COMP3065 AST ICA2

Advanced Security Techniques 
COM3065 	AST ICA2  
2019-20 

From the module guide

“Component 2 (70%): The design, implementation and evaluation of appropriate security measures and investigation of a given scenario (approx 3000 words). Assesses learning outcomes 4,5,6,7,8,9. Criteria:

1. Demonstration of understanding of the scenario.
2. Identification of security vulnerabilities.
3. Selection and justification for their choice of security measures used in the investigation.
4. Evaluation of appropriateness of chosen security measures used in the investigation.
5. Critical reflection of self-performance and the development of skills for employment as a computer security professional.

• LO4 Synthesise and evaluate appropriate data for a given scenario to make informed computer security judgements.
• LO5 Select and justify appropriate security measures informed by appropriate research to satisfy stated objectives.
• LO6 Operate ethically and legally when conducting simulated investigations for a given scenario.
• LO7 Act autonomously with limited supervision when investigating simulated computer security scenarios.
• LO8 Communicate findings from investigative tasks clearly, fluently and effectively in a professional manner.
• LO9 Reflect on the knowledge and skills gained during the module and articulate their effect on future employability as a computer security professional.”

Scenario

ECHRS Ltd are based in Bradford and provide a telephone and web-portal outsourcing service for human resources records and payroll for a range of companies across diverse sectors.

A specialist division of ECHRS based in Leicester handles occupational health services via a pool of doctors and nurses on casual zero-hours contracts. Their contact with external clients is normally via the ECHRS staff at Bradford.

The Bradford site has the following IT infrastructure:

• desktop PCs, mostly Windows 10;
• a large, customised web server running IIS on Windows Server 2012 R2 with Remote Desktop Services;
• VoIP telephony server / Fax.

Backups are via tape and stored in a fireproof safe at Bradford.

ECHRS’s web and email is provided via GoDaddy and cPanel configuration.

Occupational health services division staff based at Leicester use remote desktops (served via the Bradford remote desktop services). The workstations themselves are a mixture of very old Windows XP devices all the way up to powerful Windows 10 machines.

All staff have access to email via the GoDaddy service; many are known to access it via personal devices (mobile phones and tablets).

Occupational health services doctors and nurses sometimes visit employees of external clients at their home address or workplace. They are known to make notes on their own devices prior to writing reports via the remote desktop services. Some access the remote desktop services from their home PCs.

ECHRS believe that they have suffered an intrusion. This is because a large amount of data has been found by a third party on a web forum accessed via I2P (Invisible Internet Project). The third party has reported this to ECHRS via anonymous email. The data is reported as containing a substantial amount of personal and payroll data for many (but not all) external client companies, which is not compliant with the GDPR. There are also a small number of detailed occupational health reports on external client employees.

You have been brought in as an external security specialist.

Task (Total Mark 100)

1. Explain the consequences of the event, including non-compliance with the GDPR (15% Mark).
2. Explain how you would investigate this intrusion (20% Mark).
3. Make recommendations for immediate actions to limit the compromise. You should make reasonable assumptions about the possible means of intrusion (15% Mark).
4. Identify the other potential means of information leakage (based on the scenario) if there was no intrusion (10% Mark).
5. Make recommendations for future security at ECHRS (20% Mark).
6. Describe, with rationale, the relevance of this ICA to you and your future employment and how you believe it could be improved (10% Mark).

For the first three tasks, be precise about tools and methods. Justify all your suggestions, recommendations and decisions.

Rest of the mark (10% Mark) is for the organisation and presentation of the ICA report.

Deliverable and deadline

You should submit your report as a PDF document via Blackboard by the deadline of 16:00 hrs (date given by MDIS) 2019.

Advice and assistance

Consult the module tutor during a scheduled session or email.

Assessment criteria

The criteria below are necessarily incomplete as we cannot anticipate every possible ICA submission. Marking weightages are highlighted in the Tasks section. 

Marks will be assigned as in the following table.

For more information, please reread this document.