CNT4403 Data Security is the course in which security stops being a set of principles and becomes a set of mechanisms operating on actual packets, protocols and hosts. Where the foundations course establishes what confidentiality, integrity and availability mean, this course asks how they are enforced across a network that was designed, at its origin, with no security properties at all.
The course is offered at approximately seven Florida institutions, including the University of West Florida, Florida Gulf Coast University, Florida Atlantic University, Florida International University, Florida Polytechnic University, the University of Central Florida and the University of South Florida.
At the University of West Florida the course is titled Computer and Network Security and is offered by the Department of Cybersecurity and Information Technology. UWF describes it as providing an understanding of computer and network security concepts using currently available technology, the options available to mitigate threats within a system, and the techniques for protecting network and communication assets from cyber threats. Florida Gulf Coast University titles it Network Security and describes a foundation in network security defence including intrusion detection and firewalls, with advanced topics covering security policies, packet filtering and analysis, perimeter defence, virtual private networks, and network traffic signatures.
⚠ The prerequisite requirements differ dramatically between institutions, and this is the most important practical fact in this guide.
These are not the same course experience. A student arriving with data structures and a networks course can be taught packet analysis, protocol attacks and detection engineering at a level that assumes they know what a TCP handshake looks like and can reason about algorithmic cost. A student arriving with one programming course must be taught the networking alongside the security. Both versions are legitimate and both appear under CNT 4403 — but a student transferring the course, or planning graduate work, should know which one they took, and a student choosing when to take it should recognise that the networking background is what makes the material make sense rather than an arbitrary gate.
The conceptual core of the course is a fact worth stating early: the protocols the internet runs on were designed for a cooperative research network and assume participants are honest. There is no authentication in ARP. DNS was specified without integrity protection. BGP trusts what it is told. TCP sequence numbers were originally predictable. Essentially every classical network attack exploits a design decision that was reasonable in 1983 and catastrophic at internet scale, and the security architecture of the modern network is a set of layers added afterwards to compensate. Understanding security as retrofit explains why it is hard, why it fails, and why "just use the secure protocol" is rarely a complete answer.
This is the course that most directly prepares a student for the technical security roles that employers struggle to fill. The traffic analysis and detection skills in particular are what security operations centres hire for.
Florida's demand is concentrated in identifiable clusters: the defence and special operations community around MacDill Air Force Base in Tampa, which anchors a large cleared contractor base; the Space Coast and the launch and satellite industry; Orlando's simulation, training and technology sector; Pensacola's substantial Navy cyber and cryptologic presence, which is directly relevant to UWF students; financial services in Jacksonville, Tampa and South Florida; the state's hospital systems; the cruise and logistics industries; and Florida's state agencies, universities and utilities. Defence contractors including Lockheed Martin, Northrop Grumman, L3Harris and Leidos maintain significant Florida operations with continuing demand for network security staff, most of it requiring or leading to security clearance.
Practical advice on hiring: in this specific area, demonstrable skill outweighs credentials at the entry level to an unusual degree. A student who can open an unfamiliar packet capture and explain what happened in it is doing the actual job in the interview. Build a home lab, work through published capture exercises, and compete in capture-the-flag events — the network forensics categories are the most directly job-relevant part of those competitions.
UWF requires two upper-division computing courses including networking; FGCU requires one programming course. The specific requirements:
What to do about it. Take a networking course before this one regardless of whether your institution requires it. The material assumes you can read a protocol header, reason about what happens at each hop, and understand why a stateful firewall needs to track connections — and a student without that background spends the term learning networking under the pressure of also learning attacks against it. If your institution does not require networking and you cannot fit it in first, work through the protocol fundamentals independently before the term starts; the investment is a few weeks and it changes the course from bewildering to coherent.
If you are transferring this course, note that the receiving department may ask what your version assumed. Keep the syllabus.
The statewide title is Data Security. UWF titles CNT 4403 Computer and Network Security; FGCU titles it Network Security. The descriptions all describe network security defence, so this is title drift rather than a subject difference — but the statewide title "Data Security" is genuinely misleading, since it suggests a course about protecting stored data, encryption at rest, data classification and database security. That is not what this course is. A student looking for data-at-rest security should look at CIS 4368 (Database Security) or the data protection portions of the foundations course.
Distinguish this course from CIS 4361 (Applied Security). CIS 4361 is the broad foundations course with a one-programming-course prerequisite, covering the full scope of information security including governance, risk and policy. CNT 4403 is the deeper technical course focused on network and system mechanisms. Take CIS 4361 first where both are offered; the foundations course supplies the framework that makes this one's detail meaningful. A companion guide covers CIS 4361.
CNT4403 is an upper-division course, normally taken in the junior or senior year of a cybersecurity, information technology or computer science programme after networking and programming foundations. At UWF it is itself a prerequisite for further specialisation — CNT 4416 (Cyber Operations with Defensive AI) requires it alongside a forensics or ethical hacking course — so it functions as a gateway to the advanced sequence rather than as a terminal elective. Students planning to take the advanced offerings should schedule it early enough to leave room.
