Reference no: EM133297874

Module - Cyber Operations

Assignment Brief:

This is an individual assessment that will assess your understanding of advanced principles in computer security from a systems perspective.
You are expected to demonstrate an insight into the implications of the problem introduced using clear and concise arguments. You will receive formative feedback as part of the module to demonstrate how to be concise in your written work. If you produce work that is not concise and to the point, then marks may be reduced. The reports should be well written (and word-processed), showing good skills in creativity and design. Sentences should be of an appropriate length and the writing style should be brief but informative.

During the teaching weeks, you will have the opportunity to submit draft copies of your work. The module team will provide general feedback based on your draft copies and advice regarding your progress (if it is deemed necessary). The deadline for submitting task 1 is 20.12.2022.

Situational awareness
This is a scenario-based assignment in which you need to develop a threat and risk mitigation strategy based on your analysis of the circumstance and supporting evidence. The assignment is weighted at 60% of the overall mark. It should take you approximately 25 hours to complete. It is expected that the report will be in the region of 3000 words. You are expected to conduct an analysis of the network packet capture that will be made available to you, using Wireshark as well as extract specific information using bash scripting.
You are required to present your findings in a factual manner to convince decision-makers of a large corporation or a nation-state on operational strategies. Additionally, you are requested to produce proof of concept mitigations in the form of a simple bash script.

Task 1: Scenario

The UK government has made a decision to implement additional security measures to strengthen the security of its critical national information infrastructure in the wake of the current conflict in the region. The ministry of defense has received an intelligence report from one of the UK armed forces, the naval operation centre, which organises and mobilises the navy and some other forces. According to the report, there is a high possibility of an attack being launched against the Naval command and control base that coordinates with the other UK armed forces to protect the critical national information infrastructure from adversaries. Some suspicious activity that was recently recorded in the naval computer networks has furthered proven this. If the attack is successful, the UK's military capabilities will be significantly constrained, exposing it to greater risks. Therefore, the cybersecurity department of the ministry of defence has contracted a firm CyOps defence Corp., that specialises in developing offensive and defensive cyber operations strategies.

You work at CyOps as a security analyst. As part of the team, your role is to identify the potential threat, conduct a risk assessment and analyse the PCAP file that contains the activities within the naval computer network. you are required to produce a report containing the following elements.

Question 1. Identify the ICT assets that are critical to the navel operation. identify the potential threat (you can use automated threat modeling tools, like, Microsoft threat modeling tool, or manually draw one).

Question 2. based on the threat and criticality of the ICT assets provide a risk assessment. (YOU CAN USE ONE OF THE RISK ASSESSMENT FRAMEWORK, I.E. NIST)

Question 3. For the statistical analysis section, you are expected to use the automation provided by Wireshark under the ‘Statistics' drop-down menu. For the activity narrative section, you are expected to explain your thought process for identifying one attack, making references to specific packets in the provided PCAP file. For the technical explanation section, you are expected to provide a technical explanation of the identified attack, making references to good-quality sources.

Question 4. For the attack mitigation section, you are expected to synthesise and present your opinion of what controls you would deploy for preventing similar attacks from happening again and produce a simple proof of concept script.

Question 5. Your script must be able to execute on the lab's Kali Linux virtual machines and generate a report in the required format to be considered for marking. The script should solely implement defensive measures and not perform any reconnaissance, attempt to launch a reverse attack, or remove any content of the VMs.

Other than, the student ID, no further student identification should be included in the script. The script should include comments that explain what each line of code does. Academic misconduct will be deemed to exist if the script lacks supporting documentation and references (i.e., the lack of the URL of the original source of a code snippet as a comment at the end of the script).

The final report is an academic report and as such the following report structure is expected:
1. Introduction
The introduction should include, the scope of the document, a brief introduction to the situation, and what is the tasks assigned to your firm.
2. Body -
a. (Threat and risk assessment)
identify the ICT assets, identify the threat associated with them using the threat modeling method, Identify the critical information infrastructure, and conduct a risk assessment using one of the risk assessment frameworks.
b. (Statistical Analysis)
identify the network boundaries, network protocols, and internal and external nodes.
c. (Activity narrative and attack identification)
identify the suspicious activity in the network, and what makes them suspicious. Identify at least 3 attacks. Provide evidence of the attack identification, use screenshots of the packets you identified as attacks.
d. (Attack technical explanation)
How the attacks have been initiated. Technical explanation of the attack, and how they work.
3. Mitigation measures
What can you do to mitigate the attacks? strategies for the future and the measure you take during an active attack session.
4. References
5. Appendixes