FIT5037 Network Security
The Complete Study & Assessment Guide · S2 2026FIT5037 Overview
- Monash Faculty of Information Technology
- Semester 2, 2026
- a postgraduate Level 5 unit
- 6 credit points
FIT5037 covers PKI, transport attacks and security, DNS, email, DoS, wireless security, IPSec, VPNs, intrusion detection, firewalls, BGP and penetration testing. It is taught within Monash Faculty of Information Technology. It is a postgraduate Level 5 unit. It carries 6 credit points.
- Threat model first A control is meaningful only against a named asset, attacker position and capability.
- Crypto is deployed, not invoked Certificates, keys, validation and revocation determine whether a cryptographic promise survives implementation.
- Detection needs evidence An IDS rule without a response path and false-positive model is only an alert generator.
- No final exam The current S2 structure ends with a practical-and-report assignment rather than an examination.
How FIT5037 is assessed
| Component | Weight | Format |
|---|---|---|
| Class tests | 30% | The unit-information deck places the in-class test in Week 6 |
| Assignment 1 demonstration | 30% | Hands-on network-security assignment |
| Final assignment | 40% | Practical and report; live Moodle controls dates and operation |
S2 assessment consists of class tests worth 30%, a hands-on Assignment 1 demonstration worth 30%, and a final practical-and-report assignment worth 40%. The current unit-information deck says the marks must average at least 50 and publishes no separate component hurdle.
Current FIT5037 dates
| Date | Item | Control |
|---|---|---|
| Week 6 | Class test and Assignment 1 release | The class-test stream and hands-on assignment are each worth 30%. |
| Week 10 | Final assignment release | 40% practical and report. |
Current-offering dates captured in the course materials. Confirm changes and exact submission settings in the live LMS.
What FIT5037 covers
Start with Network-Security Foundations and Threat Models; use Denial of Service and Wireless Security as the turning point; finish by bringing the course together in Penetration Testing and Authorised Validation.
Network-Security Foundations and Threat Models
security property · threat model · attack surface · connect network architecture and attacker position to specific security properties02Public-Key Infrastructure and Certificate Validation
public-key infrastructure · certificate chain · revocation · verify identity binding, chain, name, time and revocation rather than accepting encryption alone03Transport-Layer Attacks and Secure Sessions
transport security · downgrade attack · session hijacking · trace handshake, negotiation and session state through attack and control04DNS Security and Name Resolution
domain name system · cache poisoning · DNSSEC · trace a query through stub, recursive and authoritative roles and test spoofing controls05Email Security and Message Authentication
email spoofing · SPF/DKIM/DMARC · phishing · connect message path, domain alignment and user action to spoofing resistance06Denial of Service and Wireless Security
denial of service · amplification · wireless trust boundary · distinguish volumetric, protocol, application and wireless attack mechanisms07IPSec and Virtual Private Networks
IPSec · security association · VPN trust model · choose tunnel endpoints and policy that match the traffic and trust boundary08Intrusion Detection and Security Telemetry
intrusion detection system · signature detection · anomaly detection · design detection with data source, threshold, false-positive cost and response09Firewalls, NAC, Proxies and Caching
firewall policy · network access control · application proxy · combine segmentation, access admission and application mediation10BGP Security and Interdomain Routing
border gateway protocol · route hijack · route-origin validation · trace how an announcement changes path selection and apply origin and operational controls11Penetration Testing and Authorised Validation
penetration test · rules of engagement · finding validation · plan and report penetration testing without crossing scope or overstating impactIt is positioned as an advanced network-security unit for IT and software-engineering pathways.
The unit joins protocol reasoning with Python-based labs, bypass thinking and a final practical-and-report assessment.
Assessment in fit5037 is distributed as follows: 30% class tests, a 30% hands-on assignment demonstration and a 40% final practical-and-report assignment
The operational assessment conditions matter here.
No final examination appears in the current assessment structure; the final 40% item is a practical-and-report assignment.
What makes fit5037 demanding is concrete: tracing a network attack through protocol state and trust assumptions before selecting controls, rather than naming a fashionable defence without testing bypass or residual risk
The landed current unit-information deck says marks must average at least 50; no separate component hurdle is published in the retrieved current surfaces.
For enrolment planning, The current Handbook lists FIT4165 for specified Software Engineering students and expects networking, Unix and basic cryptography knowledge.
Start with Network-Security Foundations and Threat Models; use Denial of Service and Wireless Security as the turning point; finish by bringing the course together in Penetration Testing and Authorised Validation.
Threat-model a public Wi-Fi login
- 1Name credentials, session and device state as assets.
- 1Trace DNS, certificate and transport validation paths.