CNT4403 carries the same SCNS number across Florida public institutions, and SCNS equivalency governs transfer of the credit. As an upper-division course it does not appear in A.A. programmes and is taken after transfer. Given the prerequisite divergence described above, a receiving department may reasonably ask about the depth of the version completed; equivalency moves the credit and the department decides what requirement it satisfies.
Three credit hours, approximately 45 contact hours, usually taught as lecture plus substantial laboratory work in virtualised environments. Online delivery is common and works well because the laboratories are virtual regardless. Assessment typically combines examinations, hands-on laboratory exercises, packet analysis assignments, a configuration or design project, and sometimes a capture-the-flag component. Expect eight to twelve hours a week outside class — this is one of the more demanding courses in a computing major, and the laboratory work does not compress well into the night before.
This course teaches techniques that are illegal to use against systems you do not own or lack written authorisation to test, under the federal Computer Fraud and Abuse Act and Florida law. Scanning, capturing traffic on a network you do not administer, or testing a system without documented permission can result in criminal prosecution, and separately in expulsion under institutional acceptable-use policy. Curiosity is not a defence and neither is the absence of damage.
This warning carries more weight in this course than in the foundations course because the techniques here are more directly operational. Use isolated virtual laboratories, the deliberately vulnerable practice environments that exist for the purpose, and published capture files. Note also that packet capture on a shared network raises privacy issues even where you have technical access — capturing other people's traffic on a university or workplace network is generally prohibited and potentially unlawful regardless of your intent.
The course content overlaps substantially with CompTIA Network+ and Security+, and moves toward CySA+ (analyst-level) and the SANS/GIAC network-focused certifications. For students targeting security operations roles, GIAC's certifications in intrusion detection and network forensics are the recognised credentials, though they are expensive; the Security+ remains the practical entry credential and is frequently a contract requirement for defence-adjacent work in Florida.
Network security is where AI's effect on the security field is most visible, in both directions, and this course has the technical depth to examine it properly rather than in general terms.
Machine learning is now embedded in the defensive stack. Anomaly detection over network flows identifies deviations that no signature would catch. User and entity behaviour analytics establishes baselines and flags departures. Encrypted traffic analysis infers malicious activity from metadata — packet sizes, timing, flow patterns, certificate characteristics — without decryption, which matters increasingly as the proportion of encrypted traffic approaches all of it. Automated alert triage addresses the volume problem that defines security operations work.
The failure modes are specific and this course can explain them properly. Network environments are non-stationary: a model baselined on last quarter's traffic degrades as the environment changes, and every new application deployment looks like an anomaly. The class imbalance is extreme — attacks are vanishingly rare relative to normal traffic — so a classifier with excellent accuracy still produces false positives in volume, and the operational cost of that is analyst time, which is the scarcest resource in the field. Most importantly, the adversary is adaptive in a way that no other machine learning application domain faces: attackers deliberately shape traffic to resemble normal behaviour, and evasion is an active research area on both sides. A detection model is not a solved problem that stays solved.
The offensive changes are real but narrower than the discourse suggests. Automated reconnaissance and vulnerability discovery have accelerated. Malware that varies its network behaviour to evade signature detection is easier to produce. Command-and-control traffic can be shaped to blend into normal patterns more convincingly. And the human-facing attacks — phishing, pretexting, voice cloning — have improved substantially, which matters because those remain the most common initial access vector regardless of how good the network controls are. What has not changed is the fundamentals: attackers still need initial access, still need to move laterally, still need to exfiltrate, and each of those still generates network artefacts. The MITRE ATT&CK techniques remain the techniques.
Detection engineering is where a student can see the trade-off most clearly, and it is worth doing deliberately. Writing a signature by hand — for a specific known attack pattern — gives precision, explainability and a rule you can reason about and tune. Training a model gives coverage of variants you did not anticipate and an alert you cannot fully explain. Production environments use both, and knowing which problem calls for which is a genuine professional judgement. If your course includes a Snort, Suricata or Zeek component, write the rules by hand first. Understanding what a signature can and cannot express is what lets you evaluate whether a model is adding anything.
For coursework, the usual discipline applies with a domain-specific edge. Language models help with explaining protocol behaviour, drafting and debugging analysis scripts, and interpreting an unfamiliar log format. They are unreliable on configuration specifics — generating firewall rules that are subtly permissive, TLS configurations with deprecated ciphers, or detection signatures with syntax that does not compile and logic that would not match. Every configuration must be tested in the lab and verified against vendor documentation and the relevant RFC. In this field a plausible-looking rule that does not do what you think it does is worse than no rule, because it produces confidence without coverage.
Generated September 5, 2026 · Updated September 5, 2026