REPORT: IMPROVING SPECIFC ASPECTS OF THE ORGANIZATION’S INFORMATION SECURITY PROGRAMME INSTRUCTIONS 1. This assignment c
Posted: Thu May 05, 2022 12:56 pm
REPORT: IMPROVING SPECIFC ASPECTS OF THE ORGANIZATION’S
INFORMATION SECURITY PROGRAMME
INSTRUCTIONS
1. This assignment comprises three questions. Answer any TWO
questions.
2. Each question is worth 20 marks
3. The answer to each question is a report that covers four
sections , marked as
follows:
• Section 1: max 10 marks
• Section 2: max 5 marks
• Section 3: max 5 marks
• Section 4: required, but not marked separately
4. The title and the content of each section as described on
pages 2-4.
5. The lengths of the sections in your answers may vary. For
each question,
section 1 is expected to be around 2 pages (excluding
references) pages,
whole sections 2 and 3 may be shorter – but not shorter than one
page each
(excluding any references used).
6. Reference all sources used. Use APA v6 style for
referencing.
7. Use Times Roman Size 12 or a similar font/size, line spacing
1.5.
8. You can style your answers using the template on pages 5-6 of
this
document.
9. It is estimated that the work on this assignment will take
you about 40-45
hours.
10.For marking guidelines, see the relevant Canvas Rubric (in
Assignments).
11.Submit the assignment in Canvas in by 4.pm on Friday, 3rd
June 2022 or
earlier.
2
Question 1
You are a senior security analyst at the ABC university and are
tasked with improving some
specific, practice-oriented aspects of the university's InfoSec
programme, related to
cybersecurity incidents, You are studying the history of cyber
security incidents and want to
learn from it. There are quite a few famous cases to reflect on:
Kevin Mitnick, Anonymous,
Adrian Lamo, Albert Gonzalez, Jeanson James Ancheta, Michael
Calce, Kevin Poulsen,
Jonathan James, Wikileaks (You are not limited to these examples
and may select a different
example.) What can we learn from these cases? Identify a case of
a cybersecurity villain
(an individual or a group) and write a well-researched report,
as described below.
SECTION 1
In the first section , titled ‘The Case of [inset your case name
here]’ , the report should provide
a sufficiently detailed and referenced overview of the case you
have selected.
SECTION 2
In the second section , titled “Lessons Learnt” , the report
should provide an in-depth
discussion of how the lessons learned from your research can be
used to improve your
organizations’s response to information security incidents and
breaches and in particular, the
incident response plan of your organization .
SECTIION 3
Your organization has already developed an ICT Security Incident
Response Plan by adopting
the plan developed at Waikato university
(https://www.waikato.ac.nz/ict-selfhelp/ ... e-Plan.pdf
.In the last section of the report,
titled “Incident Plan Review”, you need d to review this plan
and determine whether it would
deal successfully wit the attack(s) that you have discussed in
the pervious two sections.
SECTIION 4. REFERENCES
This section will contain the references to the sources used in
the sections above.
Question 2
You are a senior security analyst at the ABC university and are
tasked with improving some
specific, practice oriented aspects of the university’s InfoSec
programme. One-Time Pad
(OTP) is an important security control as it can be used to
build an unbreakable cryptographic
system. Write a well-researched report on OTPs, as described
below:
SECTION 1
In the first section of your report, titled “OTP Review”,
explain who was behind the initial
idea, when OTPs were first used, in what application they were
found, and how they are used
today. To get a better idea about OTP, visit an online OTP
creation site (such as
3
www.braingle.com/brainteasers/codes/onetimepad.php) and practice
creating your own
ciphertext with OTP. You may even exchange your OTPs with other
students to see how you
might try to break them.
SECTION 2
In the next section, tilted “OTP Use”, the report should provide
an in-depth discussion of
how OTPs can be used for improving your organization’s response
to information security
incidents and breaches – e.g., would it be practical to use
OTPs? Why or why not? In what
contexts should they be used?
