Reference no: EM133003707
SIT284 Cybersecurity Management Assessment
Assessment 1: Case investigation report This is an individual assessment task and worth 30% (numerically marked) of your overall mark. This assessment requires you to conduct an investigation of serious security management issues in corporate organizations and prepare a report based on the findings of your investigation. Analysing real-life cybersecurity incidents provides you with crucial insights regarding cybersecurity posture of an organization and a thorough understanding of details related to the cybersecurity incidents before, during and after the incidents.
Learning Outcome 1: Assess security risks, threats and vulnerabilities to the organization and implement appropriate information security protection mechanisms.
Learning Outcome 2: Conduct investigation of security management issues in organization by analysing requirements, plans and IT security policies.
Brief description of assessment task
In this assignment, you will prepare a case investigations report for the board of a Marriott International.
Marriott International, the popular hotel chain, experienced a new data breach in mid- January 2020, affecting up to 5.2 million guest records globally. This is the second data breach Marriott has experienced in 16 months. There is quite a bit written about the latest Marriott data breach.
Your task is to critically and thoroughly analyse and synthesis the Marriott International 2020 data breach and write a case investigation report of approximately 2000 words along with a list of bibliography to support your findings.
Focus on the following:
• The analysis of the data breach.
• Analysis of cybersecurity governance and planning as related to the data breach.
• Analysis of data breach laws.
You can use the following to structure your report:
1. Introduction
2. Analysis of the breach
3. Analysis of cybersecurity governance and planning
4. Analysis of GDPR compliance
5. Conclusion
Please be sure to write in as much detail as is needed to respond in a way that clearly responds to the question at hand, while clarifying and elaborating with examples and details, where possible.
This assessment requires to gather and piece together data sourced from different sources and take an educated guess as to what may have transpired leading up to the loss of over 5 million guest records. It is suggested that you start working on this assessment by following:
• Start collecting and researching information.
• Think creatively.
• Write your report.
• Look at the assessment rubric and the unit learning outcomes to ensure that you understand what you are being assessed (and marked) on.
Q2.1: What is an attack vector and how do I identify them?
Q2.2: How do investigators figure out who might have hacked Marriott?
Q2.3 How do the threat actors identify and exploited the attack vector?
Q2.4: How to identify possible security flaws that allowed the threat actor(s) to get access to the system.
Q2.5 What should I look at for ‘how the breach was discovered and contained'?
Q2.6: How to determine the methods used by the threat actors to compromise login credentials and gain access to the system?
Q2.7: What should I consider regarding the security controls that may have failed?
3 Analysis of cybersecurity governance and planning
Q3.1: What does ‘focus on cybersecurity governance that directly impact planning for data breach' mean?
Q 3.2: What does ‘describe ways on how cybersecurity governance could have averted the Marriott data breach' mean.
Q 3.3: Ways that cybersecurity strategic plan can help organizations
Q 3.4: What are some of strategic options for improving cybersecurity governance.
4 Analysis of data breach related laws.
Q 4.1: Why does Marriott has an obligation to GDPR?
Q 4.2: What does an "eligible data breach" and data breach notification duties mean?
Q 4.3: What does a "notification timeline" to a supervisory authorities and communication to data subjects mean?
Q4.4: What do we know about Marriott's response to the data breach?
Q 4.5: What are GDPR notification rules regarding data breach notice to data subjects?
Q 4.6: How did Marriot communicate with the data subjects (guests)?
Q 4.7: Did Marriott provide guests how to get further information if they need to?
Q 4.8: What measures did Marriott take?
Q4.9: What does critical response factors (i.e., notification promptness, suitability, and quality) mean?
Q4.10: What is the risk of hackers using the victims' data for fraudulent purposes?
Q4.11: How Marriott's response minimizes the data breach impact
5 Word limits, references, and quotes
Q1: Is the limit of 2000 words absolute?
Q2: Which referencing, and citation style should I use?
Q3: Does the word limit apply to references?
Q4: What does ‘excessive use of quotes' mean?
6 General question
Q6.1: How do you give credence to the assertion you make.
Q6.2: What does ‘verifiable' claim mean?
Q6.3: What should the answer to ‘Lessons learnt and recommendation' cover?
Q6.4: Should we consider other compliance laws such as the Australian Data breach notification law?
7 Word limits, references, and quotes
Q7.1: Is the limit of 2000 words absolute?
Q7.2: Which referencing, and citation style should I use?
Q7.3: Does the word limit apply to references?
Q7.4: What does ‘excessive use of quotes' mean?
Attachment:- Cybersecurity Management.rar