pp
Deliverables:
Step-12 SLA 3-5 pages
Project 2: Nations Behaving Badly Start Here
Despite work that cyber management teams perform in regard to systems design, network security protocols, hardware and software maintenance, training, policies, implementation, maintenance, and monitoring, breaches can and do occur. In this project, you will work with a team of other cyber professionals to analyze and respond to anomalous network activities.
The graded submission for Project 2 is a packaged deliverable to the CISO about risk and network intrusion, to be completed as a team. The deliverable to the CISO will include the following five parts:
1. Cybersecurity Risk Assessment including Vulnerability Matrix
2. Incident Response Plan
3. Service-Level Agreement
4. FVEY Indicator Sharing Report
5. Final Forensic Report
The project will take 15 days to complete. After reading the scenario below, proceed to Step 1, where you will establish your team agreement plan.
The US reports data exfiltration has been detected in the IDS (intrusion detection system). All nations will perform forensic analysis and collect corroborating information to identify the bad actor.
Prior to the summit, your nation team was tasked with setting up its own independent secure comms network. Now, at 3 a.m., just hours before the summit begins, you receive a text message from your CISO that reads: "I need to meet with the team immediately about an urgent matter. Please come to the conference room next to my hotel room now so we can discuss it."
You quickly dress and head to the conference room. When you arrive, she breaks the news to your team: The nation hosting the summit has detected data exfiltration in its IDS (intrusion detection system). It is likely that this pattern of network traffic could also result in buffer overflows or other attacks such as denial of service. Each nation's server is at risk.
"The report shows that the pattern of network traffic is anomalous," says the CISO. "And the point of origin is internal. Someone at the summit is involved in this."
Given the nature of the summit, participants understand that all nations have a common goal. "None of the FVEY members would have done this," says a colleague. "It's got to be the Russians or the Chinese. Friends don't read each other's mail."
The CISO says, "No one is above suspicion here. Our FVEY partners have been known to both collect intelligence and seek to embarrass other partners when it suited their strategic needs. It could have been anyone. Until we know for sure, though, we will continue to regard them as allies."
Leaders of the nations at the summit agree they all need to perform forensic analysis on their respective systems to identify the bad actor.
Your CISO continues. "Let's get to the bottom of this. We’re all familiar with data exfiltration attacks; do you think that's part of what we're dealing with here? Or do you think there's more? Use our packet sniffing tools to analyze the network traffic. Additionally, we need to identify attack vectors and attributes. Give me any information you can find on the tools, techniques, and the identity of this bad actor. Also, establish an incident response plan that we can use in case of another cyber event."
"Our systems went down due to this attack. We need to examine the service-level agreement to see what it will take to get the summit back up and running. After our analysis, we need to quickly let our allies know how to protect their networks through an indicator sharing report.
"Remember, no one is above suspicion—not even our allies. Got it?"
Everyone nods in agreement. The CISO says, "Good. Now get to work. I'm going to try to go back to sleep for a few hours."
When you submit your project, your work will be evaluated using the competencies listed below. You can use the list below to self-check your work before submission.
Competencies
Your work will be evaluated using the competencies listed below.
· 2.2: Locate and access sufficient information to investigate the issue or problem.
· 4.4: Demonstrate diversity and inclusiveness in a team setting.
· 5.3: Support policy decisions with the application of specific cybersecurity technologies and standards.
· 5.8: Apply procedures, practices, and technologies for protecting web servers, web users, and their surrounding organizations.
· 6.1: Knowledge of methods and procedures to protect information systems and data by ensuring their availability, authentication, confidentiality, and integrity.
· 8.1: Employ ethics when planning and conducting forensic investigations, and when testifying in court.
· 8.2: Incorporate international issues including culture and foreign language to plans for investigations.
Step 1
As a part of your nation(Canada) team, an agreement needs to be established in order to work efficiently on each project. Begin by revisiting your current team agreement document, which includes a suggested schedule for project completion. Update your team agreement with roles and assignments for this project. Your team will use this document as a guide to establish a plan for completing and submitting the group tasks. When you have completed the plan, resubmit it for review in the dropbox below.
