Cyber Security Project

ISE 510 Final Project Guidelines and Rubric

Overview The final project for this course is the creation of a security breach analysis and recommendations. The relevance of risk assessment cannot be overemphasized as organizations establish or reaffirm their security posture, especially in the wake of overwhelming computer security breaches at many organizations in the United States and around the world, including government agencies. Organizations seek to understand their compliance status for current regulations as well as their vulnerability in order to adopt a proper approach to manage risks. It is equally important to conduct a risk assessment after a system breach has occurred to better understand the threats and the vulnerabilities exploited. For your final project, you will analyze an information security breach that has already occurred. This will place you in the role of a risk assessment expert, coming in to determine how the breach occurred and develop strategies to mitigate against the breach reoccurring. Risk assessment experts can fill the positions of penetration testers, information security auditors, and independent verification and validation analysts, for example. Such roles will continue to gain relevance as organizations and governments continue to move sensitive financial information, personal health information (PHI), and personally identifiable information (PII) across publicly accessible networks and storage devices. For the final project for this course, you will analyze an information security breach provided in the Final Project Scenario document and the educational video game (Agent Surefire: InfoSec) you will play in Module Three. In your analysis, you will discuss how the breach occurred, the incident response processes that were initiated, the impact of the breach, and applicable regulations to the organization. Then, you will develop a security test plan for the breached system and create security controls to ensure that the breach will not reoccur. The project is divided into three milestones, which will be submitted at various points throughout the course to scaffold learning and ensure quality final submissions. These milestones will be submitted in Modules Three, Five, and Seven. The final product will be submitted in Module Nine. This assessment addresses the following course outcomes:

 Determine how cybersecurity attacks occur in organizations through analysis of security breaches

 Evaluate incident response processes for their effectiveness in ensuring business continuity in support of organizational goals

 Assess the impact of cybersecurity regulations on the information security of organizations

 Create security test plans for networks, applications, or physical security assessment projects based on established cybersecurity standards

 Develop risk mitigation strategies for addressing application, website, and network vulnerabilities

 Recommend methods to reduce the impact of organizational culture and communication challenges that could affect cybersecurity risk assessment in a diversified world

Prompt Your security breach analysis and recommendations should answer the following prompt: Using your Final Project Scenario and gameplay from the educational video game Agent Surefire: InfoSec that you will complete in Module Three, analyze the information security breach to determine how the breach occurred, evaluate the incident response processes, and assess the impact of the breach and applicable regulations on the business or organization. Then use your analysis to develop a security test plan, security controls to mitigate risk, and recommendations that reduce the impact of organizational culture and communication challenges. Specifically, the following critical elements must be addressed:

I. Introduction: Provide a brief profile of the business or organization that has been attacked, including its organizational goals. In your profile, you could consider the industry in which the business or organization operates and the product or service that is the focus, for example.

II. Security Breach: In this section, you will analyze one current information security breach, describing the business or organization that has been affected by this breach and explaining how the breach occurred. Specifically, you should:

A. Attack Location: Determine what part of the business or organization was attacked by analyzing the security breach that occurred. For example, was the network attacked? Or was the company website hacked?

B. Attack Method and Tools: Analyze the security breach to determine the method and tools that were used to effect the attack. In other words, how did the attack occur?

C. Vulnerabilities: Based on your analysis, what vulnerabilities of the business or organization were exploited? How were the vulnerabilities discovered? For example, were the vulnerabilities discovered by an employee, a third party, or a customer?

III. Incident Response: In this section, you will evaluate the incident response processes that were initiated in response to the breach. Specifically, you should:

A. Actions: What incident response actions were initiated to minimize the impact of the breach? In other words, what did the business or organization do to address the vulnerabilities and resume normal system operations after the breach?

B. Business Continuity: Evaluate these incident response actions for their effectiveness in allowing the business to resume normal system operations after the breach. In other words, how effective were these incident response actions in ensuring business continuity and supporting the organization’s goals?

