|
Assignment Brief:
This is an individual assessment, which carries 30% of the overall module mark. The task will assess your understanding of the process of penetration testing as a method of systems security evaluation, and in particular you will focus on the preparation phase, where the pen testing scope is discussed and evaluated, a standard operating procedure (SOP) is devised and agreed with the client, and an Attack Tree is prepared and shared with the pen testing team, in order for them to follow it, when decisions need to be made during the test.
All academic reports that you write as part of your coursework assessments are in fact technical reports, and as such the following report structure is expected:
1. A professional title page
2. A Contents page with page numbers, and also numbers for each section or subsection
3. A professional layout of the whole report, with numbered sections and subsections headings, and indentation for subsections as well
4. An Introduction (which obviously will be numbered as 1.0), where you will introduce the topics of penetration testing types, methodologies involved, and then you introduce the report itself
5. Main Body, where you will develop your arguments, by critically discussing and analysing the topics you introduced in the introduction. You will draw conclusions as you analyse.
5.1 Pen Testing Methodologies
5.2 Standard Operating Procedure
5.3 Decision Making Tree (or Attack Tree)
6. Conclusions section, where you sum arise the conclusions previously drawn, evaluate those conclusions, and make recommendations, or draw lessons for the future
7. References, aim for an average of 12-15 references for the report
8. Appendixes
You are expected to demonstrate an insight into the implications of the problem introduced in the task by using clear and concise arguments. The reports should be well written (and word-processed), showing good skills in creativity and design. Sentences should be of an appropriate length and the writing style. should be academic and informative.
During the teaching weeks you will have the opportunity to ask specific questions about the assignment in class – in person during the practical session, or online during the tutorial session. The module team will provide general (not individualised) feedback based on your questions, and will advise regarding your progress (if it is deemed necessary). The deadline for Assignment 2 is 25.11.2024.
The Assignment Task – Develop a Standard Operating Procedure and a Decision Tree for a System Security Test (Penetration Testing)
It is expected that the report for this task will be in the region of 1250 -1300 words as a minimum. Although the tasks for this assignment will require you to undertake research and reading, this is a very practical assignment, involving the development of an SOP and an attack tree. Therefore, you will report on the work that you have done. You are not expected to write an essay. You will need to first establish what test type you conduct, in order to be able to select a suitable pen testing methodology, with reasons, for your test type. Based on that decision, you will need to design and develop your Standard Operating Procedure (SOP), including an attack tree (please put these in an appendix). An SOP is defined as a set of agreed procedures compiled by an organisation to help workers carry out routine operations. For penetration testing, the SOP forms the agreement (a legal document) between the testers and the clients The SOP and attack tree should be appropriate for Assignment 3, which is the penetration test of a single Linux target, offering several network services.
As stated, the deadline for Assignment 2 is on the 25.11.2024 by electronic submission via Canvas. If you fail to do so, you either can submit until one week after the deadline with a reduced mark, being capped to a maximum of 40%, or you complete an EC (Exceptional Circumstances) form. to require a deferral to the May/June period, or a deferral in the next run of the module (this is for all assignments and it can be done even at the end of the module period). You can also apply for a maximum of seven days extension, by completing a form, and supplying evidence to SASH for the extension request. Please remember that failing one assignment does not necessarily mean failing the module. The overall mark for the module will be calculated from all three assessments.
|
Assignment 2, Assessment Criteria
|
Weighted mark
|
Mark out of 100%
|
|
After establishing what test type you will conduct, you need to critically evaluate and select a suitable testing methodology, based on your test type
|
6
|
20
|
|
A Standard Operating Procedure needs to be created for your test.
Critically discuss existing SOP’s, and develop yourself an SOP for your own Pen Test
|
12
|
40
|
|
After deciding the Standard Operating Procedure for the test, you need an attack plan in the form. of an Attack Tree.
Critically discuss some existing Attack Trees and then develop an Attack Tree for your own Pen Test
|
12
|
40
|
|
Total
|
30
|
100
|
Please note that if you fail to design an appropriately structured SOP, you will be penalised, and if you fail to design an appropriately structured decision-making tree, you will be penalised. Both are very well-defined notions/structures. Examples will be provided through StudyNet.
|