Security evaluation assignment

Information Security 2020
Security evaluation assignment
Introduction
This is an individual assignment and requires students to conduct a security evaluation of their
personal information management situation and report on the results of this evaluation. The main
body of the report is expected to be around 2500 words but quality is more important than length.
The intention of this review is to give you exposure to some of the issues that organisations might
face when conducting such an information security review.
As it is not feasible to give you access to a ‘normal’ organisational setting, we will use your personal
situation as a simulation for the organisation. Despite this being similar to an organisational security
review, it is important that you treat the situation ‘as is’ – that is you should focus on the risks that
are relevant to your situation, not some pretend organisation. These risks may not be quite the
same to those that organisations experience, but risks do vary significantly between differing
organisations, so this should not cause too many issues with the integrity of this exercise.
The security evaluation review for this year will focus on some key issues, including backup and
recovery, access controls, protection from malware, and ensuring availability of a suitable computing
environment.
Requirements
This assignment is intended to cover the full range of your personal situation with respect to
information and its management – this will include any technology, insomuch as it relates to
information processing and storage (such as home computers, laptops and home networks; and any
mobile devices that you may have including smart phones, tablets, smart watches, and fitness
devices; and other home-related devices as appropriate – for example, smart TVs,
Google/Apple/Amazon smart home devices, and electronic locks) and any other storage media that
you use to store relevant information. Where you store personal information online (in the cloud –
data storage and email), you should include this in the review. There is no need with this review to
include information about you that is stored by others (for example, the University keeps
information on students, but this is not expected to be covered by this review). You should also
avoid including work related activity in this review.
The first step in the review is to identify all of the relevant information assets; any associated
technology resources; and what these resources are used for. It is important for your report to
include a description of these assets and their uses so that the reader has a context within which to
situate the investigation and its findings. The nature of these assets and their use will influence the
risk environment, so your overview is important for the reader to the make a judgement about the
reliability of the review and its findings.
In conducting such a review is common practice to have a normative model against which the
situation is assessed. You should use AS 27002:2015 as the primary source for constructing a
customised normative model for this review, but this should be supplemented by other sources as
appropriate (and these should be fully referenced). Note that it is important that the review extends
beyond the simple technical aspects of the situation, so the customised model should account for
non-technical aspects as well. Details on accessing AS 27002 can be found in the week 4 tutorial
work.
As noted above, the review for this year should focus on the issues of backup and recovery, access
controls, protection from malware, and ensuring availability of a suitable computing environment
(physical theft can be a consideration with some of these issues). These issues should become
primary headings in your normative model, and each of them should contain a number of controls
that would then form the basis of the normative model and subsequent evaluation.
The adaption of AS 27002 and other sources for the normative model to evaluate your
circumstances should be guided by risk management principles – that means selecting a set of
controls that are likely to be more important in a personal environment and leaving out controls that
are not all that relevant. As a guide for this assignment, it is expected that you would have around
15 to 20 controls in your customised normative model. These controls should have a link back to the
relevant control from your sources (such as AS 27002) so the reader knows where this element was
derived from.
To illustrate this process of adaption, Section 5 of AS 27002 covers issues associated with security
policy. For a personal situation, it would be quite unusual to have formalised written security
policies in place in relation to the issues of concern to this assignment – so the lack of such written
policies would not be a reasonable finding to make in most circumstances. However, it is quite likely
you might have some informal policies in place, such as who you might let use various facilities, what
security software you use, and how and when you backup your data. This suggests that it could be
helpful to have a general control in your adapted evaluation model relating to security policy, but
keep this at a high level and use it to consider whether your informal policies are adequate for the
situation at hand.
After constructing the customised normative model, you should use this to conduct a review of your
own personal information security situation and report on the findings and recommendations. In
conducting the review, you may find it helpful to undertake some tests to verify some of the
findings. As an example, you could physically check backup stores and verify that they keep the
most recent copies of the data, as per the backup arrangements that you think might be in place,
and that this backup data really is retrievable. You could also use various software tools to verify
security elements of the technical environment.
In making the findings and recommendations, you should be guided by the risk environment you are
operating in. For example, you would not make recommendations about implementing a rigorous
backup routine if you had little sensitive information to lose – you should suggest a contingency
approach that matches this risk profile. It is important to recognise that an overly stringent security
environment is likely to be just as problematic as one with insufficient security measures, as in the
longer term, many of these stringent security measures will be ignored or neglected if they are seen
as been unnecessary for the risk profile they are meant to be controlling.
After completing the review you should reflect on how well this whole process has worked.
Examples of the questions you may consider include: Is a review of this nature worth the effort?
Are there easier ways that could be used to provide reasonable assurance about information
security risks? Is it likely to uncover the main information security issues and make reasonable
recommendations for change? Has your adaption of the security model provided an adequate
coverage of the issues for a personal situation such as the one you are in? How easy would it be for