IV. Impact: In this section, you will discuss the possible impacts of applicable cybersecurity regulations to the business or organization. Specifically, you should:

A. Application: Describe the government and industry regulations that apply to the business or organization in relation to the security breach. For example, what legislation, directives, and policies relate to the security breach?

B. Impact: How do these regulations impact the business or organization and its information security? Support your response with specific examples.

C. Financial and Legal Implications: Discuss possible financial and legal implications of the security breach for the business or organization. Will the business or organization be subject to any fines or sanctions because of the security breach, for example?

V. Security Test Plan: In this section, you will develop a security test plan for the breached system, basing your plan on your analysis of the security breach and established cybersecurity standards such as those from the National Institute of Standards and Technology (NIST). Specifically, you should:

A. Scope: Determine the scope of the risk assessment. For example, what assets, threats, and vulnerabilities will need to be addressed? Will the risk assessment need to include networks, applications, or physical security systems? What policies and procedures will need to be reviewed?

B. Resources: Document the resources required for the risk assessment. In other words, what do you need to actually do the assessment? C. Hardware and Software: Create a list of system hardware and software within the target of the risk assessment. In other words, what are the

parts of the system that you are assessing? D. Tools: Determine the necessary tools for the risk assessment, based the list of system hardware and software you created.

VI. Risk Mitigation: In this section, you will create security controls to ensure that the breach will not reoccur. Specifically, you should: A. Security Controls: Create at least five security controls that mitigate future risks by ensuring that the security breach will not reoccur. These

controls can be technical, administrative, or personnel security controls, for example. B. Vulnerabilities: How will the security controls you created mitigate risks by reducing application, website, and network vulnerabilities? C. Evaluation: What are the criteria for measuring the controls to ensure they are properly implemented? In other words, how will the security

controls be evaluated? VII. Conclusion: In this section, you will recommend methods to reduce the impact of organizational culture and communication challenges. Specifically, you

should: A. Communication: Document interpersonal communication issues encountered within the risk assessment team. How were the issues resolved? B. Organizational Culture: What challenges to organizational culture occurred as a result of the security breach? In your response, consider the

impact of the security breach on the reputation of the business or organization. C. Recommendations: What methods can you recommend to reduce the impact of these communication and organizational cultural issues in

future risk assessments?

Milestones Milestone One: Kickoff Agenda In Module Three, you will submit a kickoff agenda. This milestone will be graded with the Milestone One Rubric. Milestone Two: Test Plan In Module Five, you will submit a test plan. This milestone will be graded with the Milestone Two Rubric. Milestone Three: Incident Response Plan In Module Seven, you will submit an incident response plan. This milestone will be graded with the Milestone Three Rubric. Final Submission: Security Breach Analysis and Recommendations In Module Nine, you will submit your final project. It should be a complete, polished artifact containing all of the critical elements of the final product. It should reflect the incorporation of feedback gained throughout the course. It should also be structured to follow the outline presented in the Prompt. This submission will be graded with the Final Project Rubric (below).

Deliverables Milestone Deliverables Module Due Grading

One Kickoff Agenda Three Graded separately; Milestone One Rubric

Two Test Plan Five Graded separately; Milestone Two Rubric

Three Incident Response Plan Seven Graded separately; Milestone Three Rubric

Security Breach Analysis and Recommendations

Nine Graded separately; Final Project Rubric (below)

Final Project Rubric Guidelines for Submission: Your security breach analysis and recommendations should adhere to the following formatting requirements: 10–15 pages, double- spaced, using 12-point Times New Roman font, and one-inch margins. You should use current APA style guidelines for your citations and reference list, if applicable. Instructor Feedback: This activity uses an integrated rubric in Blackboard. Students can view instructor feedback in the Grade Center. For more information, review these instructions.