SECTION 3
Your organization is considering the adoption of OTP
specifically for remote work, similarly
to how the Toyohashi University (Japan) is doing it. In the last
section of your report, titled “
OTP Implementation” , review the information available at
https://imc.tut.ac.jp/en/totp and
either recommend it to be used as s blueprint for implementing
OTP at your university, or
suggest that is should not be used, explaining why.
Alternatively you may suggest another
example as a blueprint for implement OTP in your
organization.
SECTIION 4. REFERENCES
This section will contain the references to the sources used in
the sections above.
Question 3
You are a senior security analyst at the ABC university and are
tasked with improving some
specific, practice-oriented aspects of the university’s InfoSec
programme. Read the article
“Continuity and change in internet law”, by James Grimmelmann,
in Communications of the
ACM. May 2019, Vol. 62 Issue 5, p24-26 as an inspiration about
how new applications and
uses of the Internet have challenged the efficiency of the
existing laws and regulations (you
can download the article form the AUT library). Using additional
references for further
information, write a report on your findings of these challenges
and the solutions that
have been implemented or suggested; the required sections are
described below.
SECTION 1
In this section (Titled “ Internet Use Challenges), the report
should provide a sufficiently
detailed and referenced overview of the security threats posed
by new applications and uses
of the Internet that have challenged existing laws and
regulations.
SECTION 2
In this section ( titled “Organizational Response to New
Internet Use Challenges”) , the report
should provide an in-depth discussion of how organizations may
plan to respond to
information security incidents and breaches resulting from the
security threats associated with
the new uses of the Internet.
SECTION 3
4
In this section (titled “Ransomware Defence”) provide a list of
high level guidelines which
your organization needs to follow in developing a incident
response plan specifically to deal
with ransomware attacks. The organization has already identified
a number of useful resources
(below), so you can start with them too (but you are not limited
to these) :
-
https://www.cert.govt.nz/it-specialists ... tostop-it/
,
-
https://isea.utoronto.ca/wp-content/upl ... aybook.pdf
(part of the University of Toronto’s very comprehensive”
Incident Security response
Plan”,
https://isea.utoronto.ca/policies-proce ... ponseplan/),
and
- various industry publications such as
https://www.cfo.com/technology/2021/10/ ... re-attack/
SECTIION 4. REFERENCES
This section will contain the references to the sources used in
the sections above.
INFORMATION SECURITY PROGRAMME
INSTRUCTIONS
1. This assignment comprises three questions. Answer any TWO
questions.
2. Each question is worth 20 marks
3. The answer to each question is a report that covers four
sections , marked as
follows:
• Section 1: max 10 marks
• Section 2: max 5 marks
• Section 3: max 5 marks
• Section 4: required, but not marked separately
4. The title and the content of each section as described on
pages 2-4.
5. The lengths of the sections in your answers may vary. For
each question,
section 1 is expected to be around 2 pages (excluding
references) pages,
whole sections 2 and 3 may be shorter – but not shorter than one
page each
(excluding any references used).
6. Reference all sources used. Use APA v6 style for
referencing.
7. Use Times Roman Size 12 or a similar font/size, line spacing
1.5.
8. You can style your answers using the template on pages 5-6 of
this
document.
9. It is estimated that the work on this assignment will take
you about 40-45
hours.
10.For marking guidelines, see the relevant Canvas Rubric (in
Assignments).
11.Submit the assignment in Canvas in by 4.pm on Friday, 3rd
June 2022 or
earlier.
2
Question 1
You are a senior security analyst at the ABC university and are
tasked with improving some
specific, practice-oriented aspects of the university's InfoSec
programme, related to
cybersecurity incidents, You are studying the history of cyber
security incidents and want to
learn from it. There are quite a few famous cases to reflect on:
Kevin Mitnick, Anonymous,
Adrian Lamo, Albert Gonzalez, Jeanson James Ancheta, Michael
Calce, Kevin Poulsen,
Jonathan James, Wikileaks (You are not limited to these examples
and may select a different
example.) What can we learn from these cases? Identify a case of
a cybersecurity villain
(an individual or a group) and write a well-researched report,
as described below.
SECTION 1
In the first section , titled ‘The Case of [inset your case name
here]’ , the report should provide
a sufficiently detailed and referenced overview of the case you
have selected.
