COSC2536: ace the project, not just read the notes
Your complete guide to RMIT University's security in computing and information technology unit. See where the marks are, work real practice questions, and study with an AI tutor that knows COSC2536.
Sia generates COSC2536 practice questions, walks through security services in computing environments and security issues in networked applications step by step, and quizzes you on the material the project that weights most heavily.
Find what is wrong
An application stores user passwords by hashing them with SHA-256. Is this adequate, and if not, what is missing?
Separate two different properties. SHA-256 is not reversible, which is true and is why option B feels right. But irreversibility is not the property that protects a password database — resistance to guessing is.
Identify the second and larger gap. SHA-256 is designed to be fast, which is exactly wrong here: an attacker with the hash file can try billions of candidates per second. A password hash should be deliberately slow, which is what bcrypt, scrypt and Argon2 provide, with a tunable work factor.
Reject option C on principle. Encryption is reversible by design, so a compromised key exposes every password in plaintext. Passwords should never be recoverable — that is the point. Option D adds a real defence but addresses a different threat: encryption at rest protects against stolen storage, not against an attacker who has already reached the application layer.
The trap: Option C is the answer that comes from thinking about the operational requirement — support staff wanting to recover a password — rather than the threat model. It is also the reason breaches leak plaintext credentials. Option B is the subtler trap: every individual claim in it is true, and the conclusion still does not follow, because the security property that matters here is not the one being cited. classic slip!
One project decides 45% of your grade. Continual assessment. This whole page is built around that.
Overview
What COSC2536 is, and where it sits
COSC2536 opens with a framing the description states plainly: security has become a focal area in IT, it has grown and evolved significantly in recent years, and different areas of specialisation have emerged. This course gives an introduction to the technical aspects and presents the foundations rather than any one specialisation.
The published scope is deliberately broad. It covers fundamental cryptographic and security mechanisms used across networked applications and computing — operating systems, databases and other relevant applications — as well as modern privacy preserving systems. RMIT also states the course introduces the fundamental discussion involving fraud detection using machine learning, which is unusual in an introductory security course.
The reasoning behind the breadth is stated too: for computer systems relied upon in many areas of life, availability and correct operation are essential, and IT professionals need to be well acquainted with the security features of the tools they use and produce. This is a course for people who will build systems, not only for people who will attack them.
Always treat your own course outline and the exam timetable as authoritative.
Difficulty & time commitment
Is COSC2536 hard, and how much time does it take?
COSC2536 is manageable if you keep a weekly rhythm and treat the back half as the main event. The pattern is consistent: it starts gently and steepens, and the heaviest assessment is the part that separates grades.
The difficulty curve and the assessment weighting point the same way: the back half is harder and worth more. Front-loading effort there is the highest-return decision in the unit.
Is this unit for you
Who tends to do well, and who tends to struggle
You will likely do well if
- You implement cryptographic mechanisms rather than only reading about them; the 45% project requires it.
- You reason from a threat model — who the attacker is and what they can reach — rather than from a checklist.
- You can write a clear analytical argument, since 35% of the grade is a report.
- You keep confidentiality, integrity and availability distinct, because most security questions turn on which one is at stake.
You may struggle if
- You treat security as a list of technologies to name rather than properties to reason about.
- You implement cryptography from memory; the details are where implementations fail.
- You arrive without functional Java or Python, which RMIT states is assumed.
- You defer the 45% project, which is the largest component and requires working code.
- For every mechanism, state which security property it provides and which it does not. That single habit answers most of the report questions.
- Never invent a cryptographic construction. Use the standard one and be able to explain why it is standard — the course rewards that reasoning.
- Write the threat model before the solution: who is the attacker, what do they have access to, what are they trying to obtain.
- For the practical evaluation outcome, work on a real system you can actually inspect rather than a hypothetical one.
Syllabus
The 12 topics, topic by topic
The exam-weight marker on each topic shows where the marks concentrate. The amber topics carry the highest exam weight.
T1 · Security services in computing environments
CLO1What security actually provides: confidentiality, integrity, availability, authentication and non-repudiation.
T2 · Security issues in networked applications
CLO1Where networked systems are exposed, and why the network changes the threat model.
T3 · Cryptographic foundations
Course description, CLO2Symmetric and asymmetric cryptography as the mechanisms everything else is built from.
T4 · Data confidentiality mechanisms
CLO2Encryption in practice, including key management and where it typically fails.
T5 · Data integrity mechanisms
CLO2Hashing, message authentication and digital signatures.
T6 · Operating system and file system security
Course description, CLO3Access control, permissions and the protections the OS itself provides.
T7 · Database security
Course description, CLO4Protecting data at rest and controlling who can read what.
T8 · Network protocols and security
CLO3Basic system security mechanisms and protocols in computer networks.
T9 · Web systems security
CLO4Why web applications are the most exposed surface most organisations have.
T10 · Privacy preserving systems
Course description, CLO5Modern approaches to using data without exposing it.
T11 · Fraud detection with machine learning
Course descriptionThe fundamental discussion the course names explicitly, applying learning methods to detection.
T12 · Evaluating system security in practice
CLO5Analysing and evaluating the security of a real system rather than describing security in general.
