Reference no: EM133709740

Task instructions

Project
Assignment
Portfolio
Case study

Summary and Purpose of Assessment
This project has been designed for you to demonstrate your skills in the following areas:
Section-1
identify threats to security
develop risk management plan
design network security policies
Create a risk management plan
Determine attacker scenarios and threats
Develop security policies
Section-2
analyse and plan solutions to compromised networks and design incident response
evaluate security information and use it to plan suitable control methods and countermeasures
add network controls, according to system security policies, procedures and risk management plan.
Design auditing and incident response procedure
Implement configurations aligned with incident response procedure design

Assessment Instructions
This is an individual based project to be completed inside the class room. This assessment includes practical task and written questions. You will be required to answer a series of tasks designed to demonstrate your understanding in the skills listed above.

What
You need to answer all the tasks below. Information and resources will be provided to you via Blackboard or in this document.

Background
You are the IT administrator at a high school Melbourne Central High School.

You have been tasked with analysing the admin department, with a view to strengthening security. This department was selected for a few reasons:
They deal with a lot of sensitive information
It's a small department

Your analysis will involve the Identification of habits within the school.

If these changes work well, then they can be implemented across the rest of the school.

Section 1: Analysis and Education
As part of your role as an IT administrator, you take the opportunity to observe the existing behaviours that exist within the admin team in order to instil better security habits.

Task 1: Attacker scenarios & threats
A security breach recently occurred at Melbourne Central High School. Luckily all incoming phone calls to the school for security purposes. One such phone call was captured between Joe, one of MCHS's admin staff, and phone call with the ID "Microsoft".

The transcript of the call has been provided:

Joe: Hello.
Unknown caller: Hi, my name is Peter from Microsoft and we have detected an issue with your computer. Would you mind checking something for me?

Joe: Sure, what should I check?

Peter: Can you please open the event viewer

***Peter takes Joe through the steps to open the Event Viewer***
Peter: Can you see any alerts?

Joe: Yes.

Peter: Ok, it seems as though your computer has a virus running and is harming your computer files. Can you please open your browser and go to www.remotefix.com.

Joe: Ok.

Peter: Please download the program on the homepage and install it onto your computer.

Joe downloads, installs and opens the program.

Peter: Can you please put the following settings into the program so I can remote in and fix the problem.

Joe places the settings as advised by Peter and provides him with remote access to the computer.

Luckily the damage caused was minimal, but rather than punishing Joe, you use this as a teaching opportunity.

Advise Joe what type of attack has occurred?
Advise Joe what red flags should Joe have noticed during this call and why? (List 3, 5-15 words per response)

Task 2. Create Security policy to combat this breach
To assist in combating this type of breach, you believe a clear security policy needs to be provided to admin staff advising them they cannot engage with any phone calls relating to IT issues.

All IT related calls, whether they are deemed to be legitimate or not, need to be escalated to the IT team. If the IT team isn't available, then a message can be taken and passed on to the IT team via email.

Your policy must contain the following:

Overview (5 - 15 words):
Scope (Dot Point):
Standards (20 - 40 words):
Guidelines (40 - 75 words):
Procedures (Minimum of 4 clear steps):
Issues (10 - 20 words):
Non-Compliance (10 - 20 words):

Task 2a: Seek feedback on Security Policy
Exchange your completed security policy from Section 1: Task 2 with another student who will take on the role of another member of the school's IT team.

Populate the table below on behalf of the student you have exchanged
Student providing feedback:

Feedback
Positive aspect of the policy
Areas of the policy that need improvement

Task 2b: Respond to Feedback
Create a copy of your original policy and save it as a second document called: <Student Name> Security Policy Updated.docx

Amend the areas of the policy outlined in the feedback provided by the other IT member in this new document. Highlight these changes in yellow.

Ensure you submit both the original and your amended document.

Section 2: Reviewing the Network
You have been tasked with reviewing the existing security setup in place. This will be done in 3 parts:
Creating a risk management plan
Creating an incident response plan
Using the newly created incident response and risk management Plan and in conjunction with a Security Policy relating to password enforcement to verify your network is operating according to these documents.

Required settings for each device have been provided to you. These settings can be download from Blackboard. The file is called: AT3 - MCHS Networking Settings.docx

Task 1. Risk Management Plan
You have been asked to create a Risk Management plan for the admin computers at Melbourne Central High School.

A topology has been provided to you: AT3 - Project Topology.pkt, to assist you in auditing the system.

The computer rooms house the following equipment:
1 X server containing
a database with student information
a website
domain Controller hosting multiple user accounts for the school.
File server housing all staff files
Student files are housed off campus
7 School owned desktop computers:
Admin Staff log in to a roaming profile account.
4 Enterprise grade switches
1 Enterprise grade router.

The following groups have access to this equipment:
IT Staff
Principal
Admin Staff

Your risk management plan must include the following:

List of the school's assets, their importance (High/Med/Low), and reasoning for their importance level (25 words).
Identification of critical data and why it is crucial to the school: (20-40 words)
Identification of responsibilities for each staff group should an attack occur (10-25 words per role)
Countermeasures can be put in place to prevent an attack from occurring? (list 2, 10-25 words per countermeasure)
When the plan will be reviewed (dot point)

Task 2. Incident Response Plan

You have been asked to create an incident response procedure that can be enacted in the event of a security breach.

Your Incident response plan must have the following:
A checklist for every networking device (including the server) to verify correct settings applied including:
Services
Ports
IP addresses (if applicable)
Passwords
Communication methods
Review timeline

Use the file AT3 - MCHS Networking Settings.docx (Appendix-A) to aid you in completing the checklist.

Task 3: Analyse and apply security to existing network
Now that you have created your Incident response plan for MCHS, you have been asked to evaluate the existing network to ensure that it complies with the requirements outlined in the following:
Your created Risk management plan in Task 1
Your created Incident Response Plan in Task 2
Security policy

The Security Policy can be found on Blackboard in a file called: AT3 - Password Policy.docx (Appendix-B)

You can download the network from Blackboard. The file is called: AT3 - Project Topology.pka

T3a: Analysis of existing security
Identify the security controls that has been applied to the networking devices in the provided Packet Tracer file as per the requirements outlined in the Security Policy, Risk Management Plan and Incident Response Plan.
List the security controls that currently exist on the devices in the table below:

Device Existing Security Controls
MCHSRouter
MCHSSW1
MCHSSW2
MCHSSW3
MCHSSW4

T3b: Implement missing network controls as per security documents

Now that you have audited the network, you have been asked to apply the remaining network controls to the devices on the Packet Tracer file as per the security policy, risk management and incident response documents.

Please write down the Network controls you have added in the table below:

Device Added Network Controls
MCHSRouter
MCHSSW1
MCHSSW2
MCHSSW3
MCHSSW4

Where
You will be undertaking this assessment in scheduled class time and cannot be completed outside class time.

How
This is an individual assessment. You will be assessed against the criteria listed in the marking guide in Section B of this task. To achieve a satisfactory result, you will need to address all criteria satisfactorily.

Instructions on submitting the Assessment Evidence:
You must submit a file containing the assessment work on Blackboard.
Upload your zip file containing the Assessment. Append zip file title with your name & Student ID.
The naming convention of the zip file is: <Student Number>_<Student Full Name>_Project2.zip

Additional Instructions:
Attempt ALL the questions/tasks in each practical test.
Performance requirement for each Practical test: