Reference no: EM133681796

Networking and Cyber Security

Project
Project Specification

Summary
Design a network that meets the provided scenario requirements. Then investigate options for using cloud services as part of the network, and evaluate potential ethical issues of data use. Finally, conduct a cyber security risk assessment for the scenario and recommend security controls.

Scenario
A gym franchisor is relocating to new premises as part of its business growth. It already has a chain of gym outlets across the city and state. This new premises will have the corporate office, a premium gym outlet, and a retail health resource shop at one location.

The corporate office maintains membership database, fitness classes & training programs, trainer schedules, personalised workout plans, website for the chain, etc. but provides limited business IT support to the franchisee. Gym members can use facilities across different outlet locations. Member-users can log- in and access their fitness/workout plans.

There is a business plan (not implemented yet) to allow other clients (gym members from participating partner gyms not within the franchise) to use the facilities within their chain of outlets.

The corporate office, initially about 25 staff, will include the Sales & Marketing, Finance, and Administration departments and an IT support team. The office will require WiFi connectivity for their devices.

The premium gym outlet will have the latest equipment with monitoring and logging features, allowing member users to track their progress against their customised fitness/workout plan. There will be several audio-visual displays used for streaming instructional programs, informational materials, or mood visuals. There will be climate and lighting controls installed.

Adjoining the gym will be change rooms with lockers, access card control system, and vending machines, etc.

The retail shop has health resources ranging from printed publications, audio-video materials, selected fitness equipment, training gear and accessories, nutrition and natural health supplements, and personal care items. The shop will have Point-of-Sale equipment, an inventory database, and will have access to the membership database to validate discounts for members.

For general security, networked CCTV cameras will be installed at the offices, the gym and the retail shop.

You have been consulted to design the network. The owner wants to see the design and hear your inputs on a variety of issues (including cyber security and cloud services). Then the owner will decide whether to further engage your services for the network build, operation and maintenance.

Groups
Conduct this project in a group of two (2) students, where both students must be in the same tutorial class. Only when there are left-over students (i.e., odd number of students in a class), will a group of three (3) be allowed (at the discretion of the Unit Coordinator). The expectations of details and quality will be higher for a group of three than a group of two.

Tasks

Network Design
Design the Network
Design the entire network. Your design should include:
One or more network diagrams (using diagrams.net);
Explanation of key design decisions, e.g., why you chose to design as you did;
Explain the WiFi design, including listing important settings (and their values).
Address allocations, e.g., IPv4 address ranges to be used;
List of recommended hardware, e.g., recommended minimum specifications for network equipment, with links to websites with the specifications and/or prices (AUD).
IP Addressing Requirements
The IP address ranges to be used are chosen by you, however they must meet the following requirements:
Only /16 or /24 network masks
The 1st decimal value, A, in any IP address, A.B.C.D, must be the last two digits of one of the group members student ID.
The 2nd (B), 3rd (C) and 4th (D) decimal value in an IP address, A.B.C.D, can be any value that is logically correct.
For example, if a group has two members with IDs 12345678 and 12234506 then all IP addresses used in your network design must start with 78 or 6, such as 78.1.2.3, 78.43.0.0/16, 6.19.123.56, 6.100.24.0/24. Depending on your network design, you can select to use any of the student IDs or use both of them.
Private address, such as 192.168.x.y, must not be used in any part of the network.

Cloud Services
The franchise has very scant ICT expertise/resources. The current franchise web server and all business data are stored in servers located at the corporate office. The franchisor believes that keeping data at the office is safer than in the cloud. With limited technical support available, the franchisor is also concerned about operational performance with servers centrally located at the office. You have been directed to explore, evaluate and recommend if cloud services are better suited for their operations.

Cloud Server
The franchise plans to move their web server to the cloud. You have been directed to estimate and compare the cost from different cloud service providers (CSP) for this relocation. The franchise public website will be hosted in this server, and it will have information about the company as well as details of all the products/services it offers (including specifications and pictures).

The servers can be implemented in a virtual machine in a cloud service. Servers must be hosted in Australia. You must find the price from at least two different cloud providers, choosing from Azure, AWS, or Google Cloud. Use the official calculators from those providers (use the given links), and you must export the price estimate from the calculator and upload the files to your GitHub repository. You must also recommend one cloud provider to the franchisor. Give a reason for the selected cloud provider.

You must summarise the values you chose for important specifications (e.g., region, operating system, CPU, storage) and justify your selection (e.g., why did you choose each value). The specifications should be the same or similar across cloud providers (e.g., do NOT choose a 1 TB disk for backup server in AWS and then choose a 5 TB disk for backup server in Azure; that is an unfair comparison). You must also give the annual cost for each server by each provider.

Backup
The corporate office has a local RAID NAS. The corporate data is backed-up in this NAS. It stores many important files of the company, e.g., sales, financial, customer and staff data, as well as automated regular backups of key computers in the network.

(a) Would this arrangement be adequate and sufficient for backups? Discuss.
Explore potential (b) cloud and (c) non-cloud services for the backup. For cloud option, identify and recommend suitable CSP for backup (including capacity, cost, etc.); use the CSP links given above. Discuss issues that should be considered for backup selection in your report. (A table would be more suitable for a summarised comparison than a list; an explanation is still required.)

