Reference no: EM132358194

Install and Maintain Valid Authentication Processes Assignment 1 -

Assessment Task 1: Determine and configure secure authentication process

Outcomes Assessed - Performance Criteria: Addresses some elements of performance evidence and knowledge evidence as shown in the Assessment Matrix.

Description: Authentication is the process of determining whether someone or something is, in fact, who or what it declares itself to be. Authentication technology provides access control for systems by checking to see if a user's credentials match the credentials in a database of authorized users or in a data authentication server.

Case Scenario: For more than 70 years, Weltman, Weinberg & Reis (WWR) has been a leader in providing collection services and legal representation to creditors. Headquartered in Sydney, Australia, WWR is the largest creditor's rights law firm in the country. The company depends on its network to connect 1000 employees at nine offices, and to provide real-time status information on cases and files.

Protecting the sensitive client information that resides on its network is a top priority for WWR. Much of the firm's application data contains confidential or non-public information (NPI). Along with privacy concerns, maintaining data integrity is also important, because customer contact records and other business information is often used in legal proceedings. Records that have become corrupted or inaccurate because of a security or network issue can result in a total breakdown of the process and a significant loss to the firm.

WWR has recently acquired a Windows Server 2016 with appropriate hardware as per Microsoft recommendations. They have approached you to determine and configure secure authentication process.

For this task you will be required to:

Sub-Task 1: Prepare report covering below information.

• Investigate and compare at least 2 different authentication methods which satisfies the user and company requirements such as confidentiality, integrity and availability (CIA).
• Select the most appropriate authentication method out of the previously compared methods. Justify your selection based on the user and company data and network security requirements. Also, provide information of any hardware components that the selected authentication method may require.

Sub-Task 2: Provide network topology.

The network topology must include following criteria:

• 1 Head-office in Sydney, Australia and Only 2 branches.
• Centralised authentication server at Sydney HO; 2 x Site-to-site VPNs.
• Servers, computers routers, switches, firewalls and other networking devices.

You can also make assumption for any unspecified network or device requirements.

Sub-Task 3: This is a practical task in which you will be required to install and configure a Windows Server 2016 on provided hardware or in virtual environment. Any virtualisation software can be used for this purpose. You have to select and use appropriate cabling to connect the server to the switch which connects the networked (LAN) computers. You will be provided with WAN/Internet link and workstations.

Install Windows Server.

• Configure appropriate name for server.
• Select appropriate IPv4 network address range (IPv4) for the network.
• Configure static IPv4 address on the server.

Install and configure secured authentication process.

• Configure the authentication method/software/tools as selected in Sub-Task 1.
• Configure test users and groups.
• Describe and configure test users and group authorisation (different permissions for different users/groups) towards different resources i.e. files, folders, services etc.
• Apply configured authorisation and authentication filter on the server and resources.

Assessment Criteria - The following assessment criteria will be used for marking this assessment task. Ensure that you have addressed all of the criteria in your work;

Sub-Task 1:

• Researched, compiled and organised information about at least 2 authentication methods.
• Evaluation of the company's services and needs to implement an authentication solution.
• Appropriate authentication method selected, and selection criteria are according to case scenario.
• Selected hardware is as per case scenario.

Sub-Task 2:

• Network Diagram or topology provided as per specified criteria.

Sub-Task 3:

• Prepared for work in line with site-specific safety requirements and enterprise occupational health and safety (OHS) processes and procedures.
• Identified safety hazards and implement risk control measures in consultation with the trainer.
• Consulted the trainer to ensure the task is coordinated effectively with others involved at the worksite.
• Physical machine or Virtual environment installed and configured for Windows Server.
• Windows Server installed and configured.
• Selected authentication process installed and configured.
• Presented the research and installation summary to the class.
• The presentation was well structured, cohesive and maintained a consistent flow of information.

Assessment Task 2: Apply and monitor authentication system

Outcomes Assessed - Performance Criteria: Addresses some elements of performance evidence and knowledge evidence as shown in the Assessment Matrix.

Description: Sub-Task 1: In continuation of previous assessment task, students need to apply and monitor the authentication in this task.

• Make sure the authentication protocol has been configured on the server.
• Join networked computers and other devices to apply authentication system to control user access.
• Record and store authentication and authorisation configuration information on the server securely.
• Test the authentication system with test users and groups.
• Review the test results and adjust the authentication system if required.
• Create or maintain the authentication system security log. Set up alarms, warnings and required actions for incident management and reporting processes according to the case scenario requirements.

Sub-Task 2:

• Create a user manual to brief users on authentication system and their responsibilities according to enterprise security plan (that they should not share their password and credentials, do not leave logged on computer unattended, etc.).

Assessment Criteria - The following assessment criteria will be used for marking this assessment task. Ensure that you have addressed all of the criteria in your work.

Sub-Task 1: Task observed by the trainer/assessor;

• Authentication protocol/s configured and applied on network devices.
• Authentication and authorisation configuration recorded and stored securely on the server.
• Tested the authentication system with test users ang groups, evaluated results and made adjustment to the system if required.
• Created or maintained the authentication system security log.

