商业信息安全

### 📖 核心知识点：Introduction to Information Security We introduce the concept of information security and the fundamental view we shall use to analyse this topic. 本周围绕 Introduction to Information Security We introduce the concept of information security and the fundamental view we shall use to analyse this topic. 的核心概念与应用场景展开，建议先把 lecture 中给出的定义、边界和示例理解透，再通过 tutorial/workshop 把知识点转化成可执行步骤。学习重点不是记住术语，而是能在案例里解释为什么使用这个方法、何时不该使用，以及与前后主题的连接关系。 - **核心概念/公式**: Introduction to Information Security We introduce the concept of information security and the fundamental view we shall use to analyse this topic., data modelling, SQL/Python, system design ⏰ **本周节奏**: 难度 ⭐⭐⭐ | 预计投入 9h（Lecture 2h + 自学 4h + 作业/Lab 3h） 🎯 **考试关联**: 常见题型是概念辨析 + 场景应用，建议用“定义-步骤-取舍”结构答题。 🧪 **Tutorial/Lab**: 围绕“Introduction to Information Security We introduce the concept of information security and the fundamental view we shall use to analyse this topic.”完成课堂练习，并整理 1 页方法清单。 📌 **作业关联**: 与当周作业/项目里对应模块直接相关，建议本周完成第一版并留出测试时间。 ⚠️ **易错点**: 只背概念不结合场景，答案缺少可执行控制措施。 （数据来源：2000 UQ Course Profile (BISM3205)）

### 📖 核心知识点：The Need for Security / Legal and Ethical Issues We discuss the need for information security - types of security threats. We introduce a range of Australian IT related laws and the advantages/disadvantages these pose. 本周围绕 The Need for Security / Legal and Ethical Issues We discuss the need for information security - types of security threats. We introduce a range of Australian IT related laws and the advantages/disadvantages these pose. 的核心概念与应用场景展开，建议先把 lecture 中给出的定义、边界和示例理解透，再通过 tutorial/workshop 把知识点转化成可执行步骤。学习重点不是记住术语，而是能在案例里解释为什么使用这个方法、何时不该使用，以及与前后主题的连接关系。 - **核心概念/公式**: The Need for Security / Legal and Ethical Issues We discuss the need for information security - types of security threats. We introduce a range of Australian IT related laws and the advantages/disadvantages these pose., data modelling, SQL/Python, system design ⏰ **本周节奏**: 难度 ⭐⭐⭐ | 预计投入 9h（Lecture 2h + 自学 4h + 作业/Lab 3h） 🎯 **考试关联**: 常见题型是概念辨析 + 场景应用，建议用“定义-步骤-取舍”结构答题。 🧪 **Tutorial/Lab**: 围绕“The Need for Security / Legal and Ethical Issues We discuss the need for information security - types of security threats. We introduce a range of Australian IT related laws and the advantages/disadvantages these pose.”完成课堂练习，并整理 1 页方法清单。 📌 **作业关联**: 与当周作业/项目里对应模块直接相关，建议本周完成第一版并留出测试时间。 ⚠️ **易错点**: 只背概念不结合场景，答案缺少可执行控制措施。 （数据来源：2000 UQ Course Profile (BISM3205)）

### 📖 核心知识点：Planning for Security We discuss management's role in the development, maintenance, and enforcement of information security policy and standards. We explain what an information security blueprint is in the context of the ISO 27000 series. We introduce contingency planning. 本周围绕 Planning for Security We discuss management's role in the development, maintenance, and enforcement of information security policy and standards. We explain what an information security blueprint is in the context of the ISO 27000 series. We introduce contingency planning. 的核心概念与应用场景展开，建议先把 lecture 中给出的定义、边界和示例理解透，再通过 tutorial/workshop 把知识点转化成可执行步骤。学习重点不是记住术语，而是能在案例里解释为什么使用这个方法、何时不该使用，以及与前后主题的连接关系。 - **核心概念/公式**: Planning for Security We discuss management's role in the development, maintenance, and enforcement of information security policy and standards. We explain what an information security blueprint is in the context of the ISO 27000 series. We introduce contingency planning., data modelling, SQL/Python, system design ⏰ **本周节奏**: 难度 ⭐⭐⭐ | 预计投入 9h（Lecture 2h + 自学 4h + 作业/Lab 3h） 🎯 **考试关联**: 常见题型是概念辨析 + 场景应用，建议用“定义-步骤-取舍”结构答题。 🧪 **Tutorial/Lab**: 围绕“Planning for Security We discuss management's role in the development, maintenance, and enforcement of information security policy and standards. We explain what an information security blueprint is in the context of the ISO 27000 series. We introduce contingency planning.”完成课堂练习，并整理 1 页方法清单。 📌 **作业关联**: 与当周作业/项目里对应模块直接相关，建议本周完成第一版并留出测试时间。 ⚠️ **易错点**: 只背概念不结合场景，答案缺少可执行控制措施。 （数据来源：2000 UQ Course Profile (BISM3205)）

