Assessment Mapping

After completing this assessment, the student will have met the following learning outcomes related to the graduate profile outcome.

 Assessment instructions:

• This is individual and compulsory assessment.
• Read the scenario provided carefully on page 3.
• Your analysis should be research based and findings must be presented in form of report.
• Correctly reference your used sources in-text and include a full reference list at the end of the report, using APA 7^thedition or IEEE guidelines.
• Report must have formal structure with a count of 2000-2500 words [+/- 10%], excluding reference list, table of contents, or any other administrative sections.
• Your report must be professional and organized. A recommended format for the report is:

a. Executive Summary
b. Table of contents
c. Introduction
d. Analysis (section 1 and 2)
e. Conclusion
f. References

Assessment submission instructions:

• Your report must be presented in the format stated above and must have margins and page numbers.
• Upload your report to the Moodle link “Upload Report here”.

Read the scenario given below carefully

You have just completed the ‘New Zealand Diploma in Cyber Security (Level 6)’ from Unitec, Auckland and have landed with a job at Google as a Security Analyst on their SOC team. Late one night, you are investigating an alert and upon auditing the email logs, you see communications between the CISO and a Russian Actor. Upon review, it appears that the CISO has fallen for a phishing attack, data has been breached and they want BTC in return.

You contact the CISO who admits falling for the attack and having knowledge about the breach. He’s been dealing with APT-1, a hacking group dealing in data breaches, in an attempt to get the data back.

Apparently they have Google’s data with 1.5 million clear-text user names and passwords, via a phishing attempt targeting an unpatched Microsoft IIS server [GOOG-2265456]. APT-1 have provided proof and the CISO tells you they have been in the system since January. The attack vector was via a phishing attempt and he was the one to click the link.

He is considering whether to disclose the breach or keep it quiet as no one knows yet except for you.

He has asked you to quietly conduct a security audit on the company’s infrastructure to check for any signs of malware and to ensure the malware has really gone.  He warns you to be careful about making any mistakes as he does not want the situation to worsen and asks that you just check the processes and memory, looking for indicators of compromise.

Google has clients throughout Europe, the United States, New Zealand and other developed nations.

He tells you that he has been offered the data back from the hackers, via encrypted email. The hackers are known as APT1 and have demanded $10 Million NZD-BTC in return for the information and if the money is not paid, the data will be dumped on the Dark Web for Auction. This could affect public confidence, perceptions and reputation as well as potentially opening the way for various legal and civil issues. It could also impact his position within the company.

He trusts you as a recent graduate of the New Zealand Diploma in Cybersecurity to have the knowledge, ability and discretion to assist him. He asking you to conduct an analysis of the impact with legal, privacy, reputational and ethical factors on the Google’s information system security decisions and present the findings in form of report on his desk by 8AM Monday the following week.

You commence an audit of GOOG-2265456 and see an interesting file hidden in a file-share named ‘APT-finance.docx’. Upon clicking this document, the server begins to respond slowly and you can see file extension names being changed to ‘.Lockbit’. You decide to quickly shut down the GOOG-2265456 and delete the logs in an attempt to stop the spread and to cover it up.

In your report to Google, you must include the following:

Section 1. The Initial data breach and the obligations to disclose

Question 1                                                                                                     

[20 marks]

• Analyse the impact to both Google and the CISO personally as to the discission as to disclose or not disclose the initial data breach (considering legal, civil, privacy, reputational and ethical factors)

Your response must include the relevant parts and/or principals of any acts that govern the Google data (either at rest or transit).  Refer to National and International Law, treaties and/or other aspects).

Question 2                                                                                                     

[10 marks]

• Analyse the various penalties for non-disclosure when sustaining a data breach and back this up with a brief case study.

In your analysis refer to National and International law and/or other aspects.

Question 3                                                                                                     

[10 marks]

• Analyse any legal and/or work-related impact for the CISO who introduced the malware to the network. This is the person who clicked the hyperlink and as a result, infected the company servers with the malware.  Also consider his current position of wanting it kept quiet. Consider legal, ethical and reputational damage.

Section 2. The Audit of the company’s infrastructure

Question 1                                                                                                     

[15 marks]

• Based on the likelihood of you now introducing malware into the impacted server, analyse any legal, reputational and ethical fall-out (impact) on you and google for going out of scope in this engagement. Research a brief case study to underscore your findings.

Question 2                                                                                                     

a. Analyse the ethical differences between the three hacking hats and comment on where your own actions put you. [10 marks]

b. Recommend on whether the CISO should pay for the data to be returned. [10 marks]

Marking Scheme

 Assessment 1 Marking Rubric