forensic data to be recovered from the workstation includes but not limited to: Data from storage media Email data Web data Triage principles for acquiring and securing data includes but not limited to: Live triage processes Post-mortem process Tools for digital forensics includes but not limited to: EnCase FTK (Access Data Forensic Toolkit) X-Ways iLook SMART WinHex md5sum DriveSpy FTK Imager BlackBug WinHex WindowsSCOPE Regripper and regripper plug-ins TZWork Tools.WFT (Windows forensic Toolchest) Linux Evidence Collection Tool (LECT) Disk drives includes but not limited to: Standard platted based drives State (SSD) Different types of email formats includes but not limited to: Microsoft Outlook Web-Based mail Microsoft Exchange and Office 365 Common forensic email tools includes but not limited to: Nuix MailXaminer Add4Mail eMailTrackerPro Paraben E-Mail Examine Web browser structures includes but not limited to: Internet Explorer Firefox Chrome Microsoft Edge Common browser forensic tools includes but not limited to: Nirsoft Woanware ChromeForensics SQLite Manager Hindsight
materials. This unit may be assessed on the job, off the job or a combination of both. Where assessment occurs off the job, an appropriate simulation must be used where the range of conditions reflects realistic workplace situations. The competencies covered by this unit would be demonstrated by an individual working alone or as part of a team. The assessment environment should not disadvantage the candidate. Method of assessment Evidence can be gathered in a variety of ways including: observation of processes and procedures oral and/or written questioning on required knowledge and skills testimony from supervisors, colleagues, clients and/or other appropriate persons inspection of the product or outcome portfolio of documented evidence. Where performance is not directly observed and/or is required to be demonstrated over a period of time and/or in a number of locations, any evidence should be authenticated by colleagues, supervisors, clients or other appropriate persons. VU22255 - Evaluate threats and vulnerabilities for Internet of Things (IoT) devices Unit Descriptor This unit provides the knowledge and skills to examine the function and operation of IoT devices and to identify what threats and vulnerabilities exit when using them. The unit also includes strategies to minimise the threats. No licensing or certification requirements apply to this unit at the time of accreditation. Employability Skills This unit contains employability skills. Application of the Unit This unit is applicable to individuals working as cyber security paraprofessionals who will utilise IoT devices Prerequisite Unit/s Nil ELEMENT Elements describe the essential outcomes of a unit of competency. PERFORMANCE CRITERIA Performance criteria describe the required performance needed to demonstrate achievement of the element – they identify the standard for the element. Where bold/italicised text is used, further information or explanation is detailed in the required skills and knowledge and/or the range statement. Assessment of performance is to be consistent with the evidence guide. 1. Identify IoT device function and operation 1.1 Impact and use of IoT devices is defined 1.2 IoT devices are classified
ELEMENT Elements describe the essential outcomes of a unit of competency. PERFORMANCE CRITERIA Performance criteria describe the required performance needed to demonstrate achievement of the element – they identify the standard for the element. bold/italicised text is used, further information or explanation is detailed in the required skills and knowledge and/or the range statement. Assessment of performance is to be consistent with the evidence guide. 1. Collate security frameworks, cyber security risk mitigation strategies and other supportive documents for the organisation 1.1 Relationship between critical infrastructure and Industrial Control Systems (ICS) is defined 1.2 Key standards bodies and organisations that provide useful resources that address security issues in critical infrastructure or ICS are identified 1.3 Current working frameworks or practices that can support the improvement of critical infrastructure from cyber security attack are identified 2. Evaluate current critical infrastructure and associated vulnerabilities 2.1 Current critical infrastructure is identified and classified 2.2 Current vulnerabilities for critical infrastructure are identified 2.3 Current ICS deployment architectures are reviewed and evaluated 2.4 Risk assessment for critical infrastructure for the organisation is performed 2.5 Case study of the STUXnet virus is performed 3. Classify current cyber security vulnerabilities for critical infrastructure 3.1 Classification of current cyber security vulnerabilities for ICS’s are identified 3.2 Risk assessment of current ICS vulnerabilities is conducted Select relevant cyber security frameworks and security critical infrastructure mitigation strategies 4.1 Resources that provide strategies to protect critical infrastructure are sourced 4.2 Current organisational security policies to protect critical infrastructure are identified 4.3 In consultation with key personnel current critical infrastructure protection policies are evaluated 4.4 Appropriate strategies to enhance the protection of the critical infrastructure are adopt 4.5 Training for staff to alter current working practices or adopt new practices to improve the security culture is planned and implemented Monitor the effectiveness of the implementation of the 5.1 In consultation with key personnel, implemented changes to processes and procedures are measured for effectiveness against selected criteria
