{
  "id": "competency:msc-software--cybersecurity",
  "code": "CDU-ICT-SEC-900",
  "level": "MSc",
  "name": "MSc Software & Cybersecurity",
  "faculty": "Faculty of Information and Communication Technology",
  "lineage": [
    {
      "institution": "Conquest Designer University",
      "year": 2026,
      "note": "authored from the brief, CSEC2017 and the FIRST/NIST standards; no prior institution is claimed"
    }
  ],
  "researchProject": "Quantifying exposure: severity, secret strength, expected loss and collision risk as engineering numbers",
  "description": "The numbers a security engineer is asked for: the CVSS v3.1 base score and severity of a vulnerability, the entropy and exhaustive-search time of a memorised secret, annualised loss expectancy and the return on a security control, and the probability of a collision among n hashes of b bits.",
  "syllabus": [
    "Vulnerability management: CVSS v3.1 base metrics, scope, the Roundup rule, severity bands",
    "Authentication: keyspace, entropy, offline guessing rates, length minimums (NIST SP 800-63B)",
    "Risk: single loss expectancy, annualised rate of occurrence, ALE, ROSI (NIST SP 800-30 Rev. 1)",
    "Cryptography: the birthday bound, collision resistance of b/2 bits (NIST SP 800-107 Rev. 1)"
  ],
  "reference": {
    "CVSS v3.1 base": "ISS = 1 − (1−C)(1−I)(1−A); impact 6.42·ISS (unchanged) or 7.52·(ISS−0.029) − 3.25·(ISS−0.02)^15 (changed); exploitability 8.22·AV·AC·PR·UI",
    "CVSS severity": "0 none; 0.1–3.9 low; 4.0–6.9 medium; 7.0–8.9 high; 9.0–10.0 critical",
    "Entropy": "length × log2(alphabet size) for a uniformly random secret",
    "ALE": "SLE × ARO, SLE = asset value × exposure factor; ROSI = (ALE before − ALE after − cost) ÷ cost",
    "Birthday bound": "P(collision) ≈ 1 − exp(−n(n−1) ÷ 2^(b+1)); 50% at ≈ 1.1774·2^(b/2)"
  },
  "role": "You are a security engineer briefing an engineering lead. State the standard and the assumption, show the computation, and say what should be patched, configured or funded first.",
  "feeUsd": 1,
  "version": "1.0.0",
  "qualification": {
    "award": "MSc",
    "nqfLevel": 9,
    "qualificationType": "Master's Degree (HEQSF qualification type 9a)",
    "totalCredits": 180,
    "minCreditsAtExitLevel": 120,
    "iscedFields": [
      "061"
    ],
    "standards": [
      "Joint Task Force on Cybersecurity Education (2017) Cybersecurity Curricula 2017 (CSEC2017), ACM/IEEE CS/AIS SIGSEC/IFIP WG 11.8",
      "FIRST Common Vulnerability Scoring System v3.1: Specification Document",
      "NIST SP 800-63B Digital Identity Guidelines: Authentication and Lifecycle Management; NIST SP 800-30 Rev. 1 Guide for Conducting Risk Assessments",
      "NIST SP 800-107 Rev. 1 Recommendation for Applications Using Approved Hash Algorithms"
    ],
    "registration": "not registered"
  },
  "modules": [
    {
      "code": "CDU-ICT-SEC-900-901",
      "title": "Coursework — the executable units",
      "nqfLevel": 9,
      "credits": 60,
      "prerequisites": [],
      "coRequisites": [],
      "outcomes": [
        "answer every unit of the qualification against its published reference, with the working shown"
      ],
      "assessment": {
        "formative": [
          "worked examples re-run against the published reference",
          "seeded practice scenarios, deterministic per (pan, unit, attempt)"
        ],
        "summative": "every unit passed once through the seeded assessment (the seeded assessment room)",
        "passMark": 50,
        "subminimum": 40,
        "moderation": "internally assessed by the unit itself — its reference implementation is the marker; the working is published so anyone can re-run the mark (D-13.1 — no model marks anything)"
      },
      "unitIds": [
        "cvss31_base",
        "password_keyspace",
        "ale_rosi",
        "birthday_collision"
      ],
      "notionalHours": 600
    },
    {
      "code": "CDU-ICT-SEC-900-902",
      "title": "Research report",
      "nqfLevel": 9,
      "credits": 120,
      "prerequisites": [
        "CDU-ICT-SEC-900-901"
      ],
      "coRequisites": [],
      "outcomes": [
