Assessment Overview
Assessment Task | Type | Weighting | Due | Length | ULOs |
|---|
Assessment 1: Workshop Quiz Students will complete in class workshop including situation analyses and practical application of skills. | Individual Invigilated | 20% | Week 4 | 1 hour (equiv. 1000 words) | ULO1 ULO2 |
Assessment 2: Report Threat and Risk Assessment Report. | Individual | 30% | Week 6 | 2500 words | ULO3 ULO4 |
Assessment 3a: Report Students will develop an Information Security Roadmap for a given situation. Assessment 3b: Presentation The Information Security Roadmap generated in part A will be presented in a plenary session to the class. | Group 
Invigilated | Part A 20% Part B 10% | Part A Week 10 Part B Weeks 10, 11 | Part A 3000 words Part B (equiv. 1500 words) | ULO1 ULO2 ULO3 ULO4 |
Assessment 4: Critique Report Students will be allocated a roadmap from another group submitted as part of Assessment 3. Each student will prepare a critique on that report identifying strengths and weaknesses in the report and providing | Individual | 20% | Week 12 | 1500 words | ULO1 ULO2 ULO3 ULO4 |
equiv. – equivalent word count based on the Assessment Load Equivalency Guide. It means this assessment is equivalent to the normally expected time requirement for a written submission containing the specified number of words.
Assessment 1: Workshop Quiz
Due date: | Week 4 |
Group/individual: | Individual |
Word count/Time provided: | 1 hour (equiv. 1000 words) |
Weighting: | 20% |
Unit Learning Outcomes: | ULO1, ULO2 |
Assessment 1 Detail
Students will complete a class workshop quiz including situation analyses and practical application of skills. This assessment covers the topics of Week 1 and Week 2. The quiz will be conducted individually and under your instructor’s invigilation in the class of Week 4. The student must attend the class in Week 4 to perform this quiz.
The Quiz has two parts:
Part 1: 20 Multiple-choice (MC) questions
Part 2: 10 short answer questions
You need to answer all questions.
Assessment 1 Marking Criteria and Rubric
The assessment will be marked out of 100 and will be weighted 20% of the total unit mark. The marking criteria and rubric are shown on the following page.
Assessment 2: Report
Due date: | Week 6 |
Group/individual: | Individual |
Word count/Time provided: | 2500 words |
Weighting: | 30% |
Unit Learning Outcomes: | ULO3, ULO4 |
Assessment 2 Detail
Threat and Risk Assessment Report
XYZ Ltd. is a medium-sized company specializing in providing software development services to various industries. The company has been operational for 8 years and has a growing client base that includes both small and large enterprises. XYZ Ltd. stores sensitive client information, including intellectual property, contracts, and financial data, on its internal systems and cloud-based solutions. Recently, the company has experienced an increase in cyber threats and is concerned about the security of its data and systems.
Assumptions
• Operating Systems:
o Servers: Windows Server 2019
o Workstations: Windows 10/11 Pro and macOS
o Mobile Devices: iOS and Android
• Cloud Services: AWS (Amazon Web Services) for cloud infrastructure, including EC2, S3, and RDS.
• Database: PostgreSQL 13
• Development Tools: GitHub for version control and Jenkins for CI/CD pipelines. • Network Security: Basic firewall and VPN setup for remote access.
• Data Storage: Client data is stored in both on-premises and cloud-based PostgreSQL databases.
Use reasonable assumptions for any additional required information, such as which network architecture is used, applications, etc.
You need to write a threat and risk assessment report. The report will be graded based on the following components:
1. Identification of potential risks
• The student accurately identifies and describes potential vulnerabilities in the company’s systems, network, and sensitive information.
• The student identifies and describes potential cyber threats facing the organization, including current trends and techniques used by attackers. (This point and the previous point are referred to them as the threat analysis in the marking rubric)
• The identified vulnerabilities and threats should lead to at least ten risks.
2. Risk assessment
• The student presents a comprehensive risk analysis, which includes the classification of impacted assets.
• The student provides a thorough analysis of the likelihood and impact of each risk.
• The student uses quantitative risk assessment or qualitative risk assessment as appropriate. The report must include both quantitative and qualitative risk assessments.
• The student uses the risk matrix to present a clear and actionable picture of the overall risk to the organization.
