1. Assess cyber security vulnerabilities and threats, including the insider threat, and critically evaluate the emerging threat landscape introduced by various technologies and in different business sectors.

This individual assignment contributes to the assessment of the following Intended Learning Outcomes of the unit:

1. Assess cyber security vulnerabilities and threats, including the insider threat, and critically evaluate the emerging threat landscape introduced by various technologies and in different business sectors.

2. Critically evaluate Log Management and Security Information and Event Management (SIEM) systems.

3. Critically evaluate, manage and handle cyber security events and incidents.

4. Construct and critically evaluate policies and methods for information sharing, incident handling and Computer Security Incident Response Team (CSIRT) operations.

Part 1. Cyber Kill Chain and Indicators of Compromise (1750 words approx.) The seminal work by Hutchins et al. has influenced the development of methodologies for defending against APTs. In this part of the coursework, you will need to map the phases of the cyber kill chain on a threat of your choice and study how SIEM could assist the mitigation processes. More specifically, the steps of your study and sections of the essay should include the following:

1. Introduction and description of a specific threat. Pick any threat and after introducing it, explain what the criticality and impact can potentially be for an organization, by showing how it would affect one or more of the security goals (confidentiality, integrity, availability). For this question you can consider threat intelligence methodologies or frameworks such as ENISA’s Emerging Threats Landscape, MITRE’s ATT&CK Framework etc.
2. Mapping of the selected threat to the cyber kill chain. With the use of specific examples, technologies and attack vectors from the literature, show how the threat could follow the cyber kill chain stages. Some generic examples are shown in Tables 2,3,4 of the kill chain paper
3. Describe how a SIEM solution could provide intelligence in the different phases in order to detect the attempted (or successful) breach or attack. In doing this you should consider and identify the relevant Indicators of Compromise (IoC), tools as well as any presentation or visualization alternatives to allow the analyst and system administrator to identify the security related events.