Assessment Mapping

After completing this assessment, the student will have met the following learning outcomes related to the graduate profile outcome.

Assessment information:

• This is a compulsory assignment with individual and team component.
• Read the scenario provided carefully on page 4 and 5.
• This assignment has 3 parts. Please see the table below for more details

• Correctly reference your used sources in-text and include a full reference list at the end of the part, using APA 7^thedition or IEEE guidelines.

Assessment submission instructions:

• Upload your Part A and C (Team Report, Investigative document and Peer Evaluation) form to the Moodle link “Upload Part A here” and “Upload part C here”.
• Part B is a presentation and there is no need for an upload.

Scenario

Read the scenario give below carefully:

After completing Unitec’s Diploma in Cybersecurity, you land a role with an IT Systems admin team at a medium-sized health provider in Auckland.

One day, a colleague from HR informs you that they clicked on a suspicious DocuSign hyperlink in an email, and are now suspecting it might have been a phishing attempt. This occurred in April 2023, but they didn’t think anything of it until having been present at a recent Cyber TTX where these exact vectors were being discussed.

They admit to being distracted and not thinking twice about it as they were expecting a similar DocuSign email at that time, and it really didn’t cross their mind until now.

Since this occurred, they’ve noticed a performance lag in their endpoint (Laptop) and are concerned.

Actions:

You take immediate action by isolating the device and handing it over to your managed DFIR team for analysis.

The DFIR team completes a triage and shares three key artifacts for your investigation:

1. The network PCAP file.
2. The potential malware binary (In hashed format)
3. The malicious email.

The company’s CISO wants you to thoroughly investigate these artifacts, looking for any evidence/ Indicators of Compromise (IOCs), and report your suspicions in a formal report not exceeding 3000 words.

Once completed, you and your team need to brief the executive on the Cybersecurity principles affected by the malware (CIA-AAA), suggest mitigation principles (like POLP, DID, Zero Trust), and explain the frameworks you would adopt, following this investigation. Top of Form

Bottom of Form

Part A                       

  [Total = 50 marks

Task 1

Instructions:

Commence an investigation with the three artefacts provided, looking for evidence of

malware existence and indicators of compromise:

• Task 1 marks are awarded via the report in Task 2. There are 50 marks in total to be awarded
• You will work in a team of 2 students to complete this task. If there is an odd number, the lecturer will approach those student(s) to ensure fairness.
• In this task your team will analyse the three artefacts provided in order to locate evidence and/or Indicators of compromise (IOC’s) to prove or disprove the existence of malware on the end point.
• These artefacts are:

1. 1. The network Packet Capture (PCAP) file.
2. The potential malware specimen (In hashed format only)
3. The suspicious email.

• Using best practice and the skills taught to you during this paper, examine these artefacts:

1. With the Suspicious email examination, examine the headers and obtain basic forensic information. Take notes and record the details.
2. With the PCAP file, examine the content and correlate the information with that found in the email. Take notes and record details.
3. With the Suspicious binary hash, use Virus Total and Any.Run to examine it. Report on the processes and beacons, IP addresses and domains called out to, Registry changes and what it actually does!

Task 2

Instructions:

Again, in your team, you must present your evidential findings from the three artefacts, in the form of investigative document/ report.  The suggested structure for the document is as follows:

• A title page
• Table of Contents
• Introduction
• Part A (Task 1) analysis of the three artifacts and robust reporting of any indicators located.
• Conclusion
• References
• Appendices (any other relevant document)
• There are 50 marks in total, 10 marks for the report structure and logic and 40 marks for the investigation from Task 1.
• Total word count for this part of the assignment is 3000 words [+/-10%], excluding reference list, table of contents, or any other administrative sections.

Part B: Task 1 – Presentation                         

[20 marks]

Part B Task 1

Instructions:

Once completed, you and your team need to brief the executive on three aspects:

1. The Cybersecurity principles affected by the malware (CIA-AAA)
2. Suggest 3 x mitigation principles (eg POLP, DID, Zero Trust),
3. Explain the frameworks you would adopt, following this investigation.

• Your team will present on three topics, the presentation itself must not exceed 15 minutes in duration and all team members must be involved.

• Topic 1 – Discuss how the malware impacted the Confidentiality, Availability and/or Integrity of the infosec System. Then consider the Authentication, Availability and Accounting of the network facing system.
• Topic 2 – Discuss three potential mitigation principals, such as (but not limited to), Principal of least privilege, Zero Trust, Defence in Depth.
• Topic 3 – Discuss the Security framework you consider should be adopted and explain why.
• You will apply personal and communication skills to present your analysis findings.
• You will not be marked individually, it’s a team effort so practice and take this seriously!
• Your presentation will be 10 minutes long allowing 5 minutes for each team member to speak, and additional question and answer time.
• You can prepare a visual presentation using Microsoft PowerPoint or similar software, however this is not mandatory.
• Your presentation will be recorded for marking and moderation purposes.
• Familiarise yourself with the attached observation checklist (page 9) to ensure you meet the requirements. Your lecturer will complete the attached observation checklist for each team member.

Part C: Peer evaluation                                                                             

Use this form to evaluate your peer. Write your name and the name of the person you are evaluating.

Peer Evaluation Form

Your name:

Team member’s name:

HTCS6701  Assessment 2 – Marking Scheme

Student Name:

HTCS6701 Assessment 2 Marking Rubric

Marking Rubric – Part A Task 2

50 Marks 

Assessment 2

Marking Rubric – Part B