No licensing or certification requirements apply to this unit at the time of accreditation. Employability Skills This unit contains employability skills. Application of the Unit This unit is applicable to individuals intending to work as cyber security paraprofessionals responsible for the security infrastructure Pre requisite Unit Nil ELEMENT Elements describe the essential outcomes of a unit of competency. PERFORMANCE CRITERIA Performance criteria describe the required performance needed to demonstrate achievement of the element – they identify the standard for the element. Where bold/italicised text is used, further information or explanation is detailed in the required skills and knowledge and/or the range statement. Assessment of performance is to be consistent with the evidence guide. Collate the current network security diagram, security infrastructure functional operation and security device documentation 1.1 Existing security infrastructure diagram for the organisation are sourced 1.2 In consultation with appropriate personnel the function and operation of the existing network security infrastructure is evaluated 1.3 Network security devices, systems and tools are identified Configure security devices according to the functional specification 2.1 Resources and documents to configure these network security devices are gathered 2.2 Security policy document is sourced 2.3 Selection of network security devices, systems and tools are configured according to the functionality described in the network security policy Verify operation of security devices 3.1 Baseline functionality of network security devices are determined or identified 3.2 Utilising software or hardware tools, network security device operation and performances is monitored according to baseline functionality 3.3 Effectiveness of the security device operation are evaluated with appropriate personnel Investigate and implement new network security architectures and devices 4.1 New network security devices and technologies are researched 4.2 New network security devices and technology is evaluated and selected 4.3 Higher packet inspection technology is described then implemented on a network security device 4.4 Holistic approaches to traffic inspection technologies is described and implemented on a network security device 4.5 Concept of dynamic update technology for defending against new cyber-attacks is described then implemented on a network security
3. Test the virtualised design for its functional operation according to design specifications 3.1 Appropriate test procedures for the organisation are followed 3.2 Virtualised security infrastructure is tested utilising appropriate 3.3 Functional operation of the cyber security infrastructure is evaluated 3.4 Vulnerabilities of virtualised systems are identified and reported to appropriate personnel. 3.5 Strategies to “harden” the virtualised security infrastructure design are developed in consultation with appropriate personnel Implement the virtualised security system 4.1 Resources for the security infrastructure deployment are identified and sourced 4.2 Resources are implemented and configured 4.3 Virtualised security infrastructure is deployed 5. Monitor the performance of the virtualised cyber security system 5.1 Tools to monitor the performance of the security infrastructure are chosen 5.2 Tools to monitor the performance of the system are configured and deployed 5.3 File outputs or alerts for system performance are monitored 5.4 Monitored data is evaluated and if appropriate, modification to the system is performed