        "Quantifying exposure: severity, secret strength, expected loss and collision risk as engineering numbers"
      ],
      "assessment": {
        "formative": [
          "worked examples re-run against the published reference",
          "seeded practice scenarios, deterministic per (pan, unit, attempt)"
        ],
        "summative": "the research report, assessed against the qualification’s published reference block",
        "passMark": 50,
        "subminimum": 40,
        "moderation": "internally assessed by the unit itself — its reference implementation is the marker; the working is published so anyone can re-run the mark (D-13.1 — no model marks anything)"
      },
      "unitIds": [],
      "notionalHours": 1200
    }
  ],
  "units": [
    {
      "id": "cvss31_base",
      "name": "CVSS v3.1 base score",
      "answers": "What base score and severity does this vulnerability’s CVSS v3.1 vector give?",
      "example": {
        "AV": "N",
        "AC": "L",
        "PR": "N",
        "UI": "N",
        "S": "U",
        "C": "H",
        "I": "H",
        "A": "H"
      },
      "reference": "FIRST CVSS v3.1 Specification §7 (base equations) and Appendix A (Roundup); severity rating scale §5",
      "signature": {
        "input": {
          "AV": {
            "type": "string",
            "describe": "Attack vector",
            "oneOf": [
              "N",
              "A",
              "L",
              "P"
            ]
          },
          "AC": {
            "type": "string",
            "describe": "Attack complexity",
            "oneOf": [
              "L",
              "H"
            ]
          },
          "PR": {
            "type": "string",
            "describe": "Privileges required",
            "oneOf": [
              "N",
              "L",
              "H"
            ]
          },
          "UI": {
            "type": "string",
            "describe": "User interaction",
            "oneOf": [
              "N",
              "R"
            ]
          },
          "S": {
            "type": "string",
            "describe": "Scope",
            "oneOf": [
              "U",
              "C"
            ]
          },
          "C": {
            "type": "string",
            "describe": "Confidentiality impact",
            "oneOf": [
              "H",
              "L",
              "N"
            ]
          },
          "I": {
            "type": "string",
            "describe": "Integrity impact",
            "oneOf": [
              "H",
              "L",
              "N"
            ]
          },
          "A": {
            "type": "string",
            "describe": "Availability impact",
            "oneOf": [
              "H",
              "L",
              "N"
            ]
          }
        },
        "output": {
          "vector": {
            "type": "string",
            "describe": "The CVSS:3.1 vector string"
          },
          "baseScore": {
            "type": "number",
            "describe": "0.0–10.0"
          },
          "severity": {
            "type": "string",
            "describe": "None, Low, Medium, High or Critical"
          }
        }
      }
    },
    {
      "id": "password_keyspace",
      "name": "Secret entropy and exhaustive-search time",
      "answers": "How many bits of entropy does a random secret of this length and alphabet have, and how long would an offline attacker need to exhaust it?",
      "example": {
        "length": 12,
        "alphabetSize": 62,
        "guessesPerSecond": 10000000000,
        "minimumLength": 8
      },
      "reference": "NIST SP 800-63B (Rev. 3) §5.1.1 memorised secrets, minimum length 8 (check the revision in force); entropy of a uniformly random string = L·log2(N)",
      "signature": {
        "input": {
          "length": {
            "type": "number",
            "describe": "Characters in the secret",
            "min": 1,
            "max": 256
          },
          "alphabetSize": {
            "type": "number",
            "describe": "Characters the secret is drawn from (62 = a–z A–Z 0–9)",