Critical Elements Exemplary (100%) Proficient (90%) Needs Improvement (70%) Not Evident (0%) Value

Introduction

Meets “Proficient” criteria and profile expertly balances necessary detail with brevity

Provides brief profile of business or organization that has been attacked and its organizational goals

Provides brief profile of business or organization that has been attacked and its organizational goals but with gaps in clarity, detail, or accuracy

Does not provide brief profile of business or organization that has been attacked and its organizational goals

5.36

Security Breach: Attack Location

Meets “Proficient” criteria and response demonstrates keen insight into how cybersecurity attacks occur in organizations

Determines what part of business or organization was attacked by analyzing security breach

Determines what part of business or organization was attacked by analyzing security breach, but with gaps in accuracy or logic

Does not determine what part of business or organization was attacked by analyzing security breach

5.36

Security Breach: Attack Method and Tools

Meets “Proficient” criteria and response demonstrates keen insight into how methods and tools influence cybersecurity attacks in organizations

Determines method and tools used to effect attack by analyzing security breach

Determines method and tools used to effect attack by analyzing security breach, but with gaps in accuracy or logic

Does not determine method and tools used to effect attack by analyzing security breach

5.36

Security Breach: Vulnerabilities

Meets “Proficient” criteria and response demonstrates keen insight into the vulnerabilities cybersecurity attackers exploit

Explains which vulnerabilities were exploited and how they were discovered, based on analysis of security breach

Explains which vulnerabilities were exploited and how they were discovered, but explanation is not based on analysis of security breach or has gaps in clarity, detail, or accuracy

Does not explain which vulnerabilities were exploited and how they were discovered

5.36

Incident Response: Actions

Meets “Proficient” criteria and description demonstrates nuanced understanding of use of incident response processes

Describes incident response actions that were initiated to minimize impact of breach

Describes incident response actions that were initiated to minimize impact of breach, but with gaps in clarity, detail, or accuracy

Does not describe incident response actions that were initiated to minimize impact of breach

5.36

Incident Response: Business Continuity

Meets “Proficient” criteria and evaluation demonstrates keen insight into effectiveness of incident response processes in ensuring business continuity

Evaluates incident response actions for their effectiveness in allowing the business to resume normal system operations after the breach

Evaluates incident response actions for their effectiveness in allowing the business to resume normal system operations after the breach, but with gaps in clarity, detail, or logic

Does not evaluate incident response actions for their effectiveness in allowing the business to resume normal system operations after the breach

5.36

Impact: Application

Meets “Proficient” criteria and description demonstrates nuanced understanding of cybersecurity regulations

Describes government and industry regulations that apply to business or organization in relation to security breach

Describes government and industry regulations that apply to business or organization in relation to security breach, but with gaps in clarity, detail, or accuracy

Does not describe government and industry regulations that apply to business or organization in relation to security breach

5.36

Impact: Impact

Meets “Proficient” criteria and assessment demonstrates keen insight into relationship between cybersecurity regulations and information security of organizations

Assesses impact of regulations on business or organization and its information security, supporting response with specific examples

Assesses impact of regulations on business or organization and its information security but assessment is cursory, inaccurate, or has gaps in support

Does not assess impact of regulations on business or organization and its information security

5.36

Impact: Financial and Legal Implications

Meets “Proficient” criteria and response demonstrates deep understanding of cybersecurity regulations

Discusses possible financial and legal implications of security breach for business or organization

Discusses possible financial and legal implications of security breach for business or organization but with gaps in clarity, detail, or accuracy

Does not discuss possible financial and legal implications of security breach for business or organization

5.36

Security Test Plan: Scope

Meets “Proficient” criteria and response demonstrates nuanced understanding of using established cybersecurity standards in developing the scope of security test plans

Determines scope of risk assessment, based on analysis of security breach and established cybersecurity standards

Determines scope of risk assessment, but response has gaps in accuracy or detail or is not based on analysis or established standards

Does not determine scope of risk assessment

4

Security Test Plan: Resources

Meets “Proficient” criteria and response demonstrates nuanced understanding of using established cybersecurity standards in developing security test plans and assigning resources

Documents resources required for risk assessment, based on analysis of security breach and established cybersecurity standards

Documents resources required for risk assessment, but response has gaps in accuracy or detail or is not based on analysis or established standards

