CETM45 – Breach and Incident Response
|
Assessment |
2 of 2 |
|
Title |
CCIR |
|
Value
|
50 % of Module Mark
|
|
Deliverables |
PDF Report |
|
Handin Date & Time |
By 2359h on 29/05/2020 |
|
Handin Location |
Online in CETM45 Canvas |
|
Module Leader |
Dominic Button |
Please read all information & instructions carefully. Please ensure that you retain a duplicate of your assignment. We are required to send samples of student work to the external examiners for moderation purposes. It will also safeguard in the unlikely event of your work going astray. The following learning outcomes will be assessed:
Knowledge
1. Incident response planning, and, preparation for cyber breach response, including the legal and professional requirements involved.
2. Evidence collection requirements and methods for securing content in a forensically sound manner. This includes the ability to acquire, analyses and report collected information
3. Breach types, consequence and surrounding legal implications on both the organization and practitioner.
Skills
4. Plan and manage an effective response to a breach, including containment strategies and management of risk.
5. Respond and learn from a breach to develop and evaluate both proactive and reactive policies and procedures.
6. Investigate a breach, including methods for containment, risk, notification, evaluation and response.
Important Information
You are required to submit your work within the bounds of the University Infringement of Assessment Regulations (see your Programme Guide). Plagiarism, paraphrasing and downloading large amounts of information from external sources, will not be tolerated and will be dealt with severely. Although you should make full use of any source material, which would normally be an occasional sentence and/or paragraph (referenced) followed by your own critical analysis/evaluation. You will receive no marks for work that is not your own. Your work may be subject to checks for originality which can include use of an electronic plagiarism detection service. Where you are asked to submit an individual piece of work, the work must be entirely your own. The safety of your assessments is your responsibility. You must not permit another student access to your work. Where referencing is required, unless otherwise stated, the Harvard referencing system must be used (see your Programme Guide).
Assignment 2
The assignment is worth 50 %. As a guide, your report should be 2,000 words in length, excluding references and executive summary.
This assignment involves writing a breach incident and response report based on practical work you must undertake. The practical work will be based on a virtual machine (Breach-1 and 2.1) links to download these breaches are at bottom of this document. You will also need to have a virtual machine with Kali Linux installed in order to perform the breach. You will be required to move through both breaches to underpin what has occurred. You should consider: What type of attack has been conducted? Who is the attacker? Were measures in place before the attack to protect systems? How can this attack be remediated? When you are at the end of each breach you will find a flag to indicate you have reached the end. Furthermore, you will also be required to create Breach and Response report based upon the Breach Incident Response scenario (below). The report will have a maximum word limit of 2,000 words, not including references, executive summary.
The report will cover the breach incident remediation approaches. References to professional and academic may be used to back up your report (as needed). The scenario is given below.
Scenario
Initech was breached and the board of directors voted to bring in their internal Initech Cyber Consulting, LLP division to assist. Given the high- profile nature of the breach and, nearly catastrophic losses, there have been many subsequent attempts at the company. Initech has tasked their top consultants, led by Bill Lumbergh (CISSP) and Peter Gibbons (CEH, SEC+, NET+, A+) to contain and perform an analysis on the breach.
Little did the company realize that the breach was not the work of skilled hackers but a parting gift from a disgruntled former employee on his way out. The top consultants have been hard at work containing the breach. However, their own work ethics and mess left behind may be the downfall of the company. Some additional video can be from https://www.imdb.com/title/tt0151804/?ref_=ttqt_qt_tt .
The following points should be discussed through the various headings in the breach report.
