ICTCYS606 1

Student Assessment Guide: ICTCYS606 Evaluate an organisation's compliance with cyber security standards and law

ICT60220 Advanced Diploma of Information Technology (Cyber Security) Student Assessment Guide: ICTCYS606 Evaluate an organisation's compliance with cyber security standards and law Student Assessment Guide: ICTCYS606 Version: v21.0 Page 2 of 42 Developed by: ACBI Approved by: DoS Issued: April 2022 Review: April 2022

ICT60220 Advanced Diploma of Information Technology (Cyber Security) Student Assessment Guide: ICTCYS606 Evaluate an organisation's compliance with cyber security standards and law Content s ICTCYS606 Evaluate an organisation's compliance with cyber security standards and law ................................................................................................................................................ 1 1. Assessment Information ............................................................................................................ 4 A. Purpose of the assessment .................................................................................................... 4 B. What you are required to do ................................................................................................ 4 C. Competencies being assessed ................................................................................................ 4 D. Important resources for completing this assessment ......................................................... 5 E. A note on plagiarism and referencing ................................................................................. 5 F. A note on questions with role plays ...................................................................................... 5 G. Instructions for completing this assessment ....................................................................... 6 2. Assessment Coversheet .............................................................................................................. 7 ICTCYS606 Evaluate an organisation's compliance with cyber security standards and law ................................................................................................................................................ 7 3. Assessment Questions ................................................................................................................ 8 A. Task A - Demonstrate knowledge of cyber security standards and laws ......................... 8 B. Task B - Research Cyber security standards and laws in organization ......................... 24 C. Task C - Analyse the implementation of cyber security standards and laws in organization .............................................................................................................................. 29 D. Task D - Implement and align organization with the standards and laws .................... 33 4. Student Self Checklist .............................................................................................................. 42 A. Student Self Checklist for Tasks A - D .............................................................................. 42 Student Assessment Guide: ICTCYS606 Version: v21.0 Page 4 of 42 Developed by: ACBI Approved by: DoS Issued: April 2022 Review: April 2022

ICT60220 Advanced Diploma of Information Technology (Cyber Security) Student Assessment Guide: ICTCYS606 Evaluate an organisation's compliance with cyber security standards and law 1. Assessment Information A. Purpose of the assessment This assessment will develop your skills and knowledge required to understand the cyber security laws and standards and their value in compliance. B. What you are required to do For this assessment, you are required to complete 4 tasks:  Task A – Demonstrate knowledge of cyber security standards and laws  Task B –Research Cyber security standards and laws in organization  Task C – Analyse the implementation of cyber security standards and laws in organization  Task D – Implement and align organization with the standards and laws Tasks B, C and D of this assessment require you to use the provided case study information relating to the fictional company UniqueStore. C. Competencies being assessed Elements To achieve competency in this unit you must demonstrate your ability to: 1. Understand Cyber security standards and laws 2. Analyze Cyber Security standards and laws 3. Plan and implement Cyber security standards and laws Performance Evidence Evidence of the ability to:  identify cyber security standards and laws and analyse an organisation’s operations and compliance to required laws and standards on at least one occasion. Knowledge Evidence Student Assessment Guide: ICTCYS606 Version: v21.0 Page 5 of 42 Developed by: ACBI Approved by: DoS Issued: April 2022 Review: April 2022

ICT60220 Advanced Diploma of Information Technology (Cyber Security) Student Assessment Guide: ICTCYS606 Evaluate an organisation's compliance with cyber security standards and law Your Trainer & Assessor will also observe your meeting for Task D, Question D2 and complete an observation checklist. Please note: You will also need to attend separate meetings organised by other students whereby you role play being other people. This allows other students in your unit to also role play being the CTO and Operational Manager. You do not need to take notes at meetings during which you are not role playing being the CTO. G. Instructions for completing this assessment Answer the questions below using the spaces provided:  Answer all parts of each question  Use your own words and give examples wherever possible  The quality of your answer is more important than how long it is  Enter your answers in this document You may use various sources of information to inform your answers, including your resources provided by ACBI, books, and online sources. You must acknowledge and cite your sources. Submission via Moodle Please refer to the “Instructions for Submitting Your Assessment” found within the unit course page on Moodle. NOTE: Please take care to follow all instructions listed. Assessments uploaded with a draft status on Moodle may not be graded. Student Assessment Guide: ICTCYS606 Version: v21.0 Page 7 of 42 Developed by: ACBI Approved by: DoS Issued: April 2022 Review: April 2022