### 📖 核心知识点：Risk Management (Part 1) In the first part, we focus on defining risk management and its role in the organisation. We describe risk management techniques to identify and prioritise risk factors for assets. We explain how risk is assessed. 本周围绕 Risk Management (Part 1) In the first part, we focus on defining risk management and its role in the organisation. We describe risk management techniques to identify and prioritise risk factors for assets. We explain how risk is assessed. 的核心概念与应用场景展开，建议先把 lecture 中给出的定义、边界和示例理解透，再通过 tutorial/workshop 把知识点转化成可执行步骤。学习重点不是记住术语，而是能在案例里解释为什么使用这个方法、何时不该使用，以及与前后主题的连接关系。 - **核心概念/公式**: Risk Management (Part 1) In the first part, we focus on defining risk management and its role in the organisation. We describe risk management techniques to identify and prioritise risk factors for assets. We explain how risk is assessed., data modelling, SQL/Python, system design ⏰ **本周节奏**: 难度 ⭐⭐⭐ | 预计投入 9h（Lecture 2h + 自学 4h + 作业/Lab 3h） 🎯 **考试关联**: 常见题型是概念辨析 + 场景应用，建议用“定义-步骤-取舍”结构答题。 🧪 **Tutorial/Lab**: 围绕“Risk Management (Part 1) In the first part, we focus on defining risk management and its role in the organisation. We describe risk management techniques to identify and prioritise risk factors for assets. We explain how risk is assessed.”完成课堂练习，并整理 1 页方法清单。 📌 **作业关联**: 与当周作业/项目里对应模块直接相关，建议本周完成第一版并留出测试时间。 ⚠️ **易错点**: 只背概念不结合场景，答案缺少可执行控制措施。 （数据来源：2000 UQ Course Profile (BISM3205)）

### 📖 核心知识点：Risk Management (Part 2) In the second part, we discuss strategy options used to treat risk. We formulate a cost-benefit analysis (CBA) using existing conceptual frameworks. We describe popular methodologies used in business to manage risk. 本周围绕 Risk Management (Part 2) In the second part, we discuss strategy options used to treat risk. We formulate a cost-benefit analysis (CBA) using existing conceptual frameworks. We describe popular methodologies used in business to manage risk. 的核心概念与应用场景展开，建议先把 lecture 中给出的定义、边界和示例理解透，再通过 tutorial/workshop 把知识点转化成可执行步骤。学习重点不是记住术语，而是能在案例里解释为什么使用这个方法、何时不该使用，以及与前后主题的连接关系。 - **核心概念/公式**: Risk Management (Part 2) In the second part, we discuss strategy options used to treat risk. We formulate a cost-benefit analysis (CBA) using existing conceptual frameworks. We describe popular methodologies used in business to manage risk., data modelling, SQL/Python, system design ⏰ **本周节奏**: 难度 ⭐⭐⭐ | 预计投入 9h（Lecture 2h + 自学 4h + 作业/Lab 3h） 🎯 **考试关联**: 常见题型是概念辨析 + 场景应用，建议用“定义-步骤-取舍”结构答题。 🧪 **Tutorial/Lab**: 围绕“Risk Management (Part 2) In the second part, we discuss strategy options used to treat risk. We formulate a cost-benefit analysis (CBA) using existing conceptual frameworks. We describe popular methodologies used in business to manage risk.”完成课堂练习，并整理 1 页方法清单。 📌 **作业关联**: 与当周作业/项目里对应模块直接相关，建议本周完成第一版并留出测试时间。 ⚠️ **易错点**: 只背概念不结合场景，答案缺少可执行控制措施。 （数据来源：2000 UQ Course Profile (BISM3205)）