You have been asked to write a Breach Incident Response report. Your report should be a well-structured, detailed, critical discussion of:
· Previous planning for a breach
· Response to the breach incident and your technical findings
· Management of an effective response to the breach
· Policies, processes and legal & ethical issues
· The evidence and its handling
· Containment of risk
· Remediation advice and recommendations
Report Sections
Title & Contents - Name of author,organisation (make one up), incident no (make one up)., IR company, ToC
· Background - A short background of the breach, discuss anything in place before breach occurred such as previous investigations or their incident response plan. (5 marks)
· Findings (executive summary) (300) goals & findings, 1 page (15 marks)
· Recommendations Short & medium term to remedy current situations. Long term to increase security (20 marks)
Appendices long listings, excerpts (anything 1+ pages)
· Examine a source of evidence – what does the evidence show, why is it important? screenshot of evidence, code or analysis report may be provided to show evidence? (15 marks)
· Handling of evidence - How would/have you handled live, images, malware? (15 marks)
· Timelines – Timeline of events for the attack – show dates and times of the attacks. (10 marks)
· Analysis Details – Steps taken to get to the root of the attack, actions taken, code used or why you did that step and screenshot/image of that step for evidence. (10 marks)
An additional 10 marks is available for appropriate use of references and the overall quality and structure of the report.
The report should use relevant references from professional and academic papers, as well as good professional practice in order to support your work (as needed and in Harvard format).
Your report should be appropriately sectioned, well-structured and should clearly set out your own analysis, the necessary remediation. and conclusions. Your conclusions should be backed up by well-reasoned arguments and references. It is not enough to regurgitate or summarise material found in literature
Quotations should be no more than two lines long and, taken all together, should represent less than 10% of the words written. The remaining 90% of this assignment must be entirely in your own words.
You should submit your paper as a PDF file.
Help with Referencing
Whenever you need to refer the reader to the source of some information, e.g. a book/journal/academic paper/WWW address, provide a citation at that point within the main body of your report.
e.g. ... as we are all now aware referencing is not trivial (Kendal, 2017)
Provide a reference list towards the end of your research paper (after your conclusions section but before any appendices) that contains:
References, a list of books/journals/academic papers/URLs etc. that have been directly cited from within the report (see example citation above).
Any material from which text, diagrams or specific ideas have been used, even if this has been presented in your own words, must be cited within the main body of the paper and listed in the reference list. It is not enough to list this material in a bibliography.
e.g. for the previous example (using Harvard system) the reference list would contain the following:
Kendal S., 2017, Referencing standards, International Student Journal, Vol 55, Pages 25 – 30, Scotts Pub., ISBN 1-243567-89
This shows the authors, date published, title of paper (in single quotes), title of journal or conference (in italics), volume, page numbers, and publisher (ISBN desirable but not essential).
For further help see the following book which is available in the library: -
Cite Them Right: The Essential Guide to Referencing and Plagiarism by Richard Pears and Graham Shields
An interactive online version of this guide is available by logging into My Sunderland with your User ID and password and then clicking on Me and Library Resources.
Files and software required
Workstation pro 15 (virtual machine)
Follow the link provided below. You will be faced with a login screen which you enter your university login details. If this does not work, please contact the IT support team.
vmware.sunderland.ac.uk
Kali Linux
One you have Workstation pro installed you will be required to obtain Kali Linux from the link provided below:
https://www.kali.org/downloads/
Here are some links on how to install Kali Linux on a virtual machine within VMWare:
https://www.shaileshjha.com/step-by-step-guide-how-to-install-kali-linux-2017-1-and-vmware-tools-in-vmware-workstation-12-pro/
Breach 1.0
The VM is configured with a static IP address (192.168.110.140) so you will need to configure your host-only adaptor to this subnet.
https://www.vulnhub.com/entry/breach-1,152/
Breach 2.1
The VM is configured with a static IP (192.168.110.151) so you'll need to configure your host only adaptor to this subnet.
https://www.vulnhub.com/entry/breach-21,159/
Assignment 2 marking scheme
|
|
Categories |
|||||||
|
|
Grade |
Relevance |
Knowledge |
Analysis |
Argument and Structure |
Critical Evaluation |
Presentation |
Relevance to Literature |
|
Pass
Pass |
86 – 100% |
The work examined is exemplary and provides clear evidence of a complete grasp of the knowledge, understanding and skills appropriate to the Level of the qualification. There is also unequivocal evidence showing that all the learning outcomes and responsibilities appropriate to that Level are fully satisfied. At this level it is expected that the work will be exemplary in all the categories cited above. It will demonstrate a particularly compelling evaluation, originality, and elegance of argument, interpretation or discourse.
