here is my report brief, it's 3000 words:
"""
Please refer to the Case Study.
Part A
You are expected to research the state of the art,
identify, and critically compare the most widely
used incident response methodologies
developed for both the industry and academia.
Part B
You are required to develop a Standard
Operating Procedure (SOP) that works for the
given scenario. The SOP should use specific
examples that will allow you to respond to the
potential cyber security incident as outlined in the
case study section.
You must include specific tools in your SOP.
"""
Learning objectives:
"""
1 - Critically evaluate the operation of a cyber
incident response plan.
2 - Investigate digital artefacts against a realistic
brief, preserving, analysing, interpreting, and
reporting significant material.
3 - Critically evaluate the significant
characteristics of relevant tools and techniques.
"""
Case study:
"""
Arts & Co’ is a media business that specialises in digital marketing. It belongs to the medium size enterprises
and employs approximately 150 people. The company is also supported by freelancers, when necessary to
support specific projects.
The structure of Arts & Co is typical for the size of the company as outlined in Figure 1.
The company has an internal IT team that is responsible for the network administration and deals with day-to-
day activities, such as offering IT support to the other departments. The IT team employs 8 people.
The company has heavily invested in SaaS services in order to offer a flexible working environment to the
employees. The services include the following:
- Cloud storage - Microsoft OneDrive
- File management services - Microsoft 365
- Customer Relationship Management (CRM) - Oracle Advertising and Customer Experience (CX)
- Business analytics tool - Microsoft Power BI: Data Visualisation
- Resource Management - Oracle Enterprise Resource Planning (ERP)
The company also has 2 servers running Microsoft Server 2019 hosting:
- Active Directory (AD)
- Domain Name System (DNS)
- Dynamic Host Configuration Protocol (DHCP)
- Microsoft Exchange Server for e-mail
- Mimecast E-mail filter
- Cisco Secure Gateway for Internet use
Most endpoints have a similar image installed running Windows 11, Microsoft Office 365, and Microsoft
OneDrive for Business, Adobe Reader and SaaS tools. The employees from the web development and marketing
department are also using designing software and graphics tablets. These departments also have some iMacs
and MacBooks, depending on the employees’ preferences on a work platform.
Requirements
You work as a consultant in a cybersecurity firm. Arts &Co is one of your clients. They outsource their security
needs to the company you work for. Incident Response services are part of your company’s contract with Arts
& Co and you are obliged to respond to an initial call within 8 working hours.
The IT manager of Arts & Co calls you late this afternoon to reveal that several employees have reported they
have problems accessing the cloud CRM system that as a result causes delay. The marketing department has
complained more since they have an important deadline for the next day. Most of the employees that have
raised the issue are working remotely and are accessing the resource via VPN.
They have already contacted the cloud CRM provider and they are looking into the situation. However, the IT
team’s initial examinations indicate that the issue is most likely internal and not linked to the cloud provider.
They noticed some unfamiliar directory names on one of their servers. Their analysis of these directories
indicated some unusual directory listings and files. As a result, they would like you to initiate incident response
for a potential data breach.
Although the company has an Incident Response Plan in place for Arts & Co, it does not have a valid SOP. A
provisional team meeting to assess the incident stresses out the need to work on a Standard Operating
Procedure (SOP), before taking action to allow you a more effective response for the incident. You are allocated
with the task, and you are strongly advised to conduct research in the field and identify appropriate tools and
techniques for the exercise.
"""