Module Directory

This module focuses on the principles and practice of secure software engineering, emphasising the identification, analysis and mitigation of security vulnerabilities throughout the software development lifecycle. Students examine common attack vectors, secure design patterns, threat modelling approaches, and techniques for building resilient software systems.

The module explores how security must be embedded within requirements, architecture, implementation and testing, rather than treated as an afterthought. By integrating security measures at the earliest stages of system development, the module highlights how risks can be significantly reduced. Students will explore key principles of secure design, focusing on proactive strategies to identify and mitigate weaknesses before they can be exploited. Through case studies and real-world examples, the module provides a comprehensive understanding of how security can be embedded into the architecture of both software and hardware systems. Through practical laboratory exercises and applied security analysis, students develop the skills required to evaluate, harden and assure the security of software systems in realistic threat environments.

The aims of this module are:

• To introduce students to the principles of security-by-design within the software development lifecycle.


• To provide students with an understanding of common software vulnerabilities, attack techniques and mitigation strategies.


• To enable students to analyse and assess security risks within software systems.


• To develop students' ability to apply secure coding practices and vulnerability assessment techniques.


• To foster awareness of professional, ethical and regulatory responsibilities in secure software development.

By the end of the module, students will be expected to:

1. Analyse software systems to identify potential security vulnerabilities and attack surfaces.


2. Evaluate common classes of software vulnerabilities and recommend appropriate mitigation strategies.


3. Apply secure design principles and coding practices to develop or improve software components.


4. Assess security risks using structured approaches such as threat modelling and risk analysis frameworks.


5. Design and implement security controls to enhance the robustness and resilience of software systems.

Indicative syllabus

• Security principles and secure software development lifecycle (SSDLC)


• Threat modelling methodologies


• Common software vulnerabilities (e.g. injection, authentication flaws, insecure deserialisation, buffer overflows)


• Secure coding practices and defensive programming


• Input validation, authentication and authorisation mechanisms


• Cryptographic integration and secure API usage


• Secure design patterns and architectural security considerations


• Static and dynamic analysis tools


• Secure testing methodologies including the use of ethical hacking


• Risk assessment and vulnerability management


• Legal, ethical and professional considerations in secure development

This module will be delivered via:

• Ten 2-hour lectures
• Ten 2-hour laboratory sessions
• Twenty academic support hours

Lectures introduce theoretical foundations, structured security concepts and case-based analysis. Laboratory sessions provide hands-on experience in vulnerability identification, secure coding, threat modelling and use of security analysis tools. Students are expected to undertake guided reading and independent practice outside scheduled teaching hours.

Teaching materials will be made available through the University's virtual learning environment (Moodle) including lecture recordings, structured lab guides and supplementary resources.

Inclusive learning is supported through clear task scaffolding, step-by-step laboratory guidance, accessible digital materials, flexible engagement with recorded content, and formative feedback opportunities. Adjustments can be made where required in accordance with individual learning plans.

Laboratory activities may involve security analysis and simulated attack scenarios; care will be taken to ensure activities are conducted within controlled environments and that appropriate guidance is provided. CSEE have an existing "Cyber security environment" that has been validated by the Digital Innovation and Technology Services (DITS) section as providing the suitable controls to operate the laboratories safely.