Information Security 2016 Security evaluation assignment Introduction This is an individual assignment and requires students to conduct a security evaluation of their personal computing situation and report on the results of this evaluation. The main body of the report is expected to be around 2000 words but quality is more important than length. The intention of this review is to give you exposure to some of the issues that organisations might face when conducting such an information security review around the use of technology within the organisation.

Requirements This assignment is intended to cover the full range of your personal computing situation – this will include any home computers, laptops and home networks; any mobile devices that you may have including smart phones and tablets; and any other storage media that you use to store related information. Where you store personal information online, you should also include this in the review.

The first step in the review is to identify all of the relevant assets and any associated information resources that are to be considered by this assignment. It is important for your report to include a description of these assets so that the reader has a context within which to situate the investigation and its findings. You should also include an overview of what these assets are used for, as these uses will influence the risk environment. In conducting such a review is common practice to have a normative model against which the situation is assessed. You should use AS 27002:2015 as the primary source for constructing a customised normative model for this review. Note that it is important that the review extends beyond the simple technical aspects of the situation, so the customised model should account for non-technical aspects as well.

Doing a detailed review using all of the controls from AS 27002 would be far more work than would be normal for an assignment of this nature, so there is a need for students to be selective about which parts of the model they apply in the assignment. This could be achieved by omitting some parts of the model, or tackling some issues at a higher level (eg, by using the chapter heading as the basis for a broad set of comments about the particular issue). The adaption of AS 27002 to your circumstances should be guided by risk management principles – that means selecting a set of controls that are likely to be more important in a personal environment and leaving out controls that are not all that relevant.

As a guide for this assignment, it is expected that you would have around 20 to 30 controls in your customised normative model. These controls should have a link back to the relevant control from the AS 27002 standard so the reader knows which part of the standard this element was derived from.

To illustrate this process of adaption, Section 5 of AS 27002 covers issues associated with security policy. For a personal situation, it would be quite unusual to have formalised written security policies in place, so lack of such written policies would not be a reasonable finding to make in most circumstances. However, it is quite likely you might have some informal policies in place, such as who you might let use various facilities, what security software you use, and how you backup your data. This suggests that it could be helpful to have a general control in your adapted evaluation model relating to security policy, but keep this at a high level and use it to consider whether your informal policies are adequate for the situation at hand. After constructing the customised normative model, you should use this to conduct a review of your own personal information security situation and report on the findings and recommendations. In conducting the review, you may find it helpful to undertake some tests to verify some of the findings. As an example, you could physically check backup stores and verify that they keep the most recent copies of the data, as per the backup arrangements that you think might be in place. You could also use various software tools to verify security elements of the technical environment.

In making the findings and recommendations, you should be guided by the risk environment you are operating in. For example, you would not make recommendations about implementing a rigorous backup routine if you had little sensitive information to lose – you should suggest a contingency approach that matches this risk profile. After completing the review you should reflect on how well this whole process has worked. Examples of the questions you may consider include: Is a review of this nature worth the effort? Are there easier ways that could be used to provide reasonable assurance about information security risks? Is it likely to uncover the main information security issues and make reasonable recommendations for change? Has your adaption of the security model provided an adequate coverage of the issues for a personal situation such as the one you are in? How easy would it be for others (particularly people without a strong IT or security background) to use these materials to assure themselves that they are not exposing themselves to unwarranted information security risks? Chapter 7 and Appendix A from Whitman and Mattord (2011) provides some information on conducting an information security assessment, although you should note that this is aimed more at organisationally based situations. The normative model in Chapter 7 of Whitman and Mattord is based on the NIST SP 800-53A publication, so while this could be a useful guide to the issues that could be covered, it is not the model to use for this assignment. The normative model in Appendix A is loosely based on the ISO 27000 series of standards so this could be used as a guide as to how the ISO 27002 model could be customised for a particular situation. Note that this is based on an older version of the standard and you will still need to undertake your own adaption of AS 27002. Whitman and Mattord make a comment about the need for such an adaption in the box on p 88.

