What this assignment does
The report designs a normalised relational database for a private outpatient clinic holding sensitive health records, builds a STRIDE threat model against it, and specifies layered controls — network isolation, authentication, role-based access control, row-level security, column encryption and auditing.
What distinguishes it is that UK GDPR principles are implemented in the schema rather than described alongside it: data minimisation in the billing view, storage limitation through scheduled retention jobs, accountability through the audit trail.
How it is built
Introduction, literature, design, threat assessment, controls, critical evaluation. The threat model sits between the design and the controls so that every control can be traced to a specific threat it answers.
Threats are rated by likelihood and impact on a three-point scale and tabulated with their mitigations, so the control set is justified by a risk score rather than by convention.
Annotated extracts
Three passages, each with a note on why it earns marks and what a weaker answer does in the same place — enough to teach the move, not enough to stand in for the assignment.
Denormalisation was rejected for the billing view: although a materialised view would be faster, it would create a second copy of personal data that must itself be secured, retained and erased. In a system dominated by privacy requirements, avoiding duplicate copies of sensitive data is itself a security control.
Why this marks well
This is the best paragraph in the report. A standard performance optimisation is considered, and rejected, on grounds that come from outside performance entirely.
The reasoning is precise about why the copy is costly: it must be secured, retained and erased — three separate obligations, each one a place the design could fail. A generic appeal to “privacy concerns” would not have earned the same credit.
The closing sentence reframes a schema decision as a security control, which is the conceptual move the whole module is about. Students who treat security as a layer added after the data model has been fixed cannot write this paragraph.
What a weaker answer does here
A weaker answer normalises to third normal form because that is what the lecture said, and never considers denormalisation at all. The schema is correct and the reader cannot tell whether the student understood the trade-off or simply avoided it.
A threat model was developed using the STRIDE categories to identify how the system could be attacked or misused. Table 1 summarises the highest-priority threats, rated by likelihood and impact on a three-point scale, together with the controls that address them. SQL injection — search box concatenates input into query — likelihood 3, impact 3, risk 9 — parameterised queries, least-privilege application role, web application firewall.
Why this marks well
The threat model is scored, so the control set has a defensible priority order rather than being a list of good practices.
Each threat is tied to a concrete mechanism in this system — the search box concatenating input — not to the abstract category. STRIDE is being used as a discovery tool against a specific design, which is what it is for.
Note that the insider threat is included alongside SQL injection. Clinical systems are far more often misused by authorised users browsing records they have no business reason to see, and a threat model that only considers external attackers would miss the likeliest harm.
What a weaker answer does here
A weaker answer lists the six STRIDE categories with a textbook definition of each. The framework is demonstrated and never applied, so no control in the report is justified by it.
Audit logging generates large volumes of data, and logs that nobody reviews offer little practical protection; the clinic needs a clear process and staff time for monitoring, which is an organisational rather than a technical control.
Why this marks well
The report identifies the point where its own technical design stops working, and the reason is organisational rather than technical. An unmonitored audit log is a control on paper only.
That distinction — technical control versus organisational control — is the one security students most often miss, because the coursework rewards the technical half. Naming the staff time required is what makes the recommendation implementable rather than aspirational.
It sits within a wider honest evaluation: column encryption degrades query performance, row-level security slows as data grows. The design is defended and its costs are stated.
What a weaker answer does here
A weaker answer concludes that the system is secure because it implements defence in depth. The phrase is correct, the claim is unfalsifiable, and nothing has been said about what the design costs or where it depends on people.
What makes this a strong answer
It lets a non-performance consideration overturn a performance decision, and explains the reasoning well enough that the reader could apply it elsewhere.
The threat model is scored and specific to this system, so the control set has a defensible priority.
It distinguishes technical controls from organisational ones and admits that the second kind is outside the schema's power.
Request the full document
Request the full document
The extracts above are the teaching material and they stay on this page. The complete 2,050-word document is sent person to person, by a human, after a short conversation about what you are working on — so that we can point you at the right parts of it rather than hand over a file and wish you luck.
Both links below already name this sample (DSC-01), so you do not have to describe it.
WhatsApp · +44 7537 126 976 · Email · mia@globalprojectshelp.com
Mon–Sat, 9–22 GMT. No form, no mailing list, no download gate.
Full documents are never published, hosted or linked on this site.
Using this sample honestly
This is a worked example. It sits in the same place as a worked example in a textbook or a past paper with an examiner’s report attached: read it, take the move, then write your own paragraph without it open in another window.
Submitting any part of this document as your own work would be plagiarism — the same offence as copying from a journal article, and detected the same way. If you draw on it, cite it. If a deadline has got to the point where submitting someone else’s paragraph feels like an option, say so when you message us; that is a problem with a legitimate answer and we would rather work on it than watch it happen.
Our full position, including how to declare mentoring support to your institution, is on the academic integrity policy page.
Where to go next
- More MSc Data Science samples The full set of annotated model answers for this course.
- All samples Every annotated model answer in the library, with discipline filters.
- How requesting works What you receive, what you do not, and the conditions attached.
- Academic integrity policy What we do, what we will not do, and how to declare mentoring support.
Model answer written by a Global Projects Help mentor · © Global Projects Help
Published 8 October 2026 · Questions? mia@globalprojectshelp.com