Testing tools for virtualised machines includes but not limited to: Hyper-V VMware vSphere Citrix XenServer Parallels VMware Fusion VMware Workstation KVM Qemu Xen VIrtualBox Software design environment includes but not limited to: Hyper-V VMware vSphere Citrix XenServer Parallels VMware Fusion VMware Workstation OpenStack CloudStackVIrtualBox Appropriate test procedures includes but not limited to: Exhaustive testing of the system off line that would not affect the existing networking infrastructure Turnkey (implement solution all at once) or in stages Vulnerabilities of virtualised systems includes but not limited to: Securing resources (eg Databases or other stored media) Hosts that access this media (ie shared hosting) Internally connected Virtual Machines Externally connected Virtual Machines Appropriate personnel includes but not limited to: Colleagues line managers external consultants virtualised security infrastructure designer Tools to monitor the performance includes but not limited to: PRTG Network Monitor vRealize Operations Manager vRealize Network Insight Pandora FMS Nagios Zabbix EVIDENCE GUIDE The evidence guide provides advice on assessment and must be read in conjunction with the Performance Criteria, Required Skills and Knowledge, the Range Statement and the Assessment section in Section B of the accreditation submission. Critical aspects for assessment and evidence required to assess competency in this unit To be considered competent in this unit assessors must be satisfied the candidate can demonstrate the achievement of all of the elements of the competency to the level defined by the associated performance criteria Specifically they must be able to:
and implemented 3. Identify, configure and monitor identity management for the organisation 3.1 Working principles for identity management are examined 3.2 Process to configure identity management for various operating systems is investigated 3.3 Identity management for an operating system is implemented 3.4 Testing strategies for identity management vulnerabilities are developed 3.5 Testing strategies to the identity management system of the operating system to determine its’ vulnerabilities are applied 3.6 Identity management processes are evaluated with key personnel and if required, are modified to improve security 4. Identify, configure and monitor access management for the organisation 4.1 Working principles for access management are examined 4.2 Access management for an operating system is investigated and implemented 4.3 Testing strategies for access management vulnerabilities are developed 4.4 Testing strategies on the access management system for an operating system to determine its’ vulnerabilities are applied 4.5 Access management processes are evaluated with key personnel and modify if required for improved security
Legislation and industry codes and standards includes but not limited to: Workplace OH&S security legislation Privacy laws Workplace relations Worker code of conduct Relevant standards Risk management analysis but not limited to: Identifying risk Analysing risk Responding to risk Precise specifications and terms of reference includes but not limited to: Functionality User experience Management Defining roles and expectations Engaging external contractors Non-disclosure requirements Planned implementation Service disruption Delivery penalties Physical and other resources includes but not limited to: Workspace Equipment Environment Timelines, schedules and critical paths includes but not limited to: Selection and use of automated tools Defining subtask interdependencies Timelines Handover Commissioning Methods development Organisational procedures includes but not limited to: Invoicing/Payment Project debriefing Documentation Project handover debriefing EVIDENCE GUIDE The evidence provides advice on assessment and must be read in conjunction with the Performance Criteria, Required Skills and Knowledge, the Range Statement and the Assessment section in Section B of the accreditation submission. Critical aspects for assessment and evidence required to assess competency in To be considered competent in this unit assessors must be satisfied the candidate can demonstrate the achievement of all of the elements of the competency to the level defined by the associated performance criteria
Cyber security features includes but not limited to: Attack Vector Attack complexity Privileges required User interaction Scope Confidentiality Integrity Availability Windows file system components includes but not limited to: FAT32 NTFS Alternative data streams MACE EFI Free space Timestamps on a file system Linux file system components includes but not limited to: EX4 Journaling MBR Swap file system MAC Evidence types includes but not limited to: Best evidence Corroborative evidence Indirect evidence Threat actors includes but not limited to: Cyber Criminals, Organized and Otherwise Hacktivists State-Sponsored Attackers State-Sponsored Attackers Networking protocols includes but not limited to: Ethernet frame IPv4 IPv6 TCP UDP ICMP HTTP Network monitoring includes but not limited to: Wireshark Tcpdump CA Netmaster Microsoft network monitor Key elements in an intrusion includes but not limited to: Source address Destination address Source port Destination port Protocols