|
||||||
|
76 – 85% |
The work examined is excellent and demonstrates comprehensive knowledge, understanding and skills appropriate to the Level of the qualification. There is also excellent evidence showing that all the learning outcomes and responsibilities appropriate to that level are fully satisfied. At this level it is expected that the work will be excellent in the majority of the categories cited above or by demonstrating particularly compelling evaluation and elegance of argument, interpretation or discourse and some evidence of originality
|
|||||||
|
70 – 75% |
The work examined is of a high standard and there is evidence of comprehensive knowledge, understanding and skills appropriate to the Level of the qualification. There is clearly articulated evidence demonstrating that all the learning outcomes and responsibilities appropriate to that level are satisfied At this level it is expected that the standard of the work will be high in the majority of the categories cited above or by demonstrating particularly compelling evaluation and elegance of argument, interpretation or discourse
|
|||||||
|
60 – 69% |
Directly relevant to the requirements of the assessment |
A substantial knowledge of relevant material, showing a clear grasp of themes, questions and issues therein |
Comprehensive analysis - clear and orderly presentation |
Well supported, focussed argument which is clear and logically structured. |
Contains distinctive or independent thinking; and begins to formulate an independent position in relation to theory and/or practice. |
Well written, with standard spelling and grammar, in a readable style with acceptable format |
Critical appraisal of up-to-date and/or appropriate literature. Recognition of different perspectives. Very good use of a wide range of sophisticated source material.
|
|
|
50 – 59% |
Some attempt to address the requirements of the assessment: may drift away from this in less focused passages |
Adequate knowledge of a fair range of relevant material, with intermittent evidence of an appreciation of its significance |
Significant analytical treatment which has a clear purpose |
Generally coherent and logically structured, using an appropriate mode of argument and/or theoretical mode(s) |
May contain some distinctive or independent thinking; may begin to formulate an independent position in relation to theory and/or practice. |
Competently written, with only minor lapses from standard grammar, with acceptable format |
Uses a good variety of literature which includes recent texts and/or appropriate literature, including a substantive amount beyond library texts. Competent use of source material.
|
|
|
40 – 49% |
Some correlation with the requirements of the assessment but there are instances of irrelevance |
Basic understanding of the subject but addressing a limited range of material |
Some analytical treatment, but may be prone to description, or to narrative, which lacks clear analytical purpose |
Some attempt to construct a coherent argument, but may suffer loss of focus and consistency, with issues at stake stated only vaguely, or theoretical mode(s) couched in simplistic terms
|
Sound work which expresses a coherent position only in broad terms and in uncritical conformity to one or more standard views of the topic |
A simple basic style but with significant deficiencies in expression or format that may pose obstacles for the reader |
Evidence of use of appropriate literature which goes beyond that referred to by the tutor. Frequently only uses a single source to support a point. |
|
|
Fail |
35 – 39% |
Relevance to the requirements of the assessment may be very intermittent, and may be reduced to its vaguest and least challenging terms |
A limited understanding of a narrow range of material |
Largely descriptive or narrative, with little evidence of analysis |
A basic argument is evident, but mainly supported by assertion and there may be a lack of clarity and coherence |
Some evidence of a view starting to be formed but mainly derivative. |
Numerous deficiencies in expression and presentation; the writer may achieve clarity (if at all) only by using a simplistic or repetitious style
|
Barely adequate use of literature. Over reliance on material provided by the tutor. |
|
30 – 34% |
The work examined provides insufficient evidence of the knowledge, understanding and skills appropriate to the Level of the qualification. The evidence provided shows that some of the learning outcomes and responsibilities appropriate to that Level are satisfied. The work will be weak in some of the indicators.
|
|||||||
|
15 – 29% |
The work examined is unacceptable and provides little evidence of the knowledge, understanding and skills appropriate to the Level of the qualification. The evidence shows that few of the learning outcomes and responsibilities appropriate to that Level are satisfied. The work will be weak in several of the indicators.
|
|||||||
|
0 – 14/% |
The work examined is unacceptable and provides almost no evidence of the knowledge, understanding and skills appropriate to the Level of the qualification. The evidence fails to show that any of the learning outcomes and responsibilities appropriate to that Level are satisfied. The work will be weak in the majority or all of the indicators.
|
|||||||