### 📖 核心知识点：Cryptography (Part 1) We consider two major encryption paradigms - symmetric key and public key cryptography - their operational strengths and challenges. 本周围绕 Cryptography (Part 1) We consider two major encryption paradigms - symmetric key and public key cryptography - their operational strengths and challenges. 的核心概念与应用场景展开，建议先把 lecture 中给出的定义、边界和示例理解透，再通过 tutorial/workshop 把知识点转化成可执行步骤。学习重点不是记住术语，而是能在案例里解释为什么使用这个方法、何时不该使用，以及与前后主题的连接关系。 - **核心概念/公式**: Cryptography (Part 1) We consider two major encryption paradigms - symmetric key and public key cryptography - their operational strengths and challenges., data modelling, SQL/Python, system design ⏰ **本周节奏**: 难度 ⭐⭐⭐ | 预计投入 9h（Lecture 2h + 自学 4h + 作业/Lab 3h） 🎯 **考试关联**: 常见题型是概念辨析 + 场景应用，建议用“定义-步骤-取舍”结构答题。 🧪 **Tutorial/Lab**: 围绕“Cryptography (Part 1) We consider two major encryption paradigms - symmetric key and public key cryptography - their operational strengths and challenges.”完成课堂练习，并整理 1 页方法清单。 📌 **作业关联**: 与当周作业/项目里对应模块直接相关，建议本周完成第一版并留出测试时间。 ⚠️ **易错点**: 只记知识点标题，忽略前后周之间的方法衔接和应用边界。 （数据来源：2000 UQ Course Profile (BISM3205)）

### 📖 核心知识点：Cryptography (Part 2) We consider the commercial applications of cryptography - hybrid security applications for the Web and Email. We also consider other important applications such as digital signatures. 本周围绕 Cryptography (Part 2) We consider the commercial applications of cryptography - hybrid security applications for the Web and Email. We also consider other important applications such as digital signatures. 的核心概念与应用场景展开，建议先把 lecture 中给出的定义、边界和示例理解透，再通过 tutorial/workshop 把知识点转化成可执行步骤。学习重点不是记住术语，而是能在案例里解释为什么使用这个方法、何时不该使用，以及与前后主题的连接关系。 - **核心概念/公式**: Cryptography (Part 2) We consider the commercial applications of cryptography - hybrid security applications for the Web and Email. We also consider other important applications such as digital signatures., data modelling, SQL/Python, system design ⏰ **本周节奏**: 难度 ⭐⭐⭐ | 预计投入 9h（Lecture 2h + 自学 4h + 作业/Lab 3h） 🎯 **考试关联**: 常见题型是概念辨析 + 场景应用，建议用“定义-步骤-取舍”结构答题。 🧪 **Tutorial/Lab**: 围绕“Cryptography (Part 2) We consider the commercial applications of cryptography - hybrid security applications for the Web and Email. We also consider other important applications such as digital signatures.”完成课堂练习，并整理 1 页方法清单。 📌 **作业关联**: 与当周作业/项目里对应模块直接相关，建议本周完成第一版并留出测试时间。 ⚠️ **易错点**: 只背概念不结合场景，答案缺少可执行控制措施。 （数据来源：2000 UQ Course Profile (BISM3205)）