Step 2
Project 2: Nations Behaving Badly Step 2: Identify Attack Vectors
You and your nation state have just suffered an intrusion attack. As a cybersecurity professional, one of the first steps is to identify potential attack vectors. For each known cybersecurity vulnerability and known threats (addressing cybersecurity threats through risk management, international cybersecurity approaches, you and your team members need to identify attack vectors via information systems hardware, information systems software, operating systems (operating system fundamentals, operating system protections), telecommunications (internet governance), and human factors (intrusion motives/hacker psychology). Then, you must determine if any attribution is known for the threat actor most likely involved in exploiting each weakness.
Review the materials on attack vectors if a refresher is needed. Once you've identified the attack vectors in this step, you will be able to participate in the next step, in which you will discuss your findings with colleagues and compare the findings with their analyses.
Step 3
Project 2: Nations Behaving Badly Step 3: Discuss Attack Vectors and Known Attribution
In light of your research in the last step, you will now use your group’s discussion board to share your thoughts with other members of your nation team. Review the findings of classmates in your group, noting points of agreement or disagreement, asking critical questions, and making suggestions for improvement or further research.
You should research incidents of known attribution of the hackers and actors who employ the attack vectors previously discussed by your group. This step provides a variety of options and perspectives for your group to consider when drafting the Attack Vector and Attribution Analysis in the next step.
This step also provides the foundation for research into known attribution, which will help you to discern the motivation for intrusion as well as the identity of the hackers and actors who employ the attack vectors noted.
Support Your Findings
Support your comments with evidence from your research. Remember, the intent is to help your fellow team members with critical questions, suggestions, and improvement in a respectful and honest manner.
Step 4
Project 2: Nations Behaving Badly Step 4: Analyze Attack Vectors and Known Attribution
You've discussed attack vectors and attribution with your nation state team members. In this step, your group will prepare an Attack Vector and Attribution Analysis of your group's findings in the previous steps. The analysis should first identify all possible attack vectors via hardware, software, operating systems, telecommunications, and human factors. Next, you should discuss whether attribution is known for the threat actor (hackers and actors) likely involved in exploiting each weakness. Integrate supporting research via in-text citations and a reference list. This analysis will play a key role in the development of a Vulnerability Assessment Matrix and Cybersecurity Risk Assessment in the next few steps.
Step 5
Project 2: Nations Behaving Badly Step 5: Develop the Vulnerability Assessment Matrix
With the Attack Vector and Attribution Analysis complete, in this step your nation team will assess the impact of identified threats and prioritize the allocation of resources to mitigate or prevent risks. As a group, you will collaborate to develop and submit one Vulnerability Assessment Matrix for your nation. This spreadsheet includes the following:
· characterization of current and emerging vulnerabilities and threats (cybersecurity vulnerability)
· identification of the attack vector(s) employed
· your assessment (high, medium, or low) of the impact the vulnerability could have on your organization
Submit your team's matrix for feedback. This matrix will be included in the final project deliverable, the Cybersecurity Risk Assessment.
In the next step, you and your nation team members will conduct research on best practices and countermeasures for the kind of attack your nation team sustained at the summit.
Step 6
Project 2: Nations Behaving Badly Step 6: Research Industry Best Practices and Countermeasures
At this point, you and your team members have analyzed attack vectors and used your research to construct a vulnerability assessment matrix. The next step in the process of analyzing the intrusion is to look at common practices and countermeasures that can be used for the type of attack your team incurred at the summit.
In this step, you and your team members will perform research on current best practices for authentication, authorization, and access control methods. You will also research possible countermeasures and cyber offense strategies that may be available. Review the materials on countermeasures and cyber offensives/warfare if needed. This research will help you make recommendations in the cybersecurity risk assessment, which you develop in the next step. Approach your research with transparency to support trust among your team. Review these resources on risk assessment and risk assessment approaches to prepare for the next step. The following links will provide you with resources on industry standards and best practices:
· Software Development Security
· Security Assessment and Testing
Step 7
Project 2: Nations Behaving Badly Step 7: Develop the Cybersecurity Risk Assessment
In this step, your team will prepare the Cybersecurity Risk Assessment in the form of a PowerPoint presentation. This is one of your three final deliverables, which you will submit for feedback as a group, and then for individual assessment at the end of the project.