3. Recommendations for risk response
• The student provides clear and practical recommendations for the appropriate risk response for the identified risks.
• The student demonstrates an understanding of industry best practices and standards for information security.
4. Presentation and organization
• The student presents the information in a clear and organized manner.
• The report is well-written and easy to understand.
5. Research and references
• The student uses credible sources to support the analysis and recommendations. • The student properly cites all sources used in the report.
Assessments 2 Marking Criteria and Rubric
The assessment will be marked out of 100 and will be weighted 30% of the total unit mark. The marking criteria and rubric are shown on the following page.
Assessment 2 Marking Criteria and Rubric
Marking Criteria | Not Satisfactory (0-49% of the criterion mark) | Satisfactory (50-64% of the criterion mark) | Good (65-74% of the criterion mark) | Very Good (75-84% of the criterion mark) | Excellent (85-100% of the criterion mark) |
Identification of potential risks (30 marks) | The student does not identify any potential risks or provides an inadequate analysis and no threat analysis. | The student identifies a minimal number of potential risks and basic threat analysis. | The student identifies a few potential risks with providing a basic threat analysis. | The student identifies several potential risks, along with providing a clear threat analysis. | The student demonstrates a thorough understanding of the company’s systems, along with providing a clear and specific threat analysis. |
Risk assessment (30 marks) | The student does not present a risk analysis and risk matrix. | The student presents a minimal or inadequate risk analysis and risk matrix. | The student presents a risk quantitative and qualitative analysis and risk matrix that may lack detail or accuracy. | The student presents a detailed quantitative and qualitative risk analysis and risk matrix, but they may not be completely accurate or actionable. | The student presents a comprehensive and accurate quantitative and qualitative risk analysis, using a risk matrix that presents a clear and actionable picture of the overall risk to the organisation. |
Recommendations for risk response (20 marks) | Student does not provide any recommendations for the appropriate risk response, or the recommendations provided are not practical or do not demonstrate an understanding of industry best practices and standards for information security. | Student provides some recommendations for the appropriate risk response, but they are weak or missing key components. | Student provides basic recommendations for the appropriate risk response, but they are not well supported or do not demonstrate a strong understanding of industry best practices and standards for information security. | Student provides clear and practical recommendations for the appropriate risk response and demonstrates a good understanding of industry best practices and standards for information security. | Student provides clear, practical, and well supported recommendations for the appropriate risk response, and demonstrates an in depth understanding of industry best practices and standards for information security. |
Presentation and organization (10 marks) | The student presents the information in an inadequate or unorganized manner, with severe issues in writing and understanding. | The student presents the information in a limited or disorganized manner, with significant issues in writing and understanding. | The student presents the information in an adequate manner, but the report may have some issues in organization and writing. | The student presents the information in an organized manner, but the report may have some minor issues in writing and understanding. | The student presents the information in a clear and organised manner, with well-written and easy-to understand report. |
Research and references (10 marks) | The student does not use any sources to support their analysis and recommendations or does not cite sources correctly. | The student uses minimal sources to support their analysis and recommendations, and may not cite all sources used in the report or may not use exclusively reputable sources. | The student uses a limited number of sources to support their analysis and recommendations, and may not cite all sources used in the report or may not use exclusively reputable sources. | The student uses a variety of sources to support their analysis and recommendations, but may not cite all sources used in the report or may not use exclusively reputable sources. | The student uses a variety of reputable sources to support their analysis and recommendations, and correctly cites all sources used in the report. |
Assessment 3a: Report
Due date: | Week 10 |
Group/individual: | Group |
Word count/Time provided: | 3000 words |
Weighting: | 20% |
Unit Learning Outcomes: | ULO1, ULO2, ULO3, ULO4 |
Assessment 3a Detail
Students will develop an Information Security Roadmap for a given situation.
Your group (a maximum of three members) has been hired as an information security consultant by a selected Company/Organisation that operates in one of the listed industries below. They store sensitive information such as client’s intellectual property and financial data on their network and cloud infrastructure. The company/organization has been experiencing a rise in cyber-attacks and is concerned about the security of their sensitive information and the potential impact on their operations and reputation. The company’s management team has asked your group to develop an Information Security Roadmap that aligns with their strategic objectives and addresses the identified risks and incidents.
