Designing and Developing Products for the Cyber security

Coursework Brief

Designing and Developing Products for the Cyber security

Deliverables: Coursework 1

Coursework 1 is an individual report and will be submitted as a word document (up to 2500 words in total including all diagrams, documentation and description) via Turnitin on Moodle and must include all the required components.

Coursework 1 is worth 40% of the overall assignment. The marking criteria are outlined below.

Assignment Preparation Guidelines

1. All components of the assignment report must be word processed (hand written text or hand drawn diagrams are not acceptable), font size must be within the range of 12 point to 14 point including the headings, body text and any texts within diagrams.

2. Standard and commonly used fonts such as Times New Roman, Arial or Calibri should be used.

3. Your document must be aligned left or justified with line spacing of 1.5.

4. All figures, graphs and tables must be numbered and labelled.

5. You must provide screen shots of any commands used in your ethical/Hacking tests.

6. You have cited your work thoroughly by using Harvard referencing style.

7. Material from external sources must be properly referenced and cited within the text using the Harvard referencing system.

8. All components of the assignment (text, diagrams. Code etc.) must be submitted in one Word file.

Second Assessment: Examination – 60% (2 hours- unseen)

An end of course examination will be conducted in week 12 which follows delivery structure and exercises set in the workshops. Students will have access to sample formative feedback on tasks set in workshops and mock online tests thereby helping them to improve their understanding of topics covered in this module and to prepare them for this exam. This assignment will assess module learning outcomes 1,2 and 4. 

Overall, the assessments in this module fall into two categories i.e. coursework and examination with the following weightings:

Note: Pass mark in this unit: 40%

Coursework Brief  -Designing and Developing Products for the Cyber security 

Using the given scenario, students will demonstrate an in-depth understanding of information security governance outcomes with management directives and will provide guidance for Information Security Managers on how to develop an information security strategy within the organisation’s governance framework and how to drive that strategy through an information security program.

The Scenario-Individual Assessment – 40%

You have just been appointed as Security Manager in a multinational pharmaceutical company in West Midlands. You are responsible for physical, IT and information/data security. The company conducts research into medicines and vaccines for the treatment of HIV/AIDS, tuberculosis and malaria on behalf of the WHO. The organization applies information governance standard ISO27001 and implements a security strategy which is not imposed on everybody due to individual’s differing workload.

These are six departments within this company:

• Research and Development,

• Personnel,

• Marketing and Business Development,

• Strategic Operations and Management,

• Information Technology,

• Customer Services. 

Diagram 1: The Company’s internet

R&D is the one department with good security (biometric and card-based access control systems and running its own network which is isolated from the company`s network).  Since it is not connected to the rest of the intranet, R&D is not shown in the company`s network diagram above.

All offices are on the ground floor with servers (email, ftp, web servers etc) and document filling rooms and photocopiers in the basement which are easily accessible to all employees of their day to day duties. In each department, there are a number of workstations, network printers, USB based local printer/plotter/scanners, USB and network drives.

Contractors and visitors need to sign in before entering the premises which is by the entrance and then pick a blank pass in which they need to enter some of their detail (name) and wear at all times to move from department to department.

There is also a smoking area just outside the building, conveniently situated next to the staff car park which is open for visitors and contractors as well. The company’s Wi-Fi signals can be sensed by wireless devices in the smoking area.

Employees often go out of the premises for lunch. Some staff members have lunch at the riverside local Pub which is only 40 meters away from the complex and often carry their offices laptop with them that contain sensitive information. Some employees spend their lunchtime break listening to their iPods or simply surf the internet (some in their personal Laptops or mobile and some in their workstations).

The problem is that in the past there have been several incidents of information breach such as Man in the middle attack, DNS spoofing, Wifi password attack, Phishing, Evil twin attack, Denial of service attack (DoS), etc which led the Company to hire a Security Manager (yourself) to tighten security. These incidents took place across departments including R&D and went unnoticed and unpunished.

Task 1: [50%]

You need to assess the existing threats of the organization in line with the given scenario by carrying out ethical hacking/ penetration testing. You can use your selected security testing tools or other tools/techniques to identify the vulnerabilities, threats and risks which can be physical, IT infrastructure and information/data security within this organisation.

1. Critically evaluate the choice of your investigation tools and techniques using screenshots and appropriate description of each steps.

2. You should compile your list of threats (10 threats, sort them by importance) in order of importance and use a table such as the one below to provide extra information. You should include the countermeasures against each threat you have listed.

Table 1: Example as reference.

Note: For anything not mentioned, you are to assume that it is not present: e.g. secure locks, armed guards etc. You are free to make any assumptions you wish regarding your understanding of the various operations of the company, providing that you clearly state these in your report.

Task 2: [45%]

The current security strategy is not effectively managed and followed by employees and may result in further problems if not dealt with immediately.

Therefore, you will identify the importance of security policy and write an information security policy for management purposes.  It should identify suitable countermeasures and how these can be implemented, e.g. through awareness training, monitoring, feedback and reporting.

Presentation, Report Layout and References: [5%]                                                                          

You are required to use the appropriate report layout and formatting style (see the guidelines below) as well as academic citations and a reference list. Your report should be free from grammatical and spelling errors.

Marking Criteria – Coursework 1