In summary, your report should include the following: • an overview of your personal situation and the key risks areas that may be present; • a discussion of the normative model that you have used for you review. This section is mainly concerned with how you have customised the AS 27002 model; • a summary of the tasks undertaken to conduct the review. What steps did you follow in conducting the review? What evidence did you consider in helping you form your views? What tests did you perform in order to verify the answers to key review questions? Did you use any automated tools for any of this testing?

• the findings of your review and recommendations for improvement. You should provide a summary of the good and bad issues that arose from the review. What issues from the situation came up looking good in the review, and where was there room for improvement? What things would you change in order to improve the information security environment? It is important that this section only presents a summary of the key issues from the review – the details of the evaluation of individual controls should be put in the appendix;

• a reflection on the methodology or review approach, following your experience of applying it to your personal computing situation. This is an important part of the assignment and should not be neglected.

• an appendix with the details of your review. The detailed questions and issues considered and the assessment against these issues should be included in an appendix in a table format. This material is not part of the main word count for the assignment. While this appendix is not part of the word count, this will be part of the assessment for the assignment and the marker will need access to this material to ascertain the extent of the review that you have undertaken. A sample row from such a table is included below.

Assessment The assignment is worth 30% of the marks for Information Security. The deadline for submissions is Sunday at the end of week 11 There will be opportunities for students to informally discuss issues with this assignment and their review during the classes in the weeks leading up to the submission deadline. Make sure that you are familiar with what is required of this assignment and take advantage of this opportunity. The main body of the report is expected to be around 2000 words – please include a word count, but words from any quotations, your bibliography, and the appendix with the review details, should not be included in this word count. Note that it is not necessary to include an executive summary as this report is sufficiently brief. In marking the report, attention will be given to your understanding of information security concepts and how well you have met the requirements detailed above. Style and technique of your writing will also be considered.

The section reflecting of the methodology and review approach is an important part of this assignment, and will attract around one third of the marks allocated.

All work quoted from other written sources should be appropriately referenced using the UC version of the Harvard author-date style (both with in-text references and all sources included in the bibliography). This style is described in detail.

For the appendix only: It is quite likely that the material in this appendix will use headings and other material taken directly from the AS 27002 standard. So long as you make it clear which parts have been taken from the standard and which parts are your own responses, it is not necessary to put the material from the standard in quotation marks. If you have not made this clear, the assignment may be returned for resubmission. Any work that includes material that has not been appropriately referenced (with quotation marks, an in text reference, and inclusion of the source in your bibliography) will be returned unmarked for resubmission. In such cases, the maximum mark that will be attainable will be 18/30. Submission: All assignments should be submitted in electronic format (via the Moodle online assignment submission process). A coversheet is not required, but you should include your student id, assessment item name and the word count. Sample row for appendix

Note that this is a sample row only – the content of the cells in your review table is likely to be different! It is expected that you will have 20 to 30 rows of this nature in your report. Control Comments about evaluations undertaken Tests Recommendations

12.3.1: Back-up copies of information, software and system images should be taken and tested regularly in accordance with agreed back-up policy. Informal policy in place for backing up important user data.

Laissez-faire approach adopted to implementing back-up policy, but most data is synchronised with cloud storage and backed up reasonably regularly. Current work of significance is emailed from work email to home email account after major edits. Minimal testing of back-up arrangements except when outages/losses are experienced. Back-up data stores viewed, with timing and frequency of backups considered. Formally integrate back-up schedule into electronic calendar to ensure more regular compliance with policy. Test back-up repositories from time to time to ensure stored data can be recovered.

References NIST 2013, Special Publications SP 800 series, viewed 18 February, 2013,

Standards Australia 2015, AS ISO/IEC 27002:2015 Information technology - Security techniques - Code of practice for information security controls, Standards Australia International, Sydney. Whitman, ME & Mattord, HJ 2011, Roadmap to Information Security: For IT and InfoSec Managers, Cengage Learning