Sub-Task 2:

• User manual on authentication system created.
• User responsibilities described according to enterprise security plan.

Assessment Task 3: Research and Report

Outcomes Assessed - Performance Criteria: Knowledge Evidence Addresses some elements of performance evidence and knowledge evidence as shown in the Assessment Matrix.

Description: This is a summative task. Here you will apply your research abilities and the knowledge you acquired during the course of the unit. In this task, you are required to prepare a word-processed report which explain given topics. Research and report on the following:

Explain common virtual private network (VPN) issues, including:

• Quality of service (QoS) considerations.
• Bandwidth.
• Dynamic security environment.
• Function and operation of VPN concepts

Summarise the features of common password protocols, such as:

• Challenge handshake authentication protocol (CHAP).
• Challenge phrases.
• Password authentication protocol (PAP).
• Remote authentication dial-in user service (RADIUS) authentication.

Describe the principles of security tokens.

Outline authentication adaptors.

Summarise biometric authentication adaptors.

Summarise digital certificates, such as VeriSign, X.509, and SSL.

Explain the function and operation of authentication controls including:

• Passwords
• Personal identification numbers (PINs)
• Smart cards
• Biometric devices

Assessment Criteria - The following assessment criteria will be used for marking this assessment task. Ensure that you have addressed all of the criteria in your work.

• The report is appropriately structured and presented as a formal document reflecting a real-life practice.
• Appropriate headings and sub-headings are used to structure the contents.
• The scope of the report demonstrates the required extent to gather and summarise information along with appropriate references.
• Explained common virtual private network (VPN) issues.
• Described features of common password protocols.
• Described the principles of security tokens.
• Explained authentication adaptors.
• Explained biometric authentication adaptors.
• Described digital certificates, such as VeriSign, X.509, and SSL.
• Explained the function and operation of authentication controls.

Minimise Risk of New Technologies to Business Solutions Assignment 2 -

Assessment Task 1: Risk Evaluation Report

Outcomes Assessed - Performance Criteria: Addresses some elements of performance evidence and knowledge evidence as shown in the Assessment Matrix.

Description: This is scenario based individual assessment task. In this task, you will develop a risk evaluation report in which you will be required to articulate the requirements of a new and proposed network and come up with risk mitigation strategies as the solution. The report should consist of all the assumptions and estimations for the project.

This task is being given with an aim to develop an understanding of the skills required to evaluate the core network requirements and infrastructure capability and based on the requirements prepare a risk strategic plan and scoping document and subsequently discuss the risk mitigation strategies associated with the plan. For the purpose of simulation, your trainer/assessor will play the role of a senior manager and/or client. Ensure that you seek inputs and maintain consultation with your trainer/assessor as you undertake this task.

Scenario - Fitters Snackers Company is a company that manufacture Health Bars. They have 2 locations for their company, the head office is situated in Melbourne and the production site is situated in Perth. They both are connected to each other via the ISP through a WAN link.

The company plans to implement a 100% growth in the next 3 years. The company would like to support up to 1000 employees in near future (of both the branches) and currently have infrastructure which consists of switches and routers, servers and other network equipment to support existing 500 employees. They would also like to build redundancy into the network as to help with security. The servers are situated in the head office and requires continues access by both the departments. Fitters Snackers would also want to make their both branches have wireless internet to all the employees in the near future. Currently, they all rely on the normal dialup internet and would spend considerable amounts to make it happen.

Task -

The company would like you to evaluate available capacity, capability and parameters of current core infrastructure and come with a strategic risk evaluation plan and scoping document that will take into considerations the practical limitations and other estimations when estimating the growth of this project.

You are required to research how much more resources will be needed to support the existing infrastructure to sufficiently support future growth and what are the security and risk aspects that will hinder the progress of this project and highlight all the risks. Also discuss how user/employees of the organisation will be impacted from the proposed changes; as well as any foreseen changes in company's business processes.

Assessment Criteria - The following assessment criteria will be used for marking this assessment task. Ensure that you have addressed all of the criteria in your work;

• The report is appropriately structured and presented as a formal document reflecting a real-life practice
• Appropriate headings and sub-headings are used to structure the contents
• The content flow covers all the required elements of the analysis and contains a logical sequence of the topics
• The plan contains an executive summary that provides a synopsis of the plan
• Project scope is included and explained
• Provided analysis and evaluation of the current core infrastructure
• Identified potential risks to the business and determined risk level
• Identified and described appropriate risk mitigation techniques and explained each technique integrated into the infrastructure
• Discussed the impact of perceived changes from organizational change perspective and how it will impact the employees
• Supporting documentations estimating the costs and the risk the company would have to undertake for the new infrastructure are included

Assessment Task 2: Develop a Risk Management Plan

Outcomes Assessed - Performance Criteria: Addresses some elements of performance evidence and knowledge evidence as shown in the Assessment Matrix.

Description: This assessment task is continuation of Assessment Task1 and provides implementation aspect of the documents created in Assessment Task1.

