Please enable JavaScript.

Coggle requires JavaScript to display documents.

TMA03 - Coggle Diagram

- - - - Four potential risks with Bring Your Own Devices:
      - Security:√
      - With multiple devices connected to the college's network, segmentation of the network into smaller chunks allows for effective monitoring and controls.√ OK, but a solution/mitigation against which risk?
    - - Inventory of all devices could be kept, and regular audits could be conducted. With so many devices there is a risk of unauthorised access to sensitive information.√ yes a risk Colleges must implement robust security measures to protect against data breaches. √ yes a risk They must ensure that all devices accessing the network are secure and properly authenticated using MFA (Multi Factor Authentication). MFA authenticates users. Devices can be blocked with techniques like MAC-filtering or switchport blocking.
        
        BYOD implementation raises privacy concerns, as personal devices may hold sensitive personal information unrelated to college activities. Colleges need to set up clear boundaries between personal and institutional data to protect the privacy of students and staff. Developing robust privacy policies and obtaining consent from users within the A.U.P(Agreement User Policy) for necessary data access and monitoring is essential. Regular audits and reviews of privacy practices can help colleges find any potential privacy breaches and respond appropriately to address them.
        
        Man-in-the-Middle Attacks: Although a risk: this is not mentioned in the NCSC piece.
        
        Malware:√ “Infected Devices” in the list
        
        Q1B-ii Four risks identified for the context (not just generic) from https://www.ncsc.gov.uk/collection/device-security-guidance/bring-your-own-device/action-1-determine-your-objectives ? One would be hard-pressed to find direct links to the source and your list. It reads more like you came up with your own answer. Basically: the question asked to identify and describe risks after reading a suggested source and you gave an own set of risks, that were partly resulting indirect risks. No word limit specified, no count needed.
        
        Fig 1: courtesy of tm256 module material.
        Q2a-i Clear and readable diagram? √ Included rather than as separate file? √ Describe how OSI model helps understand differences between firewalls and web-application firewalls & how they manage traffic? √ . No word limit specified, no count needed.
        
        Q2a-ii the importance of the placement of a web application server within a network infrastructure outlined? √ (critical for operation of web-application, in DMZ x I miss the the term DMZ between external and internal firewalls). No word limit specified, no count needed.
        Good understanding, but omitted “DMZ”
        
        1 more item...
- - - - Q2b-ii Steps advised to ensure security of web-transactions√ & their database√.No word limit specified, no count needed. Very elaborate answer. .
        
        Employers must exercise human resource security to protect sensitive information and guard against insider threats. One reason this is a necessity is to prevent√ unauthorised access√ to confidential data√. For example, in 2017, Equifax suffered a massive data breach due to a failure in human resource security used as an example of application security: In what way was HR-security involved? .
        
        problem HR security ? explain concisely
        
        Quite a few points you could have mentioned were not mentioned and under C you omitted some of the more obvious HR tasks for Training, Education and certifying the process. Merging training/education could have allowed more.
        
        4a. 5 commands (Activity 4.22 (NetLab Activity 30 – Task 2) uname, hostname, netstat, ps, route but the pdf also mentions date and ifconfig so I will accept those and reasonable alternatives) extracting volatile data, with description of what it does and how used to investigate incident.
        
        Q4b: Appropriate citation/reference? √ Excellent/good explanation of differences between bind shell and reverse shell? (bind shell = shell service on target machine client connects, reverse= listener on own client target machine connects)√
        
        Q3 Summary in 350 words? √ wordcount?√ A. Importance employers use HR-security (wrong people√, wrong positions√, awareness training √, disciplinary vs curiosity√ , termination procedures/handoverx)? B. Difficulties in recruiting (perimeter bypass of strangersx, discrimination lawsx, fake qualifications x, poor disposal of datax)? C. 3 improvements to current HR-security position (background checks .√ mentioned before, employment contract,√ job description x)?