### 📖 核心知识点：Security Technology (Firewalls, Proxys and the DMZ - Part 1) A business analysis of major types of security controls - operational approaches and positioning within the business network. 本周围绕 Security Technology (Firewalls, Proxys and the DMZ - Part 1) A business analysis of major types of security controls - operational approaches and positioning within the business network. 的核心概念与应用场景展开，建议先把 lecture 中给出的定义、边界和示例理解透，再通过 tutorial/workshop 把知识点转化成可执行步骤。学习重点不是记住术语，而是能在案例里解释为什么使用这个方法、何时不该使用，以及与前后主题的连接关系。 - **核心概念/公式**: Security Technology (Firewalls, Proxys and the DMZ - Part 1) A business analysis of major types of security controls - operational approaches and positioning within the business network., data modelling, SQL/Python, system design ⏰ **本周节奏**: 难度 ⭐⭐⭐ | 预计投入 9h（Lecture 2h + 自学 4h + 作业/Lab 3h） 🎯 **考试关联**: 常见题型是概念辨析 + 场景应用，建议用“定义-步骤-取舍”结构答题。 🧪 **Tutorial/Lab**: 围绕“Security Technology (Firewalls, Proxys and the DMZ - Part 1) A business analysis of major types of security controls - operational approaches and positioning within the business network.”完成课堂练习，并整理 1 页方法清单。 📌 **作业关联**: 与当周作业/项目里对应模块直接相关，建议本周完成第一版并留出测试时间。 ⚠️ **易错点**: 只背概念不结合场景，答案缺少可执行控制措施。 （数据来源：2000 UQ Course Profile (BISM3205)）

### 📖 核心知识点：Security Technology (Intrusion Detection - Part 2) Consideration of the role of intrusion detection systems - placement and operational approaches. We analyse how intrusion detection systems (IDS) provide 'defence in depth' for the modern business. 本周围绕 Security Technology (Intrusion Detection - Part 2) Consideration of the role of intrusion detection systems - placement and operational approaches. We analyse how intrusion detection systems (IDS) provide 'defence in depth' for the modern business. 的核心概念与应用场景展开，建议先把 lecture 中给出的定义、边界和示例理解透，再通过 tutorial/workshop 把知识点转化成可执行步骤。学习重点不是记住术语，而是能在案例里解释为什么使用这个方法、何时不该使用，以及与前后主题的连接关系。 - **核心概念/公式**: Security Technology (Intrusion Detection - Part 2) Consideration of the role of intrusion detection systems - placement and operational approaches. We analyse how intrusion detection systems (IDS) provide 'defence in depth' for the modern business., data modelling, SQL/Python, system design ⏰ **本周节奏**: 难度 ⭐⭐⭐ | 预计投入 9h（Lecture 2h + 自学 4h + 作业/Lab 3h） 🎯 **考试关联**: 常见题型是概念辨析 + 场景应用，建议用“定义-步骤-取舍”结构答题。 🧪 **Tutorial/Lab**: 围绕“Security Technology (Intrusion Detection - Part 2) Consideration of the role of intrusion detection systems - placement and operational approaches. We analyse how intrusion detection systems (IDS) provide 'defence in depth' for the modern business.”完成课堂练习，并整理 1 页方法清单。 📌 **作业关联**: 与当周作业/项目里对应模块直接相关，建议本周完成第一版并留出测试时间。 ⚠️ **易错点**: 只背概念不结合场景，答案缺少可执行控制措施。 （数据来源：2000 UQ Course Profile (BISM3205)）

### 📖 核心知识点：PCI DSS Discussion & Analysis A 'capstone' analysis of the Payment Card Industry Data Security Standard (PCI DSS). A contractually obligatory standard for any business storing, forwarding or processing in-house credit card data for Visa, Mastercard, and Amex. 本周围绕 PCI DSS Discussion & Analysis A 'capstone' analysis of the Payment Card Industry Data Security Standard (PCI DSS). A contractually obligatory standard for any business storing, forwarding or processing in-house credit card data for Visa, Mastercard, and Amex. 的核心概念与应用场景展开，建议先把 lecture 中给出的定义、边界和示例理解透，再通过 tutorial/workshop 把知识点转化成可执行步骤。学习重点不是记住术语，而是能在案例里解释为什么使用这个方法、何时不该使用，以及与前后主题的连接关系。 - **核心概念/公式**: PCI DSS Discussion & Analysis A 'capstone' analysis of the Payment Card Industry Data Security Standard (PCI DSS). A contractually obligatory standard for any business storing, forwarding or processing in-house credit card data for Visa, Mastercard, and Amex., data modelling, SQL/Python, system design ⏰ **本周节奏**: 难度 ⭐⭐⭐ | 预计投入 9h（Lecture 2h + 自学 4h + 作业/Lab 3h） 🎯 **考试关联**: 常见题型是概念辨析 + 场景应用，建议用“定义-步骤-取舍”结构答题。 🧪 **Tutorial/Lab**: 围绕“PCI DSS Discussion & Analysis A 'capstone' analysis of the Payment Card Industry Data Security Standard (PCI DSS). A contractually obligatory standard for any business storing, forwarding or processing in-house credit card data for Visa, Mastercard, and Amex.”完成课堂练习，并整理 1 页方法清单。 📌 **作业关联**: 与当周作业/项目里对应模块直接相关，建议本周完成第一版并留出测试时间。 ⚠️ **易错点**: 只背概念不结合场景，答案缺少可执行控制措施。 （数据来源：2000 UQ Course Profile (BISM3205)）