On the topic of data backups, but in a different context, (d) recommend an approach for a new CQU ICT student (such as your group members) to organise and backup their university work during their entire course. You must recommend specific tools that are relevant to CQU students and ICT units, and justify the selection of these tools.

Security

Conduct cyber security risk assessment
You are to conduct a mini cyber security risk assessment of your network. By "mini" we mean you only conduct a subset of steps of a typical full risk assessment (due to lack of time and information available to you). You must use the risk assessment template, and follow the process, provided in the unit. Your risk assessment must consider vulnerabilities across at least 8 of the 12 information security threats, must contain assets of each asset type, and there must be at least 4 different data assets considered.

Recommend security controls
Select the data asset rated with the highest risk (from the previous risk assessment). Consider the following security controls covered in the unit: encryption, MFA, firewalls. Recommend at least one specific way you can use each of these controls in the project scenario to reduce the risk of the selected data asset. You must explain how the control reduces the risk, give details of how the control can be used (e.g., referring to devices, data and users in the project scenario, recommend specific technologies or approaches), and should mention specific parts of your network design when relevant (e.g., where in the network will the control be implemented; what will need to change in the network). You should also discuss any disadvantages of introducing the controls from the perspective of the users.

Ethical Issues

Identify issues with data collection

The franchise registers and collects information about their member-clients. Some of these would be necessary, but not exclusively, for business operations while other information collected would be for marketing to better target their products/services. New members can register at any franchise outlets; existing members can change/update their information at any franchise outlet, or through the franchise web portal. What could ethical/social issues be in collecting information on their member-clients? How much is too much? Apart from regulatory requirements, how would collection, access and use be managed from an ethical/social perspective. Consider that potentially any franchisee, and not just the corporate office, can have access to member-client information. Identify relevant issues and give your recommendations. (Note: The discussion on exchanging information with participating partner gyms is out of scope and will not be considered here.)

Identify issues with security cameras
Security cameras would be installed in the main office, the gym and the retail shop. Would these raise any ethical/social concerns? Are these identified reasons widely acceptable ethically/socially? What is the evidence? (Other factors to consider may include locations for surveillance, retention duration for archived material, access, distribution and use.) You will need to be very specific in identifying and discussing these. Also, are there relevant local or laws/regulations governing using security cameras? Explain and provide required source references.

Project Management
You are required to apply a very lightweight approach to project management (in later units you will learn and practice more formal project management). During the project you must do the following.

Project Plan
Before the start of Week 5 you must:
Form your group and setup project GitHub repository.
Agree upon communication frequency (e.g., "every Sunday and Wednesday", "during tutorial and every 2nd Thursday") and methods (e.g., Zoom, face-to-face, Teams).

Create a schedule of the weeks in which you plan to complete each task.
You must include the communications plan and schedule in your GitHub repository in the file plan.md.

Project Progress
Throughout the entire project all group members must make regular contributions to the project via the GitHub repository. See section 3 on Groups for details.

Project Reflection
Describe how you worked in a group, including the actual split of tasks. Consider what worked well in a group, and what issues you encountered. Recommended techniques you (or others) should use in future group projects (e.g., in units next term) to ensure successful team work. For each technique, explain what problem the technique is likely to solve or how it will help teamwork. You must refer to specific activities and techniques you actually performed/used in the project.

Report

The report must be in Markdown on your group project repository. A template and repository will be provided to you. There will be template Markdown files to use, however images and other supporting files (e.g., spreadsheets, diagrams) must also be included in your repository and linked from the relevant Markdown files. The report must be presented in a professional technical report (e.g., title, authors, section headings) and should include sections for each of the tasks. You may use sub-sections where relevant.

Include your own pictures and tables where relevant; do not use images from other sources. Do not change any names of files given with the template.

There is no word limit or page limit. Several of the tasks involve design and explanation, and therefore the level of detail (and length of the report) may vary significantly across groups.

There is no recommended number of references. It is not expected you will need to read research papers to complete this project, however you may need to research information from standards, industry best practices and websites (e.g., technical documentation, specifications). When you do gain key knowledge from other sources, including AI chatbots (e.g., ChatGPT), you must acknowledge that source (by referencing). Relevance and consistency (in format) of references is much more important than number of references or following a specific format.

Recorded Presentation

The presentation will be a recorded video that must cover the following:

Explain briefly why you chose the recommended approaches for company backup and personal backup (in Section 4.2.2).

Explain briefly the key ethical issues that the company must consider, with each student explaining one issue. (Section 4.4)

A summary of who contributed to the different tasks during the project. (Section 5.3)

A summary of how your group worked together, e.g., how often you met, where did you meet (in- class, after class, online), what communication mechanisms you used. (Section 5.3)

Reflection on what went wrong and how you can improve in the future. (Section 5.3) The presentation must meet the following requirements:

All students in the group must speak. One possible arrangement (referring to the 5 items above): student A covers item 1; student B covers item 2; both students cover item 3; student A (or B) covers item 4; student B (or A) covers item 5. If there are three students, then each student takes one of item 1, 2, and 3, and one student also takes item 5.

On the first appearance, each speaker must identify themselves before presenting. This includes showing the speaker's face on the screen (either full screen or in thumbnail).

No PowerPoint slides are needed. You are recommended to speak without notes. You may show parts of your report on the screen if relevant, but should not be reading your report.

Duration of approximately 5 minutes (about 1 minute for each of the items). The duration must be more than 4 minutes and less than 7 minutes.