ICT5350 Securing IT Systems Assessment 3

Assessment Overview

• Weighting: 40% of unit total
• Due Date: Week 12, Monday, 15/12/2025, by 23:55 AEDT
• Assessment Type: Individual assessment
• Word Count / Length: 2500 words +/- 10%

Unit Learning Outcomes

In this assessment, you will be tested on whether you have successfully met the following Unit Learning Outcomes (ULOs):

• ULO2: Justify strategies and measures to safeguards IT systems to mitigating risk and controls losses associated with adverse events.
• ULO4: Diagnose the cause of security incidents.
• ULO5: Develop a security incident response plan.

Submission Type and Required Format

The type of assessment you will be completing is a Case Study Analysis and including the Advanced Cybersecurity Incident Response Plan.

It should include the following:

• A detailed strategy encompassing roles and responsibilities, communication protocols, operational procedures, and technical analysis.
• Reference to the incident response template from the Australian Cyber Security Centre.
• A plan that is detailed, actionable, and grounded in best practices for incident management and response.

Assessment Details

Assessment Purpose

This assessment requires you to act as a senior cybersecurity analyst tasked with managing and reporting on a major security breach. You will develop a comprehensive incident response plan and conduct a practical forensic analysis based on a detailed case study. This capstone assessment challenges you to integrate the strategic, procedural, and technical skills developed throughout this unit, from high-level policy to command-line analysis.

Assessment Instructions

Case Study Scenario: The "FinSecure" Data Breach

Background: FinSecure is a promising Australian FinTech startup that provides a service for fraud detection using a proprietary Federated Learning (FL) model. On November 1st, 2025, the company's CTO was alerted to anomalous network traffic by their cloud provider. An initial investigation suggests that an unauthorized actor has been present in their network for several weeks.

Key Findings:

• The attacker appears to have gained initial access through a misconfigured development server running an old version of vsftpd (FTP server).
• Sensitive data, including parts of a proprietary machine learning dataset, was exfiltrated. The exfiltrated data was stored in a plaintext format.
• Network logs show evidence of extensive internal network scanning originating from the compromised server before the data was exfiltrated.
• The attacker attempted to cover their tracks by spoofing internal IP addresses to poison the ARP cache of other servers.

As the lead analyst, you must now produce a detailed report for the executive team that outlines the incident response process and provides a technical breakdown of the attack.

Assessment Tasks

Your report must be structured into two main parts:

Part A: Strategic Incident Response Plan
This section covers the high-level governance and procedural aspects of the response.

1. Roles, Responsibilities, and Communications:
   • Define the roles and responsibilities of the key personnel (e.g., Incident Commander, CIRT, Technical Lead) in response to the FinSecure breach.
   • Develop a comprehensive communication plan detailing how, when, and what will be communicated to internal stakeholders (e.g., employees, executives) and external parties (e.g., customers, the Australian Cyber Security Centre (ACSC), the Office of the Australian Information Commissioner (OAIC)).
2. Containment, Eradication, and Recovery:
   • Outline the immediate steps to contain the breach and prevent further data loss.
   • Detail a comprehensive remediation action plan for both immediate and long-term actions (e.g., server hardening, patch management).
   • Create a practical recovery plan that ensures business continuity, including 'stand down' procedures for when the incident is officially closed.

Part B: Practical Forensic & Technical Analysis
This section requires you to perform practical tasks based on the skills learned in your workshops. You will need to apply these skills to the FinSecure scenario and embed the results (commands, rules, screenshots, and analysis) in your report.

1. Task 1: Reconnaissance Analysis (Skills from Workshop 8)
   • Based on the scenario, the attacker performed internal network scanning. Explain how an attacker would use Nmap for this purpose. In your report, provide and explain the exact Nmap commands an attacker would use to:
     • Discover other live hosts on the FinSecure internal network.
     • Conduct a TCP SYN scan to identify open ports on a discovered server.
2. Task 2: Intrusion Detection and Traffic Analysis (Skills from Workshops 3 & 4)
   • The breach involved an exploit against an FTP server. To help FinSecure's security team detect similar future attacks, you must write a custom Snort rule.
     • Write one custom Snort rule that would trigger an alert if an anonymous login attempt is made on any FTP server within the network's home subnet. Include the complete rule in your report.
   • During their investigation, the FinSecure team captured network traffic from the compromised server. Explain how you would use Wireshark to identify the initial HTTPS connection to the attacker's command-and-control server. What specific display filter would you use, and what three TCP messages would you expect to see in a successful three-way handshake?
3. Task 3: Post-Incident Hardening Recommendation (Skills from Workshop 7)
   • The case study notes that the exfiltrated data was in plaintext. As a key recommendation, you must demonstrate the importance of encryption.
     • Implement the Caesar cipher in a programming language of your choice (e.g., Python). Your program should allow a user to either encrypt or decrypt a message.
     • Include your fully commented source code as an appendix to your report. In the main body of your report, briefly explain how applying fundamental encryption principles would have mitigated the impact of this data breach. Detail the steps for containing the Federated Learning incident, including preserving digital evidence for forensic analysis, and develop a comprehensive remediation action plan addressing immediate and long-term actions.