How it's assessed
Assessment structure
| Component | Weight | Format & timing |
|---|---|---|
| Programming-based Security Project | 45% | Programming-based security project, supporting course learning outcomes 2 to 5. Across the semester. Continual assessment. |
| Analytical Security Report | 35% | Analytical security report, supporting course learning outcomes 1 to 3. Across the semester. Continual assessment. |
| End-of-Semester in-class face-to-face timed-exercise | 20% | In-class face-to-face timed exercise at the end of semester, supporting all five course learning outcomes. End of semester. Timed, in class. |
- The three published tasks sum to 100. RMIT states plainly that this course has no hurdle requirements, so no component must be passed independently.
- There is no examination, and the timed component is only 20% — the smallest in our RMIT set. That makes this the most coursework-driven course here: 80% of the grade is a report and a programming project, both produced without a time limit and both marked on the quality of the security reasoning rather than on getting a determinate answer.
This is a coursework unit. Coursework carries 80% of the grade and the programming-based security project is the single heaviest piece at 45%, so steady work across the semester decides your result more than any one sitting. Continual assessment.
Final exam timing: No examination; 20% end-of-semester in-class timed exercise. Confirm the exact date and venue on your exam timetable.
How to actually pass it
A weekly rhythm, two checklists, and the traps to avoid
The unit rewards consistency over cramming, and practice over re-reading. Here is the loop that works, then what to have nailed before each exam.
The weekly loop
Before the mid-semester checklist
- Explain security services and the security issues in networked applications.
- Discuss and implement data integrity and confidentiality mechanisms including cryptography.
- Describe system security mechanisms in operating systems and file systems.
- Explain basic protocols used in computer networks.
Before the final heaviest topics
- Analyse the importance of IT security across networking, databases, operating systems and web systems.
- Explain modern privacy preserving systems.
- Discuss fraud detection using machine learning.
- Analyse and evaluate the security of a computing system on a practical level, including privacy issues.
The mistakes that cost marks
Hashing confused with password storage. A fast cryptographic hash is not a password hash. Salting and a deliberately slow key derivation function are what resist guessing.
Encryption used where hashing is required. Encryption is reversible by design. Passwords should never be recoverable, and treating them as encryptable is how breaches leak plaintext.
Custom cryptographic constructions. Standard constructions are standard because they have been attacked for years. Inventing one is the classic novice failure.
Controls listed without a threat model. A control only means something against a stated attacker with stated access. Listing defences without that framing cannot score well in the report.
Teaching team
Who teaches COSC2536
The bios below are factual. We do not rate lecturers; any star ratings are submitted by students who have taken COSC2536.
Teaching team as listed in public course information. AskSia does not rate lecturers; star ratings are submitted by students who have taken COSC2536.
Formula & concept sheet
The vocabulary and formulas you must own
- Confidentiality
- The property that information is not disclosed to unauthorised parties.
- Integrity
- The property that information has not been altered undetectably.
- Availability
- The property that a system remains usable when needed; the third leg most often forgotten.
- Symmetric cryptography
- Encryption where the same key encrypts and decrypts.
- Asymmetric cryptography
- Encryption using a public and private key pair, enabling exchange without a shared secret.
- Cryptographic hash
- A one-way function mapping data to a fixed-size digest; fast by design, which matters for how it should be used.
- Salt
- Per-user random data added before hashing, so identical inputs do not produce identical digests.
- Key derivation function
- A deliberately slow function for deriving a key or password hash, with a tunable work factor.
- Digital signature
- A construction providing integrity and origin authentication using asymmetric cryptography.
- Access control
- The mechanism deciding which subjects may perform which operations on which objects.
- Threat model
- An explicit statement of who the attacker is, what they can access and what they seek; the frame every security argument needs.
- Privacy preserving system
- A system designed to permit use of data while limiting what it reveals about individuals.
Common acronyms: AES · CIA · CLO · MAC · PKI · TLS.
Where it fits
Prerequisites, related units & why it matters
RMIT publishes no enforced prerequisite for this course; assumed knowledge is a functional command of Java or Python. Worth 12 credit points at City Campus by the School of Computing Technologies. It contributes to BP355 Bachelor of Cyber Security and BP356 Bachelor of Cyber Security (Professional), and to the cyber security major within the Computer Science, Data Science and Information Technology degrees.
Your COSC2536 study toolkit
Study the unit with Sia, not just read about it
Each tool already knows COSC2536: your syllabus, your texts, and where the marks are. Grouped by how you study, from first contact to exam week.
FAQ
Frequently asked questions
Is COSC2536 hard?
It rates moderately hard. There is no enforced prerequisite and no examination, but the material spans cryptography, systems, networks, databases and privacy, and the 45% project requires implementing security mechanisms correctly rather than describing them.
What is the assessment breakdown?
Programming-based security project 45%, analytical security report 35%, end-of-semester in-class timed exercise 20%. There is no examination.
Are there hurdle requirements?
No. RMIT states plainly that this course has no hurdle requirements.
What do I need before taking it?
No enforced prerequisite. RMIT states that a functional knowledge of Java or Python is assumed.
Who coordinates the course?
The published course coordinator is Shekhar Kalra, School of Computing Technologies.
Does it cover machine learning?
In one specific respect. the description states the course introduces the fundamental discussion involving fraud detection using machine learning. It is not a machine learning course, but that application is named explicitly.
Study COSC2536 with Sia
Work through security services in computing environments, security issues in networked applications, cryptographic foundations and the rest of the unit with a tutor that knows it and quizzes you on the topics the assessments weight most heavily.
Start studying with Sia