By Week 4, each group will be allocated one of the following industries:
1. Banks
2. Healthcare providers
3. Retail companies
4. Educational institutions
5. Government agencies
6. Technology companies
7. Energy companies
8. Manufacturing companies
9. Transport and logistics companies
10. Insurance companies
11. Service providers (e.g., consulting, legal, accounting)
12. Non-profit organizations
13. Media and entertainment companies
14. Telecommunications companies
15. Pharmaceutical companies
Each group will select a specific real-world company/organization that belongs to their allocated industry. The group should gather any required information from the selected company’s official website (or any other authentic sources). Otherwise, reasonable assumptions should be used for any required information that could not be obtained officially about the selected company.
The report will be graded based on the following components:
1. Strategic Objectives
• The student accurately identifies the company’s strategic objectives and explains how the information security plan aligns with them.
• The student demonstrates an understanding of the company’s goals and objectives and how they relate to information security.
2. Risk Assessment
• The student conducts a thorough risk assessment, identifying potential vulnerabilities, threats, and risks (at least 10 risks) facing the company’s systems, network and cloud infrastructure, and sensitive information.
• The student provides a clear and actionable picture of the overall risk to the organization.
3. Information Security Program
• The student develops a comprehensive security program that includes appropriate controls and treatments for the identified risks.
• The student demonstrates an understanding of industry best practices and standards for information security.
4. Incident Management and Response
• The student develops a clear and comprehensive incident management and response plan that includes procedures for identifying, reporting, and responding to security incidents (at least 10 incidents).
• The student demonstrates an understanding of incident response best practices.
5. Implementation Roadmap Plan
• The student provides a clear and comprehensive implementation plan that includes timelines, resources, and milestones required to implement the security program and incident management.
• The student demonstrates an understanding of information security roadmap best practices.
6. Presentation and Organisation
• The student presents the information in a clear and organized manner.
• The report is well-written and easy to understand.
7. Research and References
• The student uses credible sources to support the analysis and recommendations, and properly cites all sources used in the report.
• The student demonstrates an understanding of research and referencing best practices
Assessment 3b: Presentation
Due date: | Week 10, Week 11 |
Group/individual: | Group |
Word count/Time provided: | (equiv. 1500 words) |
Weighting: | 10% |
Unit Learning Outcomes: | ULO1, ULO2, ULO3, ULO4 |
Assessment 3b Detail
The Information Security Roadmap generated in part A will be presented in a plenary session to the class.
The presentation should focus on the main findings and recommendations of the report, including the strategic objectives, risk assessment, security program, incident management and response, implementation plan, monitoring and evaluation, and any other relevant information.
The presentation should cover the main elements of the report within 15 minutes (5 minutes for each member).
During the presentation, all group members should actively participate and take turns presenting different parts of the report. The group members should also be prepared to answer any questions or clarifications at the end of the presentation.
This presentation will be graded based on the group’s ability to effectively communicate the main findings and recommendations of the report, as well as their ability to answer any questions and engage with the class during the presentation. The presentation skills and response to the questions will be marked individually (see the Criteria and Rubric for more details).
The presentation should be delivered in a clear and organized manner, and the slides should be well designed, visually appealing, and easy to read.
Assessment 3 Marking Criteria and Rubric
The assessment will be marked out of 100 and will be weighted 30% of the total unit mark. The marking criteria and rubric are shown on the following page.