SECTION 2
In the second section , titled “Lessons Learnt” , the report
should provide an in-depth
discussion of how the lessons learned from your research can be
used to improve your
organizations’s response to information security incidents and
breaches and in particular, the
incident response plan of your organization .
SECTIION 3
Your organization has already developed an ICT Security Incident
Response Plan by adopting
the plan developed at Waikato university
(https://www.waikato.ac.nz/ict-selfhelp/ ... e-Plan.pdf
.In the last section of the report,
titled “Incident Plan Review”, you need d to review this plan
and determine whether it would
deal successfully wit the attack(s) that you have discussed in
the pervious two sections.
SECTIION 4. REFERENCES
This section will contain the references to the sources used in
the sections above.
Question 2
You are a senior security analyst at the ABC university and are
tasked with improving some
specific, practice oriented aspects of the university’s InfoSec
programme. One-Time Pad
(OTP) is an important security control as it can be used to
build an unbreakable cryptographic
system. Write a well-researched report on OTPs, as described
below:
SECTION 1
In the first section of your report, titled “OTP Review”,
explain who was behind the initial
idea, when OTPs were first used, in what application they were
found, and how they are used
today. To get a better idea about OTP, visit an online OTP
creation site (such as
3
www.braingle.com/brainteasers/codes/onetimepad.php) and practice
creating your own
ciphertext with OTP. You may even exchange your OTPs with other
students to see how you
might try to break them.
SECTION 2
In the next section, tilted “OTP Use”, the report should provide
an in-depth discussion of
how OTPs can be used for improving your organization’s response
to information security
incidents and breaches – e.g., would it be practical to use
OTPs? Why or why not? In what
contexts should they be used?
SECTION 3
Your organization is considering the adoption of OTP
specifically for remote work, similarly
to how the Toyohashi University (Japan) is doing it. In the last
section of your report, titled “
OTP Implementation” , review the information available at
https://imc.tut.ac.jp/en/totp and
either recommend it to be used as s blueprint for implementing
OTP at your university, or
suggest that is should not be used, explaining why.
Alternatively you may suggest another
example as a blueprint for implement OTP in your
organization.
SECTIION 4. REFERENCES
This section will contain the references to the sources used in
the sections above.
Question 3
You are a senior security analyst at the ABC university and are
tasked with improving some
specific, practice-oriented aspects of the university’s InfoSec
programme. Read the article
“Continuity and change in internet law”, by James Grimmelmann,
in Communications of the
ACM. May 2019, Vol. 62 Issue 5, p24-26 as an inspiration about
how new applications and
uses of the Internet have challenged the efficiency of the
existing laws and regulations (you
can download the article form the AUT library). Using additional
references for further
information, write a report on your findings of these challenges
and the solutions that
have been implemented or suggested; the required sections are
described below.
SECTION 1
In this section (Titled “ Internet Use Challenges), the report
should provide a sufficiently
detailed and referenced overview of the security threats posed
by new applications and uses
of the Internet that have challenged existing laws and
regulations.
SECTION 2
In this section ( titled “Organizational Response to New
Internet Use Challenges”) , the report
should provide an in-depth discussion of how organizations may
plan to respond to
information security incidents and breaches resulting from the
security threats associated with
the new uses of the Internet.
SECTION 3
4
In this section (titled “Ransomware Defence”) provide a list of
high level guidelines which
your organization needs to follow in developing a incident
response plan specifically to deal
with ransomware attacks. The organization has already identified
a number of useful resources
(below), so you can start with them too (but you are not limited
to these) :
-
https://www.cert.govt.nz/it-specialists ... tostop-it/
,
-
https://isea.utoronto.ca/wp-content/upl ... aybook.pdf
(part of the University of Toronto’s very comprehensive”
Incident Security response
Plan”,
https://isea.utoronto.ca/policies-proce ... ponseplan/),
and
- various industry publications such as
https://www.cfo.com/technology/2021/10/ ... re-attack/
SECTIION 4. REFERENCES
This section will contain the references to the sources used in
the sections above.