CityUHK IS6523: Information Systems Infrastructure and Security Management — course overview with AskSia
IS6523 Information Systems Infrastructure and Security Management is a 3-credit postgraduate course from the Department of Information Systems at City University of Hong Kong, offered in Semester A 2026/27. It is equivalent to IS6522 and has no prerequisites.
Sia generates IS6523 practice questions, walks through threats and privacy step by step, and quizzes you on the material the exam weights most heavily.
Sharpen your argument
An online retailer stores customers' card numbers in plain text 'so refunds are quick'. A manager asks which single control to prioritise. Which answer best applies the course's managerial framework?
Start from risk assessment: the asset is card data, the threat is theft, the vulnerability is plain-text storage.
It also shrinks the IS-audit scope and meets the data-privacy obligations covered in the legal topic.
A firewall, backup-only encryption or a policy alone each leave the plain-text asset in place.
One exam decides 50% of your grade. Minimum 25% in the examination; must pass both coursework and exam. This whole page is built around that.
Overview
What IS6523 is, and where it sits
IS6523 Information Systems Infrastructure and Security Management is a 3-credit postgraduate course from the Department of Information Systems at City University of Hong Kong, offered in Semester A 2026/27. It is equivalent to IS6522 and has no prerequisites.
The syllabus frames the course managerially: the key infrastructure and security issues in electronic-commerce transactions, covering both electronic payment infrastructure and transactional security infrastructure. Lectures move from threats and attack methods through IS security principles and tools, IT risk management, the IS audit life cycle and controls framework, electronic payment systems and certification authorities, to security policy and the legal and ethical issues in the HKSAR context.
Assessment is 50% continuous (class activity 5%, an individual assignment 15%, a group project 30%) and a 50% two-hour examination, with a minimum of 25% required in each half.
Always treat your own course outline and the exam timetable as authoritative.
Difficulty & time commitment
Is IS6523 hard, and how much time does it take?
IS6523 is manageable if you keep a weekly rhythm and treat the back half as the main event. The pattern is consistent: it starts gently and steepens, and the heaviest assessment is the part that separates grades.
The difficulty curve and the assessment weighting point the same way: the back half is harder and worth more. Front-loading effort there is the highest-return decision in the course.
Is this course for you
Who tends to do well, and who tends to struggle
You will likely do well if
- You can write a clear recommendation for a manager, not just a list of vulnerabilities.
- You are willing to learn the Hong Kong regulatory context: recognised CAs, computer-crime and data-privacy law.
- You keep up with the class exercises; they are the exam style in miniature.
You may struggle if
- You expect a hands-on penetration-testing course.
- You let the group carry the 30% project; peer-visible criteria include communication with stakeholders.
- You revise tools without the controls framework that the exam asks you to apply.
- For each threat, write the control, the audit evidence that shows the control works, and the law that applies.
- Practise turning a case into a one-page security policy with roles, risk assessment and critical success factors.
- Sketch the flow of one electronic payment method end to end and mark where each security mechanism sits.
Syllabus
The 10 topics, topic by topic
Topics from the public source. Their order is a content map, not an official weekly timetable or published exam weighting.
T1 · Threats and attack methods
Lecture itemsUnderstanding threats to business systems and the general methods of attack.
T2 · Privacy and security principles
Keyword syllabus detailsData and transactional security, data privacy, public-key encryption and digital signatures.
T3 · Network security
Keyword syllabus detailsTypes of breach, intrusion detection, firewalls, identity threat management.
T4 · IT risk management
Lecture itemsRisk assessment and management of information technology risks.
T5 · IS audit and controls framework
Keyword syllabus detailsAudit principles, management and application controls, evidence collection and evaluation, the audit life cycle.
T6 · Electronic payment systems
Keyword syllabus detailsDigital cash, electronic cheques, online cards, stored value, EFT and debit, settlement systems and protocols.
T7 · Certification authorities
Keyword syllabus detailsTechnology and organisation of CAs; the code of practice for recognised CAs in the HKSAR.
T8 · Security management and policy
Keyword syllabus detailsRoles and functions, security strategies and policies, implementation issues, critical success factors.
T9 · Legal and professional issues
Keyword syllabus detailsProfessional codes of conduct; laws on computer crime, online transactions, intellectual property and data privacy.
