ — the entry credential most Florida employers and federal contractors recognize; this course maps to much of it.

Career Pathways

• Information Security Analyst (SOC 15-1212) — the primary destination; consistently among the fastest-growing occupations.
• SOC Analyst — the most common entry point into security.
• Penetration Tester — requires demonstrated skill and, always, written authorization.
• Security Engineer and Cloud Security Engineer.
• Incident Responder and Digital Forensics Analyst.
• GRC Analyst — governance, risk, and compliance; an underrated and accessible path.
• Systems and Network Administrator (SOC 15-1244) — where much security work actually happens.
• Software Developer (SOC 15-1252) — secure development is a differentiator.
• Federal and defense roles — frequently requiring a clearance and a DoD 8570-approved certification.

Florida demand is substantial and geographically spread: defense and simulation in Central Florida, CENTCOM and SOCOM in Tampa, financial services and international business in South Florida, health systems statewide, plus state and local government. Many roles are remote-eligible. The field has a genuine shortage at the mid level; entry-level competition is real, which is why the practical advice below emphasizes demonstrable skill.

Special Information

⚠ The same number is a CS course at one institution and an IT course at another

A genuine divergence, and the prerequisites reveal it more clearly than the titles do:

• University of Florida — Computer and Information Security, prerequisite CDA3101 (computer organization). A computer science course, taught close to the machine, with cryptography and systems emphasis.
• UNF — Introduction to Computer Security, prerequisite COP3503 (second programming course). Also a CS course, assuming programming maturity.
• Daytona State College — Applied Cybersecurity, prerequisites (CTS2321 or CTS3348) and (CET1600 or CNT3104) — that is, Linux administration plus networking. An information technology course, taught from the administrator's side.

Both are legitimate and the overlap is large, but the experience differs: the CS variant asks you to reason about memory, protocols, and cryptographic constructions; the IT variant asks you to configure, harden, and monitor real systems. Check the prerequisites to find out which one you are registering for — they are a more reliable signal than the title. And confirm you actually hold them, because they are not interchangeable: a student with the Linux and networking background may struggle in the CS variant, and the reverse is equally true.

⚠ Unauthorized testing is a crime — this is the single most important thing in the course

Stated plainly because students get this wrong with career-ending consequences. The techniques taught here are illegal to use against systems you do not own or have written authorization to test. The federal Computer Fraud and Abuse Act and Chapter 815, Florida Statutes (the Florida Computer Crimes Act) both apply, and "I was curious," "I was practicing for class," and "I did not damage anything" are not defenses.

The specific traps: scanning or testing your employer's network without written permission — being an employee is not authorization; testing your college's systems; probing a site because you noticed a flaw; and using a tool from class against anything outside the lab. Even well-intentioned disclosure has resulted in prosecution.

The correct practice is simple and free: use sanctioned environments — TryHackMe, Hack The Box, OverTheWire, capture-the-flag events — or your own isolated virtual lab. If you find a real vulnerability, report it through a published disclosure or bug bounty process and do not investigate further. Get authorization in writing, always, for your whole career.

Do not write your own cryptography — and understand why

The most reliable practical rule in the field, and the course explains the reasoning. Cryptographic primitives are extraordinarily difficult to implement correctly; the failures are subtle, do not produce visible symptoms, and are found by attackers rather than by testing. Serious breaches trace to correct algorithms used incorrectly — a reused nonce, a predictable IV, a bad random number source, unauthenticated encryption, a timing side channel.

What professionals do instead: use vetted libraries and high-level interfaces, choose authenticated encryption, use a cryptographic random source, and for passwords use a purpose-built password hash such as bcrypt, scrypt, or Argon2 with a salt — never a plain SHA hash, and never encryption. The point of learning the internals is to select and configure correctly, not to build your own.

⚠ Most breaches are not clever — they are people, patches, and passwords

Worth holding onto against the impression a technical course creates. The dominant real-world causes of compromise are phishing and credential theft, unpatched known vulnerabilities, misconfiguration (notably exposed cloud storage and default credentials), and excessive privilege. Sophisticated novel exploitation is rare by comparison.

The implication for practice is that the highest-value defensive work is unglamorous: multi-factor authentication, patch management, least privilege, backups that are tested and offline, logging that someone actually reads, and user education. A security professional who can drive those consistently prevents far more harm than one who is good at exploitation. It is also why ransomware remains so effective against organizations that neglected exactly this list.

Security is a specialization, not an entry point — build the foundation

Honest career advice that contradicts a great deal of marketing. Employers hiring security staff generally want people who already understand networking, operating systems, and systems administration, because you cannot secure what you do not understand. The common realistic path into the field runs through help desk, systems or network administration, or software development, then into a SOC or security engineering role.

What accelerates it: CompTIA Security+ (the recognized entry credential, and required for many federal and defense positions in Florida), demonstrable hands-on lab work, competing in capture-the-flag events, and a home lab you can talk about in detail. What does not accelerate it: certifications without any practical experience behind them. The strongest interview signal is being able to explain something you actually built, broke, and fixed.

Numbering and program context

CIS4360 sits among Florida's security offerings at multiple levels, and the level matters for transfer. Two-year and certificate security coursework appears under CTS numbers — including CTS0069 Computer Security Technician (PSAV clock hours), CTS2311 Linux Security, and CTS2321C Linux System Administration — and under CIS2 numbers such as CIS2350C Cybersecurity Analysis. Upper-division work continues at CIS4250 (ethical issues in IT), CIS4510 (IT project management), and CNT networking numbers. SCNS equivalency applies to the same number at the same level, never across numbers, so a 2000-level cybersecurity course does not satisfy a CIS4360 requirement no matter how similar the content — a common and expensive surprise for students transferring from an A.S. into a bachelor's program. Confirm the articulation before assuming it.