The presentation should identify current measures for authentication, authorization, and access control, and clearly explain weaknesses in your organization's security (to include people, technology, and policy) that could result in successful exploitation of vulnerabilities and/or threats. The presentation should conclude with recommendations (e.g., continue to accept risks, accept some risks (identify them), mitigate some risks (identify them), mitigate all risks, etc.). Include the attack vector and attribution analysis, and the vulnerability matrix from the previous steps. Don’t try to shoehorn every point into your presentation. For guidance on creating presentations, refer to the following:
· Creating and Delivering Professional Presentations
· Record a Slide Show with Narration and Slide Timings
· Converting PowerPoint and Uploading to YouTube
Submit your Cybersecurity Risk Assessment PowerPoint for feedback by uploading it to YouTube. At the end of this project, your team will submit the presentation in the form of a YouTube link for grading.
Step 8
Project 2: Nations Behaving Badly Step 8: Define Incident Response, Part 1
It's time to begin work on the next phase of the final analysis of the intrusion, which will include an incident response plan . Such a plan provides a method for containing the impact from a cybersecurity incident. It includes a plan for file recovery and remediation from an incident. All the actions will start from the security baseline analysis , which has been defined for all the nations' network topologies at the summit, using a network security baseline analyzer.
Your nation team will work together to develop an eight- to 10-page Incident Response Plan to use in the event of a cyber incident. This is one of your three final deliverables, which you will submit for feedback as a group, and then for individual assessment at the end of the project.
Begin your first half of the plan by focusing on the environmental conditions and coordination mechanisms. Include:
1. roles and responsibilities
2. phases of incident response
3. scenario—provide an incident response plan in the case of distributed data exfiltration attacks, specifically the case of loss of communications
4. activities, authorities pertaining to roles and responsibilities
5. triggering conditions for actions
6. triggering conditions for closure
7. reports and products throughout the incident response activity
8. tools, techniques, and technologies
9. communications paths and parties involved
10. coordination paths and parties involved
11. external partners and stakeholders, and their place in the coordination and communication paths
12. security controls and tracking
13. recovery objectives and priorities
Your team will continue working on the incident response plan in the next step. You will consider the processes of an active response.
Step 9
Project 2: Nations Behaving Badly Step 9: Define Incident Response, Part 2
Your team in this step will continue developing the Incident Response Plan. The second half of your report will focus on events and processes of your active response plan. Include the following:
14. incident response checklist. Refer to the NIST Computer Security Incident Handling Guide for an example.
15. data protection mechanisms
16. integrity controls (system integrity checks) after recovery
17. a plan to investigate the network behavior and a threat bulletin that explains this activity
18. defined triggering mechanisms for continuing alerts and notifications throughout the cyber incident
19. additional aspects of the incident response plan necessary to contain a cyber incident on the international domain
20. diagrams of swim lanes of authorities, activities and process flows, coordination and communication paths. Review the Swim Lane Template to familiarize yourself with the concept of swim lanes and swim lane diagrams.
You will complete your incident response plan in the next step. Your incident response plan is critical in outlining your activities during a cyberattack as well as providing direction for recovery.
Step 10
roject 2: Nations Behaving Badly Step 10: Execute Incident Response
The intrusion activity apparently is not over yet. The CIOs of the nations are still detecting high-volume traffic on their networks. Almost as soon as there is a surge in activity, network functions and websites immediately become nonoperational. Communications are also affected between the nation teams.
The CIOs have provided information on the anomalous activity in the following lab.
Step 11
Project 2: Nations Behaving Badly Step 11: Analyze Cyber Defense Information
Take Note
This step includes a mandatory lab exercise. The teams should work together on the exercise, relying on each other’s expertise in the subject area of the exercise. The findings will be included in your team’s Security Baseline Report.