others (particularly people without a strong IT or security background) to use these materials to
assure themselves that they are not exposing themselves to unwarranted information security risks?
Chapter 7 and Appendix A from Whitman and Mattord (2011) provides some information on
conducting an information security assessment, although you should note that this is aimed more at
organisationally based situations. The normative model in Chapter 7 of Whitman and Mattord is
based on the NIST SP 800-53A publication, so while this could be a useful guide in developing your
normative model, care should be exercised as the intention with this assignment is to use AS 27002
as the primary source for this model. The normative model in Appendix A is loosely based on the
ISO 27000 series of standards so this could be used as a guide as to how the ISO 27002 model could
be customised for a particular situation. Note that this is based on an older version of the standard
and you will still need to undertake your own adaption of AS 27002. Whitman and Mattord make a
comment about the need for such an adaption in the box on p 88.
In summary, your report should include the following:
• an overview of your personal situation and the key risks areas that may be present;
• a brief discussion of the normative model that you have used for you review. This section is
mainly concerned with how you have constructed this normative model and why you have
included the various controls in the model, noting the various sources you have used;
• a summary of the tasks undertaken to conduct the review. What steps did you follow in
conducting the review? What evidence did you consider in helping you form your views?
What tests did you perform in order to verify the answers to key review questions? Did you
use any automated tools for any of this testing?
• the findings of your review and recommendations for improvement. You should provide a
summary of the good and bad issues that arose from the review. What issues from the
situation came up looking good in the review, and where was there room for improvement?
What things would you realistically change in order to improve the information security
environment? It is important that this section only presents a summary of the key issues
from the review – the details of the evaluation of individual controls should be put in the
appendix;
• a reflection on the methodology or review approach, following your experience of applying it
to your personal computing situation. This is an important part of the assignment and
should not be neglected. There are details above on what should be covered in this section
and a reasonable length for this section is around 500 words;
• an appendix with the details of your review. The detailed questions and issues considered
and the assessment against these issues should be included in an appendix in a table format.
This material is not part of the main word count for the assignment. While this appendix is
not part of the word count, this will be part of the assessment for the assignment and the
marker will need access to this material to ascertain the extent of the review that you have
undertaken. Without this table, there is little evidence that you have actually conducted an
appropriate security evaluation! A sample row from such a table is included below.
Assessment
The assignment is worth 30% of the marks for Information Security. The original deadline published
in the unit outline for submissions of this assignment was Sunday at the end of week 11 (26 April
2020). With the change to the semester arrangements, where an extra week has been added to the
mid semester break, this deadline has now been pushed out by a week until 11:59pm on 3 May
2020.
There will be opportunities for students to informally discuss issues with this assignment and their
review during the classes in the weeks leading up to the submission deadline. Make sure that you
are familiar with what is required of this assignment and take advantage of this opportunity. It is
also reasonable to use the discussion forum to post questions about the assignment, as other
students are also likely to be interested in similar questions.
The main body of the report is expected to be around 2500 words – please include a word count, but
words from any quotations, your bibliography, and the appendix with the review details, should not
be included in this word count. Note that it is not necessary to include an executive summary as this
report is sufficiently brief.
In marking the report, attention will be given to your understanding of information security concepts
and how well you have met the requirements detailed above. Style and technique of your writing
will also be considered.
The section providing a reflection on the methodology and review approach is an important part of
this assignment and will attract around one quarter of the marks allocated.
All work quoted from other written sources must be appropriately referenced using the UC version
of the Harvard author-date style (both with in-text references and all sources included in the
bibliography). This style is described in detail (including electronic sources) in referencing guides
available at: http://canberra.libguides.com/referencing
For the appendix only: It is quite likely that the material in this appendix will use headings and other
material taken directly from the AS 27002 standard. So long as you make it clear which parts have
been taken from the standard and which parts are your own responses, it is not necessary to put the
material from the standard in quotation marks. If you have not made this clear, the assignment may
be returned for resubmission (where the maximum attainable mark will be 18/30).
Submission: All assignments should be submitted in electronic format (via the Canvas online
assignment submission process). A coversheet is not required, but you should include your student
id, assessment item name and the word count.
Sample row for appendix
Note that this is a sample row only – the content of the cells in your review table is likely to be
different! As an example, this row could easily be split into two rows, one that considers the taking
of backups and a second one concerned with the testing of these backups. Note also that the text in
the first column has been taken directly from the AS 27002 standard, with the control number being
a sufficient attribution in this case (there should be a statement on this elsewhere in the appendix).
It is expected that you will have 15 to 20 rows of this nature in the appendix of your report.

References
NIST 2013, Special Publications SP 800 series, viewed 18 February, 2013,
<http://csrc.nist.gov/publications/PubsSPs.html>
Standards Australia 2015, AS ISO/IEC 27002:2015 Information technology – Security techniques –
Code of practice for information security controls, Standards Australia International, Sydney.
Whitman, ME & Mattord, HJ 2011, Roadmap to Information Security: For IT and InfoSec Managers,
Cengage Learning

The post Security evaluation assignment appeared first on My Assignment Online.

Expert Help With This Assignment — On Your Terms