T10 · Security consultancy and communication
CILO 5; AT3Presenting findings and recommendations to stakeholders; the group audit report and presentation.
How it's assessed
Assessment structure
| Component | Weight | Format & timing |
|---|---|---|
| Class activity (exercises and group discussion) | 5% | Class exercises and group discussions in seminars applying the concepts to business scenarios. Throughout. Continuous. |
| Individual assignment: written report on a new development in a course topic | 15% | Written report on a new development in one of the course topics, with critical analysis and its impact on business organizations. Mid-semester. Continuous. |
| Group project (4-6 students): IS security / audit analysis report + 20-minute presentation | 30% | Group of 4-6 students produces an IS security or audit analysis report with findings and recommendations, plus a 20-minute presentation. Late semester. Continuous. |
| Final examination (2 hours) | 50% | Two-hour written examination on the taught subjects. Examination period. Minimum 25% in the examination; must pass both coursework and exam. |
- Coursework 50%, examination 50%. Minimum continuous-assessment passing requirement 25% and minimum examination passing requirement 25%; students must pass both to pass the course. GenAI use is allowed on the coursework tasks.
- A two-hour written examination worth 50%, assessing competence in the taught subjects against the same five criteria used for the coursework: applying security concepts and IT risk management, evaluating audit principles and controls, designing security policy with the legal issues in view, and evaluating electronic payment security.
This is an exam-cram course. With the exams at 50% of the grade and the final examination (2 hours) alone at 50%, your result is overwhelmingly decided by how well you perform under time pressure. Minimum 25% in the examination; must pass both coursework and exam.
Final exam timing: During the examination period. Confirm the exact date and venue on your exam timetable.
How to actually pass it
A weekly rhythm, two checklists, and the traps to avoid
The course rewards consistency over cramming, and practice over re-reading. Here is the loop that works, then what to have nailed before each exam.
The weekly loop
The mistakes that cost marks
Formula & concept sheet
The vocabulary and formulas you must own
- Public-key encryption
- Encryption using a public key that only the matching private key can decrypt; the basis of digital signatures.
- Digital signature
- A hash of a message encrypted with the sender's private key, proving origin and integrity.
- Intrusion detection system
- Software that monitors traffic or hosts for signs of attack.
- Certification authority
- A trusted body that issues and vouches for digital certificates.
- Application control
- A control built into an information system to ensure complete and accurate processing.
- IS audit life cycle
- Planning, fieldwork and evidence collection, evaluation and reporting on an information system.
- Risk assessment
- Identifying assets, threats and vulnerabilities and estimating likelihood and impact.
- Security policy
- The management statement of security objectives, roles and rules for an organisation.
Set texts
The prescribed reading
The syllabus references map straight onto these.
Whitman & Mattord, Principles of Information Security, 6th ed., Course Technology
.
Where it fits
Prerequisites, related courses & why it matters
No prerequisites; 3 credit units; postgraduate; offered Semester A 2026/27. Equivalent to IS6522.
Your IS6523 study toolkit
Study the course with Sia, not just read about it
Use your permitted course notes with these study tools. Follow your course’s rules for AI and assessed work.
FAQ
Frequently asked questions
Is IS6523 hard?
Moderate on the six-factor rubric, a shade above the HK anchor. The content is managerial, but 80% sits in the exam and the group project and both halves carry a 25% minimum.
What is the assessment breakdown?
Class activity 5%, individual assignment 15%, group project 30%, two-hour examination 50%, per the CityU syllabus effective Semester A 2026/27.
Is it technical?
The syllabus says a managerial perspective is adopted throughout. You need to understand encryption, firewalls and payment protocols well enough to evaluate them, not to build them.
Which textbook?
Whitman and Mattord, Principles of Information Security, 6th edition, is compulsory; audit and e-commerce security references are listed as additional.
How big is the group project?
Groups of four to six write an IS security or audit analysis report with recommendations and give a 20-minute presentation; it is 30% of the grade.
Is IS6522 the same course?
IS6522 Infrastructure and Security Management for eCommerce is listed as equivalent, so you cannot count both.
Study IS6523 with Sia
Practise explaining the course concepts and check your reasoning. Confirm assessed-work requirements in your current outline.
Start studying with Sia
