Reference no: EM133870633

Cyber Forensic

Assessment - Case Study Cybersecurity Investigation and Mitigation Report

Advanced Cybersecurity Investigation and Practical Implementation

Assessment Overview

This assessment requires students to analyse a real-world cybersecurity incident, conduct in-depth forensic investigations, and implement technical solutions using practical tools discussed in lectures.

Case Studies

0 Medibank Data Breach (2022) Medibank Cyberattack
Overview
1 Latitude Financial Cyberattack (2023) Latitude Financial Data
Breach
2 Canva Data Breach (2019) Canva Data Breach
Information
3 Optus Data Breach (2022) Optus Data Breach
Summary
4 Australian National University (ANU) Hack (2018-2019) ANU Cyber Attack
Report
5 MyGov Phishing Attack (2021) MyGov Phishing_
Incident
6 Australian Government Department of Home Affairs Home Affairs Data
Cyber Incident (2023) Breach
7 Transport for NSW Ransomware Attack (2020) Transport for NSW
Cyber Attack
8 NAB Customer Data Leak (2020) NAB Data Breach
Details
9 Woolworths MyDeal Data Breach (2022) MyDeal Data Breach
Students should use the provided source as a starting point for their investigation, ensuring they adhere to APA 7th referencing style for all citations and references in their report. Each student must investigate their assigned case study, analyse the attack methodology, and demonstrate forensic investigation techniques.
Assessment 3 (a): Individual Investigation Report (20%)
Your forensic investigation report must include:

1. Executive Summary
Explain the key findings of the assigned cybersecurity incident.
Summarise the forensic methodologies used in the investigation,
Provide recommendations for cybersecurity improvements.

2. Introduction
Discuss the significance and implications of the assigned case study.
Explain the scope, objectives, and methodology of the forensic investigation.

3. Evidence Collection & Forensic Analysis
Describe the incident response steps, including data acquisition and integrity verification.
Explain forensic imaging techniques and memory dump analysis for extracting system artefacts.
Analyse network traffic patterns to investigate data exfiltration methods.
Use and justify forensic tools such as:
Autopsy (File System Analysis)
Volatility (Memory Forensics)
Wireshark (Network Packet Analysis)
Splunk (SIEM Log Correlation) VARA Rules (Malware Hunting)

4. Attack Analysis & Practical implementation

Explain how the attackers gained access and discuss their methods for extracting sensitive data.
Analyse maiware and backdoor techniques used during the breach.
Investigate cloud-based forensic evidence and endpoint forensic artefacts to identify Indicators of Compromise (lo Cs) using Splunk & Windows Event Logs.
Examine how the attackers employed detection evasion techniques to remain undetected.

5. Legal & Compliance Aspects
Discuss the legal implications of the cybersecurity incident, focusing on Australian data protection regulations and compliance failures.
Explain how cybersecurity policies such as GDPR and the Australian Privacy Act 1988 apply to this case.

6. Strategic Cybersecurity Recommendations
Recommend measures for improving data security and preventing future breaches.
Explain how organisations can implement Zero Trust security models and other risk mitigation strategies.

7. References & Citation
Use APA 7th referencing style for all sources.
Include in-text citations where applicable.
Provide a reference list at the end of the report.
Ensure all references are from academic and reputable sources (e.g., journals, books, government reports, and white papers).

8. Appendices
Include screenshots of forensic tools in use.
Provide technical evidence, extracted artefacts, and log files.

Assessment: Presentation & Practical Demonstration

Each student must present their forensic investigation with a hands-on component. The presentation must include:

1, Summary of the Assigned Cybersecurity Incident

2. Explanation of the Attack Methodology

3. Demonstration of Forensic Analysis Using At least Two Tools

Practical Task 1: Memory Forensic Analysis using Volatility to analyse memory dumps.
Practical Task 2: Network Traffic Analysis using Wireshark to identify malicious outbound traffic.

4. Discussion on Legal & Ethical Considerations in Digital Forensics

5. Recommendations for Preventing Similar Cyber Attacks

Presentation Guidelines:

Provide 6-10 slides
Provide suitable Visual Aids, Including diagrams, forensic logs, and screenshots.
Mode of Delivery: PPT slides submissions, In-class Demonstration/Presentation and Viva