This task should be completed in conjunction with the relevant learning and practice sessions in the class to familiarise themselves with risk management approaches and review sample risk management plans. Students must maintain adequate attendance in the sessions and complete the assessments as scheduled in presence of the trainer/assessor.

For the purpose of simulation, your trainer/assessor will play the role of a senior manager and/or client. Ensure that your seek inputs and maintain consultation with your trainer/assessor as you undertake this task.

Scenario: Refer to the scenario provided in Assessment Task 1.

Task: The board has asked for a comprehensive risk management plan to be prepared for the company as the basis for developing business strategies. Prepare a detailed risk management plan for the company including risk analysis, audit and monitoring procedures. The plan should follow recognised content and structure standards for risk management plans.

You plan must include;

• Executive Summary
• Objectives of the Plan
• Situation Analysis (Background and reasoning)
• Risk Analysis
• Risk Assessment
• Risk Management Strategies and Actions
• Contingency and recovery plan
• Resource Requirements
• Copyright or intellectual property issues
• Monitoring and Controls

There is no word limit for the plan but it is expected that the plan is no longer than ten single sided A4 pages. Parts of this unit also require you to demonstrate your technical skills. Demonstration of these skills will be best achieved with participation in in-class activities, and consideration of technical assessment tasks in other units of competency.

As part of the in-class activities, demonstrate to your trainer that you are able to;

• Interpret organisational documents (e.g. Need Analysis, Security Policy etc.).
• Identify and administer simple network tasks (transfer of files, software installation, back up etc.).
• Understand the concept of financial risks and use of cost-benefit analysis.
• Communicate with your group members and discuss your ideas and plans in the class room or group environment.

These skills will be assessed through observation by your trainer/assessor over the duration of this unit. Work completed in other units within the course may also be taken into consideration.

Assessment Criteria - The following assessment criteria will be used for marking this assessment task. Ensure that you have addressed all of the criteria in your work;

• The plan follows recognised standards for content and structure
• Appropriate headings and sub-headings are used to structure the contents
• The content flow covers all the required elements of the analysis and contains a logical sequence of the topics
• Key aspects of the plan are summarised in the Executive Summary
• Plan objectives are developed and articulated
• Analysed the perceived risk and summarised the data developed in Part A
• Developed a risk assessment based on a business risk management approach and assessed the risk levels using a risk assessment matrix
• Suggested strategies to mitigate the risks
• Identified the required resources
• Identified and described copyright and intellectual property issues
• Described plan monitoring and controls mechanisms
• Provided a brief contingency and recovery plan based on perceived risk impacts
• The document content and presentation are suitable for submission to the board
• Demonstrated a range of technical, analytical and literacy skills during classroom activities and/or other relevant units

Assessment Task 3: Case Study Analysis

Outcomes Assessed - Performance Criteria: Addresses some elements of performance evidence and knowledge evidence as shown in the Assessment Matrix.

Description: Read the following case study and answer the questions.

Case: The administration of St Andrew's University has noticed that an increasing number of Students are failing units taken in the later semesters of their degree. Although the University has developed a system to ensure that students are not allowed to study a unit unless they have passed the pre-requisite units, it is thought that students who achieve a Result of less than 55% in a pre-requisite unit might not be adequately prepared to undertake the dependent unit.

Hence the University has contacted ABC Consulting to develop a System that helps to address this problem. Specifically, St Andrew's University would like to have a system that, given the student enrolments for a unit of study of a given semester, allows a unit convener to check which students have achieved satisfactory results in the pre-requisite units. This information will then help the convener to identify those students that failed to achieve the threshold score(s) and then assist the students to plan their studies, including revision of the pre-requisite unit.

For a given unit, and for each pre-requisite unit, the convener should be able to set a Threshold mark to be used in identifying the students at risk. As an example, unit PBC301 "Advanced Programming" might have pre-equisites PBC234 "Data Structures and Algorithms" and PBC286 "Functional Programming". The convener of PBC301 should be Able to specify selection of enrolled students whose mark in PBC234 is <= 55%, and whose Mark in PBC286 is <= 60%. In the first release, only conjunctions of conditions need be Available to conveners, but the system should be developed so that future releases might allow for arbitrary Boolean combinations of conditions. The management of ABC Consulting has given you (that is, your assignment team) the Task to devise a proposal for such a system; that is, a well-defined scope, a plan how you Would proceed with implementing the system, and how much this implementation would Cost the potential client.

Questions:

Q1. Briefly explain the project scope.

Q2. Explain the functions that the system should implement.

Q3. Identified and list some of the expected and unexpected risks arising from the project.

Q4. What should they do to mitigate the risks?

Assessment Criteria - The following assessment criteria will be used for marking this assessment task. Ensure that you have addressed all of the criteria in your work;

• Answered all the case study questions within the context of the case.
• Answers are relevant to the case and demonstrate the understanding of the business situation.
• Explained the project scope and requirements.
• Explained the key functions of the system to be implemented.
• Identified and explained expected and unexpected risks from the project.
• Suggested risk mitigation strategies.