ICT60220 Advanced Diploma of Information Technology (Cyber Security) Student Assessment Guide: ICTCYS606 Evaluate an organisation's compliance with cyber security standards and law 2. Assessment Coversheet 3. Assessment Questions A. Task A - Demonstrate knowledge of cyber security standards and laws Student Assessment Guide: ICTCYS606 Version: v21.0 Page 8 of 42 Developed by: ACBI Approved by: DoS Issued: April 2022 Review: April 2022

ICT60220 Advanced Diploma of Information Technology (Cyber Security) Student Assessment Guide: ICTCYS606 Evaluate an organisation's compliance with cyber security standards and law A3. What is Risk management? What are key principles of risk management? Answer in 120-150 words. Risk Management - The process of discovering, evaluating, and controlling risks to an organization's resources and profits is known as risk management. Key principles of Risk Management  Early identifications of the risks - Measure the risk by determining its source, developing preventative measures, and planning a response in the event that it materialises.  Risks involved in Organization Goals and objectives - Make sure your organization's general goals and objectives are aligned with your risk management plan.  Managing risks within the context - Since each organisation will have a varied level of risk tolerance, context is crucial when analysing project risk. Different causes will have varying effects on organisations and industries.  Stakeholders Involvement - It is crucial to enlist the assistance of project participants as well as internal organisation experts who can advise you on risk management strategies. A4. What does it mean by tolerance of risk in an organization? Answer in 40-80 words. Risk Tolerance - A critical consideration when making risk-based decisions, risk tolerance is a measurement of the amount of risk that an organisation is ready to accept. It can be stated in qualitative or quantitative terms. Organizations must decide what categories and what degrees of risk are acceptable. To Student Assessment Guide: ICTCYS606 Version: v21.0 Page 10 of 42 Developed by: ACBI Approved by: DoS Issued: April 2022 Review: April 2022

ICT60220 Advanced Diploma of Information Technology (Cyber Security) Student Assessment Guide: ICTCYS606 Evaluate an organisation's compliance with cyber security standards and law maintain uniformity throughout the firm, risk tolerance is set as part of the organisational risk management plan. A5. What laws in Australia are related to the cyber security? Provide brief description of these laws. Answer in 200-250 words. Privacy act 1988 - The Privacy Act of 1988 is the main law in Australia that governs the management of personal data about people. This covers both the federal public and private sectors' acquisition, use, storage, and disclosure of personal information. Gramm-Leach-Bliley Act Of 1999 – The Gramm-Leach-Bliley Act created guidelines for financial organisations' use of client information. All businesses that are "significantly engaged" in offering customers financial products and/or services are subject to the law. Children’s Online Privacy Protection Act Of 1998 – The Children's Online Privacy Protection Act (COPPA) gives parents choice over how their children's information is shared in order to safeguard children under the age of 13. The telecommunication act 1979 – The Act permitted a corporation to possess up to 4 stations in a single market and removed a limit on national station ownership. The security of critical infrastructure act 2018 - The Security of Critical Infrastructure Act 2018 aims to control the intricate and changing national security dangers presented by foreign interference in Australia's critical infrastructure, including sabotage, espionage, and coercion. A6. Describe ISO standards in relation with cyber security and governance. Answer in 200-250 words. Student Assessment Guide: ICTCYS606 Version: v21.0 Page 11 of 42 Developed by: ACBI Approved by: DoS Issued: April 2022 Review: April 2022

