The final projects would be graded entirely by your instructor. You can pick either experimental or theoretical work as your final projects. I highly encourage you to form a group of 2 or 3 for your group project; however, it is fine to work alone as well. The final grade would be for the entire group and hence the same mark would be given to every group member. The idea behind having a group project is to put your knowledge of the subject to some real use and
To perform Internet-based journalism-style information gathering and reporting,
To improve you presentation skills,
To practice teamwork and critical-thinking skills, and 
To consolidate your knowledge about a current topic of information security.
Arrange a meeting with me the week before your first draft is due if you need ideas for project. Some venues where you can find project ideas are as follows:
https://intellipaat.com/blog/cyber-security-project-ideas/Links to an external site.
http://www.infosecurity-magazine.com/ Links to an external site.
http://securityintelligence.com/ Links to an external site.
http://www.darkreading.com/ Links to an external site.
http://www.securityweek.com/ Links to an external site.
http://www.theregister.co.uk/security Links to an external site.
http://www.technewsworld.com/perl/section/cyber-security Links to an external site.
http://www.informationsecuritybuzz.com/ Links to an external site.
http://www.homelandsecuritynewswire.com/topics/cybersecurity Links to an external site.
http://www.infosecnews.org/ Links to an external site.
http://www.infosecurity-magazine.com/ Links to an external site.
http://www.inforisktoday.eu/ Links to an external site.
http://threatpost.com/ Links to an external site.
http://www.trendmicro.com/vinfo/us/security/news/ Links to an external site.
http://www.wired.com/security/Links to an external site.
This is by no means an exhaustive list. You can also implement some real world crypto systems, blockchain to see how bitcoin mining works, etc. Feel free to consult me. In general, it would be a good idea to reach out to me if you have any questions regarding your project.
As the final project, submit a pdf file for your group project with 11 points font and 1 inch spacing all around. If your work is experiment based, ensure to submit a working code and a read me file to verify the correctness of your results. This experiment work can be an implementation of an earlier paper, but it should not be plagiarized, i.e., no copying of the codebase of the authors of the work you are implementing or testing. There is a reason behind it. There is a NeurIPS 2019 paper that showed that many of the experimental results could not be duplicated, so you should never blindly trust previous works, even though peer-reviewed. One thing we would continuously try to do is to question validity of every claim we make. Theoretical work can be a survey of some of the recent work (even one) related to the wide topic of security and privacy. Again ensure that you understand the paper(s) you are including in your survey and are able to reproduce it as your own. Your paper should be a summary of past and current work on your topic, and though not required, it might be beneficial for you to give an overview of known open problems and potential future directions in the area.
Some venues where you can papers for your projects are NeurIPS, ICML, COLT, CRYPTO, EUROCRYPT, USENIX Security, ACM CCS, IEEE Symposium on Security and Privacy, and the NDSS Symposium.