            "min": 2,
            "max": 100000
          },
          "guessesPerSecond": {
            "type": "number",
            "describe": "Attacker’s offline guessing rate",
            "min": 1
          },
          "minimumLength": {
            "type": "number",
            "describe": "Length minimum the policy applies",
            "min": 1,
            "max": 256,
            "default": 8
          }
        },
        "output": {
          "entropyBits": {
            "type": "number",
            "describe": "L·log2(N)"
          },
          "log10Keyspace": {
            "type": "number",
            "describe": "log10(N^L)"
          },
          "log10YearsToExhaust": {
            "type": "number",
            "describe": "log10 of the years to try every secret"
          },
          "meetsMinimumLength": {
            "type": "boolean",
            "describe": "Length ≥ the minimum"
          }
        }
      }
    },
    {
      "id": "ale_rosi",
      "name": "Annualised loss expectancy and return on security investment",
      "answers": "What loss does this threat cost a year, before and after the control, and does the control pay for itself?",
      "example": {
        "assetValue": 2000000,
        "exposureFactor": 0.35,
        "annualRateBefore": 0.5,
        "annualRateAfter": 0.1,
        "annualControlCost": 90000
      },
      "reference": "NIST SP 800-30 Rev. 1 (likelihood × impact); ISC² CISSP CBK quantitative risk analysis (SLE, ARO, ALE); Sonnenreich, Albanese & Stout (2006) ROSI",
      "signature": {
        "input": {
          "assetValue": {
            "type": "number",
            "describe": "Value of the asset at risk",
            "min": 0
          },
          "exposureFactor": {
            "type": "number",
            "describe": "Fraction of value lost per incident, 0–1",
            "min": 0,
            "max": 1
          },
          "annualRateBefore": {
            "type": "number",
            "describe": "Incidents per year without the control",
            "min": 0
          },
          "annualRateAfter": {
            "type": "number",
            "describe": "Incidents per year with the control",
            "min": 0
          },
          "annualControlCost": {
            "type": "number",
            "describe": "Annual cost of the control",
            "min": 0.01
          }
        },
        "output": {
          "singleLossExpectancy": {
            "type": "number",
            "describe": "Asset value × exposure factor"
          },
          "aleBefore": {
            "type": "number",
            "describe": "SLE × ARO before"
          },
          "aleAfter": {
            "type": "number",
            "describe": "SLE × ARO after"
          },
          "rosi": {
            "type": "number",
            "describe": "(ALE before − ALE after − cost) ÷ cost"
          }
        }
      }
    },
    {
      "id": "birthday_collision",
      "name": "Birthday-bound collision probability",
      "answers": "Among this many hashed items, how likely is at least one collision, and at what count does it reach 50%?",
      "example": {
        "hashBits": 64,
        "items": 1000000000
      },
      "reference": "The birthday bound; NIST SP 800-107 Rev. 1 §4.1 — collision resistance of an L-bit hash is at most L/2 bits",
      "signature": {
        "input": {
          "hashBits": {
            "type": "number",
            "describe": "Output length in bits",
            "min": 8,
            "max": 1024
          },
          "items": {
            "type": "number",
            "describe": "Number of values hashed",
            "min": 2
          }
        },
        "output": {
          "collisionProbability": {
            "type": "number",
            "describe": "1 − exp(−n(n−1) ÷ 2^(b+1))"
          },
          "itemsFor50Percent": {
            "type": "number",
            "describe": "√(2·ln 2·2^b)"
          },
          "securityBits": {
            "type": "number",
            "describe": "b ÷ 2"
          }
        }
      }
    }
  ]
}