ICT60220 Advanced Diploma of Information Technology (Cyber Security) Student Assessment Guide: ICTCYS606 Evaluate an organisation's compliance with cyber security standards and law computer or to a data storage device. The prevention of any such communication over an electronic link or network utilised by the computer, such as the alteration or removal of the data an addition to the data, constitutes unauthorised modification of data with the intent to impair- impairing electronic communication to or from a computer. Financial offences are covered in Part 10.8.  ADI refers to a business that complies with the Banking Act of 1959's definition of an ADI.  Dealing in personal financial data entails providing or utilising financial data.  Deception is the intentional or careless use of words or other behaviour to deceive.  Possession or creation of personal financial information is considered to be obtaining personal financial information.  Information about a person that could be used to obtain finances, credit, or other financial benefits is referred to as personal financial information. A8. Describe PCI DSS and its main features. Answer in 200-250 words. PCI DSS - "Payment Card Industry Data Security Standard" is what this acronym stands for. In order to maintain a secure environment, ALL businesses who take, handle, store, or send credit card information must adhere to this set of security standards. American Express, Discover Financial Services, JCB International, MasterCard Worldwide, and Visa Inc. International are members of the PCI Security Standards Council, which created it. All companies that store, process, or transmit cardholder information are subject to the standard. Features of PCI-DSS  For processing credit card transactions, IS&T offers a secure transmission infrastructure.  Wherever it is kept, cardholder data is secure.  Access to cardholder data is constrained to those who have a business need-to-know.  The most recent anti-virus software safeguards systems. Student Assessment Guide: ICTCYS606 Version: v21.0 Page 13 of 42 Developed by: ACBI Approved by: DoS Issued: April 2022 Review: April 2022

ICT60220 Advanced Diploma of Information Technology (Cyber Security) Student Assessment Guide: ICTCYS606 Evaluate an organisation's compliance with cyber security standards and law  Networks are tested and monitored to ensure that security precautions are in place and working properly. A9. Describe the Essential Eight Security model. Answer in 200-250 words. Essential Eight Security Model – Application Control - The programmes that can run in your environment and who can run them are controlled by application control. Application Patching - Application patching makes sure all software services have all the latest updates installed, keeping productivity systems safe and functional. With the third blog in this series, you may mature your approach to application patching. Microsoft office Macro Configuration - Microsoft Office macro settings should be configured based on the origin, trust, and users of the macros. This is the superior approach. The fourth blog in this series explains the way to the most advanced Microsoft Office Macro settings. Hardening of User Application - By removing unused and unsafe features and settings, user application hardening increases the security of a given application. With the series' fifth blog, improve the hardening of your applications. Administrative Privileges Restrictions – Restricting administrative privileges meets the principles of least privilege and zero trust by applying the logic that you should never grant access to anyone who doesn't require it. Operating Systems Patching – Operating system patches protect the platforms on which we work. You must also consider the operating systems that are used by the other devices outside servers, desktops, and laptops when deciding whether to run Windows, Mac, or Linux. Multi-Factor Authentication – By combining many simple secondary identification methods, such as apps, SMS codes, or even biometrics, Multi-Factor Authentication increases the level of confidence for access and identity management. Student Assessment Guide: ICTCYS606 Version: v21.0 Page 14 of 42 Developed by: ACBI Approved by: DoS Issued: April 2022 Review: April 2022

ICT60220 Advanced Diploma of Information Technology (Cyber Security) Student Assessment Guide: ICTCYS606 Evaluate an organisation's compliance with cyber security standards and law The phrase "data governance" is used both at the macro and micro levels. Protecting important data assets and ensuring that high-quality data is available to the appropriate people at the appropriate time are the shared objectives of data governance and cybersecurity. Proper data handling can have a tremendous impact in a world where privacy laws and big data are becoming more and more important. Data governance is essential to carrying out security plan. Organizations must first understand who manages the data and where it is located in order to protect sensitive data and adhere to complicated requirements. The danger of a data breach is lower when data is organised properly, and when security problems do happen, it makes forensics easier. A12. Describe security requirements to protect business processes in an organization. Answer in 200-250 words. Business owners are required by law to safeguard data and maintain the confidentiality of client information. You need policies that abide by the laws on privacy, spam, and electronic transfers if you want to protect your online clients. Policies may include:  data privacy for customers  code of behaviour  operational procedures. Security specifications should specify how your company gathers, keeps, and uses data from third parties.  Physical security measures might include security guards, alarm systems, bar-coded or biometric door locks, restricted access areas, and security personnel.  Limit access to the data to protect it. Authorizations at the username-level and password-level can reduce access by unauthorised personnel.  Securing equipment physically might help to safeguard your business. As a result, some equipment, including computers and printers, may need key locks.  Documents ought to be kept in a safe location that is only accessible to authorised staff members. There should be an electronic copy of every document. Authorized personnel should be given photocopies or electronic copies as needed. Student Assessment Guide: ICTCYS606 Version: v21.0 Page 16 of 42 Developed by: ACBI Approved by: DoS Issued: April 2022 Review: April 2022