Selected intrusion elements includes but not limited to: IP address (source and destination) Client and server port identity Process (file or registry) Hashes URI or URL Common source technologies includes but not limited to: NetFlow IDS/IPS Firewall Network application control Antivirus Incident response plan includes but not limited to: Mapping elements of analysis: Preparation Detection and analysis Containment, eradication and recovery Post-incident analysis Mapping organisational stakeholders: Preparation Detection and analysis Containment, eradication and recovery Post-incident analysis Network profiling includes but not limited to: Total traffic throughput Session duration Ports used Address space utilized Server profiling includes but not limited to: Listening ports Logged in users Running processes Running tasks Applications Steps and methods used to gather data includes but not limited to: The process of data normalization 5-turple correlation structure and methods Retrospective analysis Identifying compromised networked hosts Alternative tools and techniques used for data analysis includes but not limited to: Deterministic methods of data analysis Probabilistic methods of data analysis Heuristic methods of data analysis Diamond model of classify intrusion events includes but not limited to: Reconnaissance Weponization Delivery Exploitation Installation Command and control Action on objectives
Frameworks includes but not limited to: Control Objectives for Information and Related Technologies (COBIT) Information Technology Infrastructure Library (ITIL) Prince 2 Voluntary codes and best practices for the industry sector includes but not limited to: North American Electric Reliability Corporation (NERC) Critical Infrastructure Protection (CIP) Reliability standard version 7 National Institute of Standards and Technology (NIST) Cyber security Framework for Critical Infrastructure ISO/IEC Information Technology – Security techniques code of practice ISO/IEC TR 27019:2013 Information Technology - Security techniques information security management NIST SP 800-82 to Industrial control Systems (ICS) Security Protective Security Policy Framework (PSPF) Information Security Manual (ISM) Produced by the Australian Signals Directorate (ASD) Prudential Practice Guide CPG 235 – Managing Data Risk Prudential Practice PPG 234 – Management of security risk in information and information technology Australian Securities and Investment Corporation (ASIC) Report 429 The Communication Alliance (iCodes). iCode C650:2014 voluntary code adopted by all Internet Service Providers (ISPs) in Australia) EVIDENCE GUIDE The evidence provides advice on assessment and must be read in conjunction with the Performance Criteria, Required Skills and Knowledge, the Range Statement and the Assessment section in Section B of the accreditation submission. Critical aspects for assessment and evidence required to assess competency in this unit To be considered competent in this unit assessors must be satisfied the candidate can demonstrate the achievement of all of the elements of the competency to the level defined by the associated performance criteria. Specifically they must be able to: Clarify the structure of the Australian legal system; Demonstrate organisational compliance through the use of standards, frameworks, codes and best practice; Identify mandatory and discretionary cyber laws and practices; Evaluate, select and implement relevant Australian regulation and practices pertaining to security of the organisation; Monitor the effectiveness of the organisation’s implementation regulation and practices; Context of and specific resources for assessment Evidence should show competency working in a realistic environment and a variety of conditions. The candidate will have access to all tools, equipment, materials and documentation required. The candidate will be permitted to refer to any relevant workplace procedures, product and manufacturing
frameworks and methodologies suitability and implementation 2. Collate network security design documentation 2.1 Existing network security logical diagram is reviewed and updated as required 2.2 Existing network security physical diagram is reviewed and updated as required 3. Conduct a security assessment on the security devices and components 3.1 Network and perimeter security assessment is conducted 3.2 Existing security infrastructure diagram for the organisation is sourced 3.3 Network security to determine system vulnerabilities are evaluated and selected 3.4 Template for security assessments including business impact is developed or sourced 3.5 Risk and threat modelling for the organisation is developed 3.6 Security metrics covering control objectives, warning thresholds and control thresholds is developed Collate and review security policies for the organisation 4.1 Current security policy documents for the organisation are collated 4.2 In consultation with appropriate personnel, security policies are reviewed and updated where appropriate 4.3 Change management process strategies to improve cyber security working practices within the organisation are developed Evaluate methodologies for security architecture 5.1 In consultation with appropriate personnel a layered model of security architecture is evaluated and selected 5.2 Issues around implementing a layered model