Key Information

The Assessment Calendar can be found under ‘Assessment & Feedback’ in the COMSC-   ORG-SCHOOL organisation on Learning Central. This is the single point of truth for (a) the hand out date and time, (b) the hand in date and time, and (c) the feedback return date for  all assessments.

Learning Outcomes

The learning outcomes for this assessment are as follows:

This individual assignment contributes to the assessment of the following Learning Outcomes (LO) 1, 2, 3, 4, 5 and 6 of the unit:

1. Compare and contrast common technical security controls available to prevent, detect and recover from security incidents and to mitigate risk. [T2]

2. Articulate security architectures relating to business needs and commercial product

development that can be realised using available tools, products, standards and protocols. [T1, T3]

3. Deliver systems assured to have met their security profile using accepted methods and development processes. [T2]

4. Critically analyse the correctness and properties of secure systems. [T1]

5. Justify the selection of different cryptosystems. [T2]

6. Critically analyse recent cyber security case studies. [T1, T2]

Submission Instructions

The coversheet can be found under ‘Assessment & Feedback’ in the COMSC-ORG- SCHOOL organisation on Learning Central.

All files should be submitted via Learning Central.  The submission page can be found under ‘Assessment & Feedback’ in the CMT310 module on Learning Central.  Your submission should consist of multiple files:

If you are unable to submit your work due to technical difficulties, please submit your work via e-mail to comsc-submissions@cardiff.ac.ukand notify the module leader.

Assessment Description

SCENARIO

There has been a major incident for the company ACME.LTD. Their main business is a mixture of manufacturing  and  distribution   management  for  other  organizations.  ACME.LTD   has  the following network infrastructure.

The following services are running within the network:

● Windows Active Directory

●    DHCP

● DNS Servers

● Mail Server (running SMTP & POP3)

● OpenVPN

● MsSQL Databases

● Multiple Samba Servers

● Web Servers

The ACME.LTD's databases were compromised via an internal web server. It was accessible via a lost laptop. The lost laptop only required a username and password to access it. However, the password was at least 16 characters long, SecureBoot and full disk encryption were not in use. All workstations and laptops in use are not part of the Windows Active Directory domain. This means all accounts used are local accounts.

Additionally, the attackers were able to use the access to the MsSQL services to pivot to the companies OT network and deploy ransomware. This resulted in the complete shutdown of the operations that relied upon the OT systems that had been Windows-based.

INSTRUCTIONS

This individual assessment consists of THREE tasks as  mentioned  below.  Please  carefully consider completing all tasks and prepare your final report. You are expected to submit this report on Learning Central which requires coursework submission as a single report of 2,000 words (maximum, including all except references). There should not be any appendix attached or included in this report. The expected font size is 12 and the font type is ‘Arial’ on all pages. There is no need to add a cover page with your submission but write your student number and name on the top of the first page of the report. You’re expected to back your answers with citations. Note, there is no ±10% word count criteria for this coursework. It is expected that your report (excluding references) must be within the 2,000 words count. Anything written beyond the first 2,000 words would be ignored during marking. Indicative word count against each task is mentioned. However, this is not a strict limit for each task, rather this should be used as a baseline for the expected amount of text/explanation against the maximum marks assigned for each task.

Task 1 [T1]: The CEO and CISO of ACME.TLD would like you to review their network architecture as previously presented and identify security issues, potential risks, and insecure properties.

[Indicative word count: 500]

Task 2 [T2]: Provide  recommendations with evidence of the  best  practices and applicable approaches to secure their network. Also, provide reflect on (i) what could be easily prevented and how, (ii) if not prevented, what could be detected and how, and (iii) if not prevented and detected, what could be recovered from security incidents and how. [Indicative word count: 1,000]

Task 3 [T3]: The CEO and CISO are keen to also know what additional technology and tooling could also be used to help future proof the system and justify your choices. [Indicative word count: 500]

References

References are not counted in the word limit. Use the IEEE format references: https://ieee- dataport.org/sites/default/files/analysis/27/IEEE%20Citation%20Guidelines.pdf.

This point will be further discussed in one of the lectures of the module.

and-referencing/citing-and-referencing-support

HELPING NOTES

• Vulnerability: A weakness in any aspect of a system that makes an exploit possible.

• Threat: A potential cause of an unwanted incident that may result in harm to a system.

• Attack: An attempt to destroy, expose, alter, disable, steal or gain unauthorized access to or make unauthorized use of an asset.

• Risk: An intersection of assets, threats and vulnerabilities.

• System or system model: A system that attackers target for attacks.

• Network  Architecture: It  is  defined  as the physical and logical  design  of the software, hardware, protocols, and media of the transmission of data.

• Security Architecture: The  NCSC  define security architecture  as    ‘The    practice of designing computer systems to achieve security goals. ’ These security goals are to make initial  compromise  of  the  system  difficult,  limit  the  impact of  any  compromise, make disruption of the system difficult, and  make  detection  of  a compromise easy. Security architecture must consider all the technology, people and processes relating to a computer system.

• Best  Practices: These are a standard or set of guidelines that is known to produce good outcomes if followed.

• Useful  article for  help: How to Prevent, Detect, and Respond to Cybersecurity Incidents, https://www.eidebailly.com/insights/articles/2020/5/how-to-prevent-detect-and-respond-   to-cybersecurity-incidents

Assessment Criteria

Task 1 Reviewing network architecture (Available Marks - 15)

Task 2 Provide recommendations and approaches (Available Marks - 20)

Task 3 Additional technology and tooling (Available Marks - 15)