Does not document resources required for risk assessment

4

Security Test Plan: Hardware and Software

Meets “Proficient” criteria and response demonstrates nuanced understanding of using established cybersecurity standards in determining hardware and software within target of risk assessment

Creates list of system hardware and software within target of risk assessment, based on analysis of security breach and established cybersecurity standards

Creates list of system hardware and software within target of risk assessment, but response has gaps in accuracy or detail or is not based on analysis or established standards

Does not create list of system hardware and software within target of risk assessment

4

Security Test Plan: Tools

Meets “Proficient” criteria and response demonstrates nuanced understanding of using established cybersecurity standards in developing security test plans with appropriate tools

Determines necessary tools for risk assessment, based on list of system hardware and software, analysis of security breach, and established cybersecurity standards

Determines necessary tools for risk assessment but response is not based on list of hardware and software, breach analysis, or established standards or has gaps in accuracy or detail

Does not determine necessary tools for risk assessment

4

Risk Mitigation: Security Controls

Meets “Proficient” criteria and security controls demonstrate nuanced understanding of risk mitigation

Creates at least five security controls that mitigate future risks by ensuring that the security breach will not reoccur

Creates at least five security controls, but not all controls mitigate future risks by ensuring that the security breach will not reoccur

Does not create at least five security controls

5.36

Risk Mitigation: Vulnerabilities

Meets “Proficient” criteria and response demonstrates keen insight into using security controls to address application, website, and network vulnerabilities

Explains how security controls will mitigate risks by reducing application, website, and network vulnerabilities

Explains how security controls will mitigate risks by reducing application, website, and network vulnerabilities, but with gaps in clarity, detail, or accuracy

Does not explain how security controls will mitigate risks by reducing application, website, and network vulnerabilities

5.36

Risk Mitigation: Evaluation

Meets “Proficient” criteria and explanation demonstrates deep understanding of security controls

Explains criteria for measuring controls to ensure they are properly implemented

Explains criteria for measuring controls to ensure they are properly implemented, but with gaps in accuracy or logic

Does not explain criteria for measuring controls to ensure they are properly implemented

5.36

Conclusion: Communication

Meets “Proficient” criteria and response demonstrates keen insight into relationship between communication challenges and risk assessment

Documents interpersonal communication issues encountered within risk assessment team and explains how issues were resolved

Documents interpersonal communication issues encountered within risk assessment team and explains how issues were resolved, but with gaps in clarity, detail, or accuracy

Does not document interpersonal communication issues encountered within risk assessment team and explain how issues were resolved

5.36

Conclusion: Organizational Culture

Meets “Proficient” criteria and response demonstrates keen insight into relationship between organizational culture challenges and risk assessment

Describes challenges to organizational culture that occurred as a result of the security breach, addressing impact of security breach on reputation of business or organization

Describes challenges to organizational culture that occurred as a result of the security breach, addressing impact of security breach on reputation of business or organization, but with gaps in clarity, detail, or accuracy

Does not describe challenges to organizational culture that occurred as a result of the security breach, addressing impact of security breach on reputation of business or organization

5.36

Conclusion: Recommendations

Meets “Proficient” criteria and recommended methods demonstrate nuanced understanding of impact of organizational culture and communication challenges on information security

Recommends appropriate methods for reducing impact of communication and organizational culture issues in future risk assessments

Recommends methods for reducing impact of communication and organizational culture issues in future risk assessments, but with gaps in appropriateness or applicability

Does not recommend methods for reducing impact of communication and organizational culture challenges in future risk assessments

5.36

Articulation of Response

Submission is free of errors related to citations, grammar, spelling, syntax, and organization and is presented in a professional and easy-to-read format

Submission has no major errors related to citations, grammar, spelling, syntax, or organization

Submission has major errors related to citations, grammar, spelling, syntax, or organization that negatively impact readability and articulation of main ideas

Submission has critical errors related to citations, grammar, spelling, syntax, or organization that prevent understanding of ideas

3.6

Total 100%