ICT60220 Advanced Diploma of Information Technology (Cyber Security) Student Assessment Guide: ICTCYS606 Evaluate an organisation's compliance with cyber security standards and law A13. Would there be security requirements specific to a process or you will prefer to implement security governance guidelines that are implemented across the organization? Discuss. Answer in 200-250 words. Information security operations should be governed in accordance with all pertinent requirements, such as governing laws, rules, and corporate policies. A framework for information security governance should be established with the participation of senior managers.  Information security tasks must be delegated to and carried out by people who have received the necessary training. They must be made to answer for their deeds or lack thereof.  To guarantee a successful execution of an information security programme, information security priorities should be conveyed to stakeholders at all levels of an organisation.  Information security operations must relate to other business management tasks like enterprise architecture, capital planning, and strategic planning.  The organisational structure supporting information security should be suitable for the organisation it supports and should change with the organisation.  Information security managers should use the tools and data at their disposal to regularly assess how well the security programme they are in charge of is performing.  To influence the improvement of security posture and the overall performance of the organisation, monitoring information should be used as an input into management choices about priorities and money allocation. A14. Describe principles of cyber security to protect an organization from compliance perspective. Answer in 200-250 words. Student Assessment Guide: ICTCYS606 Version: v21.0 Page 17 of 42 Developed by: ACBI Approved by: DoS Issued: April 2022 Review: April 2022

ICT60220 Advanced Diploma of Information Technology (Cyber Security) Student Assessment Guide: ICTCYS606 Evaluate an organisation's compliance with cyber security standards and law  business continuity and disaster recovery plans must be implemented as needed. A15. Describe the CIA (confidentiality, integrity, availability) Triade. Answer in 200-250 words. Confidentiality - Measures to maintain confidentiality are intended to stop unlawful information dissemination. The confidentiality principle's goals are to maintain the privacy of personal information and guarantee that only the people who require it to carry out their organisational duties can see it and access it. Integrity - The integrity principle guarantees that data is accurate and trustworthy and is not improperly manipulated, whether intentionally or unintentionally. Availability - The goal of availability is to make the technological foundation, the applications, and the data accessible when they are required by a business process or by its clients. A16. What is a cyber security incident? Answer in 200-250 words. Cyber Security Incident - Any attempted or actual unauthorised access, use, disclosure, alteration, or destruction of information constitutes a security event. This involves interfering with IT operations and breaking school rules, laws, and regulations. A cyber security incident is defined as one or more acts, events, or circumstances involving any one or more of the following:  unauthorised access to or modification of computer data  unauthorised impairment of electronic communications to or from a computer  unauthorised impairment of the availability, reliability, security, or functionality of computer data, a computer programme, or a computer.  Unauthorized use of, access to, or alteration of systems, software, or data are all examples of computer system breaches. Student Assessment Guide: ICTCYS606 Version: v21.0 Page 19 of 42 Developed by: ACBI Approved by: DoS Issued: April 2022 Review: April 2022

ICT60220 Advanced Diploma of Information Technology (Cyber Security) Student Assessment Guide: ICTCYS606 Evaluate an organisation's compliance with cyber security standards and law  Equipment storing institutional data is lost or stolen  A denial-of-service attack is launched  IT resources are not used as intended  Compromised user accounts are used A17. Describe MAPE-K. Answer in 200-250 words. The MAPE-K was created to control how autonomic systems respond. The Monitor step gathers data from controlled resources and looks for circumstances that call for modifications. The data is examined to see whether adjustment is required to meet system objectives. If an adjustment is required, the Plan stage develops a method to achieve a new target state that satisfies the objectives. Finally, the planned method is carried out on the resources under management. A set of requirements that the MAPE-K loop uses to determine adaption parameters and tactics make up the Knowledge component. The Monitor, Analyze, Plan, Execute and Knowledge (MAPE-K) model, a commonly used reference model in autonomic computing, is adhered to by the adaption loop. The knowledge base built on ontologies provides information for security adaption. The knowledge base for the security adaption is the Information Security Measuring Ontology (ISMO). The ISMO is useful both during design and during operation. The ISMO provides information to the software architect at the design stage so they can incorporate security adaption elements into their programme. A18. What is SIEM and what SIEM tools you ae aware of? Describe at least three tools. Answer in 200-250 words. Security Information and Event Management, or SIEM, is a collection of technologies and Student Assessment Guide: ICTCYS606 Version: v21.0 Page 20 of 42 Developed by: ACBI Approved by: DoS Issued: April 2022 Review: April 2022