Artificial Intelligence (AI) Use

In this assessment, the use of generative artificial intelligence (AI) tools is PERMITTED. You can use AI tools to assist with:

• Generating and modifying text related to planning and brainstorming ideas for your assessment.
• Researching topics and preparing assignments, but all AI-generated content must be acknowledged in the final report using the specified format.
• You CANNOT include any AI-generated material in your final report directly without modification or proper acknowledgement.

Example tools might include:

• ChatGPT
• Google Gemini

Students take full responsibility for the content of their assessments, and AI tools should be used as a supplement to your own research and analysis rather than as a replacement. If you use AI tools in an unethical or irresponsible manner, such as copying AI-generated output without checking it against reliable sources, you risk committing academic misconduct. Any use of AI must be appropriately acknowledged in the AI declaration on the Assessment Cover Sheet.

Refer to the Using AI page on the ECA Library and Learning Support website for further guidance.

Other Important Information

Assessment Resources

It is strongly recommended that you use the following to find academic peer-reviewed sources of information.

• ECA Library catalogue and databases
• Unit Readings (Course Reserves) [The link to unit’s Course Reserves]
• Subject Guide: ICT5351 [The link to a subject guide]

For in-text citation and referencing, follow the ECA HE Student Guide to APA 7th Referencing.

Submission Requirements

On completion of your assessment:

• Follow the Assessment Presentation Guidelines.
• Submit your document as a PDF or MS Word document via the assessment submission link in Canvas.
• Include a completed Assessment Cover Sheet, including the AI Declaration, and attach it to the assessment.
• Save drafts of your work.

Assessment Support

• For academic support or feedback on a draft of your assessment, please email [email protected]
• For assistance with finding resources, such as books and journal articles, please email [email protected]
• For information and guides on tackling assessments and developing your academic skills, please visit in the ECA Library and Learning Support website: https://eca.libguides.com/
• For queries about this specific assessment task, please contact the Unit Coordinator.

Assessment 3 Rubric

Criteria (weighted as indicated below)

High Distinction (HD) 85-100

Distinction (D) 75-84

Credit (C) 65-74

Pass (P) 50-64

Fail (F) 0-49

Criteria 1: Incident Management Framework (20%)

Presents an exemplary and highly integrated plan, clearly defining roles, responsibilities, and a sophisticated, multi-channel communication strategy tailored to all stakeholders.

Presents a clear and effective plan defining roles and a comprehensive communication strategy with minor areas for improvement.

Defines key roles and presents a functional communication plan, though it may lack detail for specific stakeholder groups.

Outlines basic roles and a generic communication plan that is not well-integrated with the case study.

Fails to define roles or provide a coherent communication plan.

Criteria 2: Technical Analysis & Detection (30%)

Demonstrates mastery of practical tools. The Nmap/Scapy commands and Snort rule are syntactically perfect and highly effective for the scenario. Wireshark analysis is deep and insightful.

Demonstrates strong proficiency. The provided commands and rules are correct and well-explained. Wireshark analysis is accurate and detailed.

Demonstrates good understanding. Commands and rules are mostly correct but may contain minor errors or lack optimal configuration. Analysis is sound but may lack depth.

Demonstrates basic awareness. Commands and rules are attempted but may be syntactically incorrect or not fit for purpose. Analysis is superficial.

Fails to provide correct commands/rules or demonstrates a fundamental misunderstanding of the tools and their application.

Criteria 3: Containment, Eradication & Recovery Strategy (20%)

Proposes a highly effective, multi-layered strategy for containment, eradication, and recovery that is both robust and practical for the scenario, considering business continuity constraints.

Proposes a clear and logical strategy that effectively covers all phases from containment to recovery, with strong justification for actions.

Proposes a sound strategy, though some elements may be generic or less detailed. The plan is logical but could be better tailored to the case study.

Outlines a basic strategy but it may be incomplete, lacking detail, or impractical for the given scenario.

The proposed strategy is incoherent, ineffective, or missing entirely.

Criteria 4: Post-Incident Recommendations & Procedures (15%)

Provides insightful, forward-looking recommendations. The appended cipher code is well-structured, fully functional, and expertly commented, demonstrating a superior grasp of encryption principles.

Provides clear and relevant recommendations. The appended code is functional and well-commented, effectively demonstrating the required encryption concepts.

Provides sensible recommendations. The appended code is functional but may have minor issues with structure or commenting.

Provides generic recommendations. The appended code is attempted but may be non-functional or poorly explained.

Fails to provide meaningful recommendations or submit the required practical code demonstration.

Criteria 5: Report Professionalism & Referencing (15%)

Exemplary report: professionally structured, exceptionally clear, and written with a sophisticated analytical tone. Flawless referencing with a wide range of high-quality sources.

Well-structured and clearly written report. Referencing is accurate with only minor formatting errors. Cites a good range of credible sources.

The report is structured logically but may have some issues with clarity or conciseness. Some referencing errors are present.

The report structure is difficult to follow. Frequent errors in referencing. Sources may be limited or of low quality.

Poorly written report with a lack of structure. Fails to use credible sources or apply referencing correctly.