of security architecture are prioritised 5.3 Different of security technical designs are defined 5.4 Key development principles of a sound security architecture are investigated 5.5 Process to address special security architecture challenges are investigated Determine existing security architecture vulnerabilities 6.1 Tools and methodologies to enable security architecture vulnerabilities are collated, evaluated and selected 6.2 An audit to detect vulnerabilities for the security architecture is performed 6.3 In consultation with appropriate personnel, strategies to mitigate detected security architecture vulnerabilities are developed and deployed Communicate design options for security architecture to the organisation 7.1 Engaging strategies for different stakeholder groups are developed 7.2 Communication strategies for different stakeholder groups are developed
Enterprise Architecture Framework - Zachman Institute for Framework Advancement SABSA Framework for security architecture design Range Statement The Range Statement relates to the unit of competency as a whole. It allows for different work environments and situations that may affect performance. Security architecture frameworks and methodologies includes but not limited to: The open group architecture framework (TOGAF) Enterprise information security architecture (EISA) Sherwood applied business security architecture Information technology infrastructure library (ITIL) Control objectives for information and related technologies (COBIT) National Institute of Standards and Technology (NIST) Cybersecurity framework Enterprise Architecture Framework - Zachman Institute for Framework Advancement Appropriate personnel includes but not limited to: Cyber security paraprofessional Cyber security manager External consultants Relevant managers Business stakeholders Security policy includes but not limited to: Breech consequences Policy enforcement User Access Security profiles Passwords E-mail use Internet use requirements Back-up and recovery processes Intrusion detection processes and procedures Remote Access Change management process strategies includes but not limited to: Internal training Random work place audits Incentives for work cyber security change practices Weekly staff security challenges Layered model of security architecture includes but not limited to: Contextual (Business context) Conceptual (Security strategy) Logical (High level security design) Physical (Part of detailed design) Component (Part of detailed design) Operational design All the above are based on the SABSA
Conduct a security assessment on the existing security devices and components; Utilise a design methodology for security architecture; Utilise and methodologies to determine security architecture vulnerabilities; Develop strategies to mitigate security architecture vulnerabilities; Communicate security architecture designs to the organisation. Context of and specific resources for assessment Evidence should show competency working in a realistic environment and a variety of conditions. The candidate will have access to all tools, equipment, materials and documentation required. The candidate will be permitted to refer to any relevant workplace procedures, product and manufacturing specifications, codes, standards, manuals and reference materials. This unit may be assessed on the job, off the job or a combination of both. Where assessment occurs off the job, an appropriate simulation must be used where the range of conditions reflects realistic workplace situations. The competencies covered by this unit would be demonstrated by an individual working alone or as part of a team. The assessment environment should not disadvantage the candidate. Method of assessment Evidence can be gathered in a variety of ways including: observation of processes and procedures oral and/or written questioning on required knowledge and skills testimony from supervisors, colleagues, clients and/or appropriate persons inspection of the product or outcome portfolio of documented evidence. performance is not directly observed and/or is required to be demonstrated over a period of time and/or in a number of locations, any evidence should be authenticated by colleagues, supervisors, clients or other appropriate persons. Appendix 1 – Knowledge/Skills and of Competency Matrix BSBWOR502 Lead and manage team effectiveness ICTNWK525 Configure an enterprise virtual computing environment VU22240 Communicate cyber security incidents within the organisation VU22241 Interpret and utilise key security frameworks, policies and procedures for the organisation VU22242 Assess and secure cloud services VU22243 Develop software skills for the cyber security practitioner VU22244 Implement best practices for identity management VU22245 Plan andImplement a cyber security project VU22246 Evaluate an organisation’s compliance with relevant cyber security standards and law Knowledge Core Basic understanding of threats and their √ √ √ √ √ √ √