The attack continues. Now the CIO reports high-volume activity shutting down web access to the summit and to the attending nations' government websites. In addition, the volume impact has also caused latency in third-party websites whose processes and data sharing are linked to the summit and to the nations' government websites.
Your team now enters Workspace to analyze the .pcap files the CIOs had provided. You will analyze the .pcap files to understand some of the conditions that may have led to this high-volume traffic, an apparent DoS attack.
Step 12
Project 2: Nations Behaving Badly Step 12: Share the Cyber Defense Information With Nations
Now that you have analyzed the .pcap contents, you and your team of analysts will prepare mitigation (risk analysis and mitigation) for this current attack as well as any future attacks. You will also provide risk countermeasure implementation to a data exfiltration attack. Compile these strategies in a FVEY Indicator Sharing Report to be shared with your FVEY allies. Include Snort rules signatures and prepare rules for firewalls that would have prevented the data exfiltration attack. Review these resources on intrusion detection and prevention (IDS/IPS) systems and IDS/IPS classification to refresh your understanding of communications and network security, intrusion detection, and intrusion prevention.
Your report should include the following:
· other possible sources of vulnerabilities and best practices to protect endpoints.
· indicators for data exfiltration.
· methods for protection in bring your own device (BYOD) mobile security.
· an explanation of the importance of authorization and authentication mechanisms like CAC-PIV card readers. Review these resources on common access card (CAC) and multifactor authentication technologies if you need a refresher.
· best practices for database protection (data loss prevention), which serves as the backbone to information sharing and communications. How can obfuscation and masking be used to ensure database security?
You don't want to just build a wall and block everything. Your team has conducted a risk assessment and developed an approach. In your report, share the tools, methods, and the actual net defenses your nation team has used.
In Project 1, your team identified the nations performing the malicious activities. At this point, it is necessary to protect the network and defend against the attacks. You must devise a plan and pull from the suite of net defense tools available to you. For intrusion detection and prevention, you must program rule sets in firewalls.
Now that your nation team has identified the bad actors, your nation will then build out Snort rules based on the traffic you have analyzed to allow the permitted communications while keeping out malicious traffic and activities.
Once your team has completed the sharing report, post it to the FVEY discussion where other nation teams can view it.
Step 13
Project 2: Nations Behaving Badly Step 13: Evaluate and Execute the Data Exfiltration Service-Level Agreement (SLA)
You've communicated the attack to your other nation teams, your team has determined that all the nation teams were under data exfiltration attack, and they sustained latency or even unavailability of their networks. Now the CIOs have directed that the service-level agreements (SLAs) be reviewed on what the attack means to the cost and services rendered. Technologically trained professionals increase their marketability and hire-ability when they can demonstrate business acumen as well as technical expertise. And with more integrated environments following services on-demand structures such as cloud computing, it is imperative that cybersecurity professionals be able to assess if their organization is getting what it paid for.
You may have determined a network topology for your nation team, or you may have researched a network topology and are using that to base your analysis, citing the researched information using APA format. In these topologies, you will research the operating system vulnerabilities (operating system fundamentals, operating system protections). You will identify requirements for operating system security to address these vulnerabilities.
You will then formulate a service-level agreement to mitigate the vulnerabilities, particularly for data exfiltration activities.
Produce a three- to five-page Service-Level Agreement (SLA) that you believe is best to serve the nation teams’ security protections. If you research sample SLAs, provide citations.
Include:
· an agreement not to engage in testing data exfiltration without notifying the internet service provider (ISP)
· metrics for availability
· bandwidth requirements
· monitoring from the ISP's network
· traffic reports to be received and access to ISP information on net defense and best practices
· testing nation teams’ configurations by ISP
· other components needed to fulfill your nation team's requirements
Perform an evaluation of the SLA that you created, and in a checklist format, report on the performance of the ISP during the data exfiltration attack. Conduct independent research if a checklist example is needed. If you model your checklist after an existing resource, cite and reference it using APA format. Estimate costs of services or any compensation owed to the nation team. Include written justification to the ISP for the downtime due to data exfiltration. This evaluation is included in the three- to five-page requirement.
