IT Security in Higher Education Institutions

Whilst your target audience has some level of IT knowledge, they have employed you as the subject expert. Answers to each question should be provided at a level of technical detail sufficient to that target audience in the given scenario. You should apply the knowledge gained from the lectures, and complement this with your own research in order to demonstrate an understanding of the subject material, explaining the technology and how it applies to the context of the given scenario, providing suitable examples where appropriate.

Question 1: Computer Misuse Act

You have just started a new job at Ruskin University as a security specialist. Ruskin University has established a new branch in Ipswich and has hired over 200 new members of academic and non-academic staff. The new members of staff are hired from different countries with different backgrounds, rules, regulations, and security practices. This raises concerns about the security awareness of the new personnel and their understanding of digital offences in the United Kingdom.  As your first task, you have been asked to promote the security awareness of your new colleagues by creating an educational brochure that outlines the UK Computer Misuse Act 1990.

Your brochure should include the following:

• Various computer misuse offences under CMA with extensive details and examples related to the university environment. Details of each offence must be adopted and reinterpreted for the university environment.
• Jurisdiction for computer misuse offences under misuse Act.
• IMPORTANT: Your solution must be adapted to the university environment and use cases.

Question 2: Risk Assessment

You have been asked to conduct both quantitative and qualitative risk assessments for Ruskin University. Describe the steps that you must take to conduct risk assessment. Use the following imaginary network topology as a baseline to estimate the Ruskin University digital assets (hardware, software) and their average monetary values. Try to identify THREE security threats that might be critical to Ruskin University digital assets. Form your quantitative and qualitative risk assessment based on those security threats and offer mitigation plans for each.   

Question 3: Cryptography

At Ruskin University, you are responsible for safeguarding and protecting the sensitive and personal information of students and staff.

3.1 Outline how and where symmetric and asymmetric cryptography can contribute to the security of communications at Ruskin University? (Your solution must be technical, and it should be adopted to the University environment and use cases.  Elaborate your solution with examples, provide a comparison if required).  

3.2 Outline the possible risks and attacks that can be mitigated through various cryptographic frameworks?  (Your solution must be technical, and it should be adopted to the University environment and use cases. Elaborate your solution with examples).

3.3 Outline how PKI and Digital Certificates contribute to the security of the communications at Ruskin University? (Your solution must be technical, and it should be adopted to the University environment and use cases. Elaborate your solution with examples).

3.4 Outline how your solutions at 3.1, 3.2, 3.3 delivers CIA and AAA framework?

Question 2: Risk Assessment

Question 4: Incident Response Plan

You have been asked to develop an Incident Response Plan for the Ruskin University to protect the university assets and safeguard business continuity in the case of a disaster, cyber-attack, or critical failure. Elaborate your solution based on the NIST’s Computer Security Incident Response lifecycle.    

NIST’s computer security incident handling guide can be found here:

Question 5: OWASP Secure Coding

You have switched your job and now you are working as a security specialist in a software development company. Your company has recently signed a new contract with Anglia Council to develop a new highly secure cloud-based office management/accounting software system capable to handle highly confidential resident information, financial transactions, and their tax records. The system should allow residents to log-in to the system, upload and download documents, fill up online forms, contact consultants, and make online payments.     

Quality of Referencing

You are expected to thoroughly and accurately reference your report using the Harvard referencing style expected by Anglia University. The report should contain a minimum of 10 references, with up to 10 out of 100 marks available for the quality of referencing. 

Marks will be deducted for:

• lack of referencing in the text (in-text citation)
• Divergence from Harvard referencing style.

You are expected to compile a well-constructed, formal written report of no more than 2,000 words. Up to 10 marks are available for the presentation and layout of the report. The report should:

• be a formal report, written in the third person.
• have all figures and tables correctly labelled and referenced.
• be presented in a structured and meaningful way, with consideration for grammar, punctuation and spelling throughout, including the minimum components:

1.Cover Page to include:

• Module Title
• Course Code
• Your Student ID
• Date of Submission
• Word Count

2.Table of Contents

3.Body of your report

4.Any supporting diagrams and tables (make sure they are labelled)

The student will automatically be awarded a failure if:

• The report is not submitted within the University agreed timescales.
• The content of the report is meaningless in terms of the assignment.
• The work is not the work of the author and is presented as such.

Word Count

The word count is deliberately tight for this report. This is to get you thinking about how to best present information, including good use of tables and diagrams. In order to achieve this word count, you will need to provide concise answers. This may mean working out what information is important in the answer, and which information you need to discard. The report recommended word count is 2000 words, however, 20% leeway, either way, will be allowed. References should not be counted toward the total word count. Please include your word count on the cover page.

The report language must be a formal, written in the third person. have all figures and tables correctly labelled and referenced and be presented in a structured and meaningful way, with consideration for grammar, punctuation, and spelling.

Ensure your student ID is listed on ALL page’s header. Submission should be anonymous, so DO NOT include your name on any pages of your submission.