### 📖 核心知识点：Blockchain - Theory & Practice We analyse the blockchain application. Discussion of the blockchain as it underpins bitcoin (crypto-currency). We focus on its architecture, benefits, challenges, and how it implements hashing and cryptography. A business analysis of the variety of blockchain management paradigms that have emerged in business. 本周围绕 Blockchain - Theory & Practice We analyse the blockchain application. Discussion of the blockchain as it underpins bitcoin (crypto-currency). We focus on its architecture, benefits, challenges, and how it implements hashing and cryptography. A business analysis of the variety of blockchain management paradigms that have emerged in business. 的核心概念与应用场景展开，建议先把 lecture 中给出的定义、边界和示例理解透，再通过 tutorial/workshop 把知识点转化成可执行步骤。学习重点不是记住术语，而是能在案例里解释为什么使用这个方法、何时不该使用，以及与前后主题的连接关系。 - **核心概念/公式**: Blockchain - Theory & Practice We analyse the blockchain application. Discussion of the blockchain as it underpins bitcoin (crypto-currency). We focus on its architecture, benefits, challenges, and how it implements hashing and cryptography. A business analysis of the variety of blockchain management paradigms that have emerged in business., data modelling, SQL/Python, system design ⏰ **本周节奏**: 难度 ⭐⭐⭐ | 预计投入 9h（Lecture 2h + 自学 4h + 作业/Lab 3h） 🎯 **考试关联**: 常见题型是概念辨析 + 场景应用，建议用“定义-步骤-取舍”结构答题。 🧪 **Tutorial/Lab**: 围绕“Blockchain - Theory & Practice We analyse the blockchain application. Discussion of the blockchain as it underpins bitcoin (crypto-currency). We focus on its architecture, benefits, challenges, and how it implements hashing and cryptography. A business analysis of the variety of blockchain management paradigms that have emerged in business.”完成课堂练习，并整理 1 页方法清单。 📌 **作业关联**: 与当周作业/项目里对应模块直接相关，建议本周完成第一版并留出测试时间。 ⚠️ **易错点**: 只画高层架构，不说明组件职责、故障路径与取舍依据。 （数据来源：2000 UQ Course Profile (BISM3205)）

### 📖 核心知识点：Security Maintenance We focus on security auditing and security testing as part of managing and operating the ongoing security program. 本周围绕 Security Maintenance We focus on security auditing and security testing as part of managing and operating the ongoing security program. 的核心概念与应用场景展开，建议先把 lecture 中给出的定义、边界和示例理解透，再通过 tutorial/workshop 把知识点转化成可执行步骤。学习重点不是记住术语，而是能在案例里解释为什么使用这个方法、何时不该使用，以及与前后主题的连接关系。 - **核心概念/公式**: Security Maintenance We focus on security auditing and security testing as part of managing and operating the ongoing security program., data modelling, SQL/Python, system design ⏰ **本周节奏**: 难度 ⭐⭐⭐ | 预计投入 9h（Lecture 2h + 自学 4h + 作业/Lab 3h） 🎯 **考试关联**: 常见题型是概念辨析 + 场景应用，建议用“定义-步骤-取舍”结构答题。 🧪 **Tutorial/Lab**: 围绕“Security Maintenance We focus on security auditing and security testing as part of managing and operating the ongoing security program.”完成课堂练习，并整理 1 页方法清单。 📌 **作业关联**: 与当周作业/项目里对应模块直接相关，建议本周完成第一版并留出测试时间。 ⚠️ **易错点**: 只背概念不结合场景，答案缺少可执行控制措施。 （数据来源：2000 UQ Course Profile (BISM3205)）