In the next step, you will take on "packet sniffing" in the lab, as you move to a digital forensics role in the investigation.
Step 14
Project 2: Nations Behaving Badly Step 14: Conduct Wireshark Packet Capture Analysis
It is time to help the CISO with the network intrusion. Your role here is to assume responsibility of analyzing a network packet capture file that was created during the network attack. You will conduct packet sniffing with Wireshark to gather information about the attacker, determine the resources that may have been compromised during the attack, and how the attacker compromised the resources.
The CISO and response team believe there were attempts to scan the network for vulnerabilities and that an attacker may have discovered and exploited a vulnerability on one of the network servers. The attack may involve a brute-force password attack followed by a data breach where the attacker was able to download and read one or more files from a compromised server.
Your objectives are to identify the attacker, identify the compromised server and service, identify the vulnerability that was exploited, and determine what data was breached or stolen.
Your task is to enter Workspace and complete the Wireshark Packet Capture Analysis. Complete the lab report, including all answers to questions in the instructions linked below.
Step 15
Project 2: Nations Behaving Badly Step 15: Develop Final Forensic Report
There are many digital forensic tools and techniques available to conduct an end-to-end forensic investigation. An end-to-end investigation tracks all elements of an attack, including how the attack began, what intermediate devices were used during the attack, and who was attacked. A typical investigation will involve visual analysis to statically review the contents of any drives, as well as dynamically review logs, artifacts (strategies for handling digital artifacts), and internet activity from the web history associated with the breached network (web browser forensics).
The investigation concludes when the investigator examines all of the information, he or she correlates all of the events and all of the data from the various sources to get the whole picture, and prepares reports and evidence in a forensically sound manner.
In this scenario, you know that there has been an attempted/successful intrusion on the network, and you have completed the packet capture analysis using Wireshark. Your task is to write a Final Forensic Report that summarizes network forensics and the digital forensic tools and techniques for analyzing network incidents. This report will include your lab report from the previous step and should also be composed of network attack techniques, network attack vectors, and a comprehensive comparison of at least five tools used for analyzing network intrusions. This report will conclude with a recommendation for network administrators to meet the goals of hardening the infrastructure and protecting private data on the network.
Submit the Final Forensic Report for review and feedback.
Step 16
Project 2: Nations Behaving Badly Step 16: Deliver to Your CISO
As a synthesis of the previous steps in this project, you will now submit the following for grading a packaged deliverable to the CISO that contains the following:
1. Cybersecurity Risk Assessment including Vulnerability Matrix
2. Incident Response Plan
3. Service-Level Agreement
4. FVEY Indicator Sharing Report
5. Final Forensic Report
Based on the feedback you have received, you should have revised the deliverables. Although many of these deliverables were initially developed in a team setting, each team member is responsible for submitting his or her own documents for individual assessment.
Before you submit your assignment, review the competencies below, which your instructor will use to evaluate your work. A good practice would be to use each competency as a self-check to confirm you have incorporated all of them in your work.
Check Your Evaluation Criteria
Before you submit your assignment, review the competencies below, which your instructor will use to evaluate your work. A good practice would be to use each competency as a self-check to confirm you have incorporated all of them. To view the complete grading rubric, click My Tools, select Assignments from the drop-down menu, and then click the project title.
· 2.2: Locate and access sufficient information to investigate the issue or problem.
· 4.4: Demonstrate diversity and inclusiveness in a team setting.
· 5.3: Support policy decisions with the application of specific cybersecurity technologies and standards.
· 5.8: Apply procedures, practices, and technologies for protecting web servers, web users, and their surrounding organizations.
· 6.1: Knowledge of methods and procedures to protect information systems and data by ensuring their availability, authentication, confidentiality, and integrity.
· 8.1: Employ ethics when planning and conducting forensic investigations, and when testifying in court.
· 8.2: Incorporate international issues including culture and foreign language to plans for investigations.