- 1Identify downgrade, captive-portal and credential-reuse risks.
- 1Layer client validation, MFA and monitoring controls.
- 1State residual device and user-interface risks.
Key terms
- security property
- A protected objective such as confidentiality, integrity, availability, authenticity or accountability. This chapter uses the concept when students connect network architecture and attacker position to specific security properties.
- threat model
- Structured statement of assets, adversary capabilities, trust boundaries and attack goals. It helps explain the reasoning required to connect network architecture and attacker position to specific security properties.
- attack surface
- Set of reachable interfaces and states through which an adversary can influence the system. Its limit matters because a generic attacker list cannot determine risk without assets, access and assumptions.
- public-key infrastructure
- Roles, policies and technical systems that issue, bind, validate and revoke public-key credentials. This chapter uses the concept when students verify identity binding, chain, name, time and revocation rather than accepting encryption alone.
- certificate chain
- Ordered set of signed certificates linking an end entity to a trusted root under validation rules. It helps explain the reasoning required to verify identity binding, chain, name, time and revocation rather than accepting encryption alone.
- revocation
- Mechanism for indicating that a certificate or key binding should no longer be trusted before expiry. Its limit matters because a mathematically valid signature is insufficient when the name, issuer, key usage or trust anchor is wrong.
- transport security
- Protection applied to end-to-end application transport, including authentication, confidentiality and integrity. This chapter uses the concept when students trace handshake, negotiation and session state through attack and control.
- downgrade attack
- Adversarial negotiation that forces weaker protocol versions, ciphers or security properties. It helps explain the reasoning required to trace handshake, negotiation and session state through attack and control.
- session hijacking
- Unauthorised use of an established session token or transport state to act as a legitimate party. Its limit matters because strong ciphers cannot repair weak certificate validation, token handling or downgrade policy.
- domain name system
- Distributed hierarchical system mapping names to resource records through authoritative and recursive resolution. This chapter uses the concept when students trace a query through stub, recursive and authoritative roles and test spoofing controls.
- cache poisoning
- Insertion of false DNS data into a resolver cache so later clients receive attacker-chosen answers. It helps explain the reasoning required to trace a query through stub, recursive and authoritative roles and test spoofing controls.
- DNSSEC
- Signature framework that authenticates DNS data origin and integrity through a chain of trust. Its limit matters because DNSSEC authenticates data but does not by itself provide confidentiality or service availability.
- email spoofing
- Forging or misleading sender identity information to make a message appear to originate elsewhere. This chapter uses the concept when students connect message path, domain alignment and user action to spoofing resistance.
- SPF/DKIM/DMARC
- Complementary controls for authorised sending sources, cryptographic message signing and receiver policy/alignment. It helps explain the reasoning required to connect message path, domain alignment and user action to spoofing resistance.
FIT5037 FAQ
Where do students usually lose marks in fit5037?
tracing a network attack through protocol state and trust assumptions before selecting controls, rather than naming a fashionable defence without testing bypass or residual risk
How is fit5037 assessed?
30% class tests, a 30% hands-on assignment demonstration and a 40% final practical-and-report assignment
What is the fit5037 final assessed-task format?
No final examination appears in the current assessment structure; the final 40% item is a practical-and-report assignment.
Does fit5037 have a hurdle or component-level pass rule?
The landed current unit-information deck says marks must average at least 50; no separate component hurdle is published in the retrieved current surfaces.
Which offering does this fit5037 guide cover?
It is aligned to Semester 2, 2026; confirm your enrolled class and timetable in the current institutional system.
What prerequisites or restrictions apply to fit5037?
The current Handbook lists FIT4165 for specified Software Engineering students and expects networking, Unix and basic cryptography knowledge.
Is this fit5037 resource an official university guide?
No. It is an independent fit5037 study resource; current institutional instructions remain authoritative for assessment operation.
Which current fit5037 dates are captured?
Class test and Assignment 1 release: Week 6; Final assignment release: Week 10. Confirm any change and the exact submission setting in the live LMS.
How to prepare for the assessments
Retrieve the course map, practise the recurring method—name the asset, principals, trust boundary and attacker capability, trace the vulnerable protocol or configuration state, then layer prevention, detection and response while documenting residual risk—on changed scenarios, and verify every operational assessment detail in the live institutional system.
Your AI Cybersecurity tutor for FIT5037
Stuck on a hard FIT5037 question? Sia is AskSia’s AI Cybersecurity tutor — ask any FIT5037 Network Security question and get a clear, step-by-step explanation grounded in how the course is actually taught and assessed. Read this whole study guide free, then take your hardest questions to Sia.