Assessment 3 Marking Criteria and Rubric
Marking Criteria | Not Satisfactory (0-49% of the criterion mark) | Satisfactory (50-64% of the criterion mark) | Good (65-74% of the criterion mark) | Very Good (75-84% of the criterion mark) | Excellent (85-100% of the criterion mark) |
Strategic Objectives (8 marks) | The student does not identify the company’s strategic objectives or provide an explanation of how the information the security plan aligns with them. | The student identifies some of the company’s strategic objectives, but does not provide a clear or complete explanation of how the the information security plan aligns with them. | The student identifies the company’s strategic objectives, but does not provide a clear explanation of how the information the security plan aligns with them. | The student identifies the company’s strategic objectives and provides a general explanation of how the information security plan aligns with them. | The student accurately identifies the company’s strategic objectives and provides a clear and detailed explanation of how the information security plan aligns with them. |
Risk Assessment (8 marks) | The student does not identify any potential vulnerabilities, threats, and risks facing the company or provides an inadequate analysis of likelihood and impact. | The student identifies a minimal number of potential vulnerabilities, threats, and risks facing the company, or provides an inadequate analysis of likelihood and impact. | The student identifies a few potential vulnerabilities, threats, and risks facing the company, but the risk assessment may lack detail. | The student identifies several potential vulnerabilities, threats, and risks facing the company, but the risk assessment may not be as complete as the Excellent Level | The student conducts a thorough risk assessment and identifies multiple potential vulnerabilities, threats, and risks facing the company. The student provides a clear and actionable picture of the overall risk to the organisation. |
Information Security Program (15 marks) | The student does not develop a security program or the program is not relevant to the identified risks. | The student develops a security program that includes minimal controls and treatments for identified risks, or the program may not be relevant to the identified risks. | The student develops a security program that includes some controls and treatments for identified risks, but the program may lack detail or not fully address all risks. | The student develops a security program that includes appropriate controls and treatments for identified risks, but the program may not be as comprehensive as the Excellent Level. | The student develops a comprehensive security program that includes appropriate controls and treatments for identified risks. The student demonstrates an understanding of industry best practices and standards for information security. |
Incident Management and Response (15 marks) | The student does not develop an incident management and response plan or the plan is not relevant to the identified risks. | The student develops an incident management and response plan that includes minimal procedures for identifying, reporting, and responding to security incidents, or the plan may not be relevant to the identified risks. | The student develops an incident management and response plan that includes some procedures for identifying, reporting, and responding to security incidents, but the plan may lack detail or not fully address all aspects of incident | The student develops an incident management and response plan that includes procedures for identifying, reporting, and responding to security incidents, but the plan may not be as comprehensive as the Excellent Level. | The student develops a clear and comprehensive incident management and response plan that includes procedures for identifying, reporting, and responding to security incidents. The student demonstrates an understanding of incident response best practices. |
Implementation roadmap Plan (15 marks) | The student does not provide an implementation plan or the plan is not relevant to the identified risks. | The student provides an implementation plan that includes minimal timelines, resources, and milestones required to implement the security program and incident management and response plan, or the plan may not be relevant to the identified risks. | The student provides an implementation plan that includes some timelines, resources, and milestones required to implement the security program and incident management and response plan, but the plan may lack detail or not fully address all aspects of implementation. | The student provides an implementation plan that includes timelines, resources, and milestones required to implement the security program and incident management and response plan, but the plan may not be as comprehensive as the Excellent Level. | The student provides a clear and comprehensive implementation plan that includes timelines, resources, and milestones required to implement the security program and incident management and response plan. The student demonstrates an understanding of project management best practices. |
Presentation and Organization (3 marks) | The student presents the information in an inadequate or unorganized manner, with severe issues in writing and understanding. | The student presents the information in a limited or disorganized manner, with significant issues in writing and understanding. | The student presents the information in an adequate manner, but the report may have some issues in organization and writing. | The student presents the information in an organized manner, but the report may have some minor issues in writing and understanding. | The student presents the information in a clear and organised manner, with well-written and easy-to understand report. |
Research and References (3 marks) | The student does not use any sources to support their analysis and recommendations or does not cite sources correctly. | The student uses minimal sources to support their analysis and recommendations, and may not cite all sources used in the report or may not use exclusively reputable sources. | The student uses a limited number of sources to support their analysis and recommendations, and may not cite all sources used in the report or may not use exclusively reputable sources. | The student uses a variety of sources to support their analysis and recommendations, but may not cite all sources used in the report or may not use exclusively reputable sources. | The student uses a variety of reputable sources to support their analysis and recommendations, and correctly cites all sources used in the report. |
Content (9 marks) Group | The presentation does not cover any of the main elements of the report or includes inaccuracies. | The presentation covers a minimal number of the main elements of the report and includes minimal relevant information, or the information provided may not be accurate. | The presentation covers some of the main elements of the report and includes some relevant information, but may lack detail or accuracy in many areas. | The presentation covers most of the main elements of the report and includes relevant information, but may lack detail or accuracy in some areas. | The presentation effectively covers all the main elements of the report and includes relevant and accurate information. |
Organization and Visual Aids (9 marks) Group | The presentation is not organized and is difficult to follow. The visual aids are not used in the presentation, or they are so poorly designed and unprofessional that they detract from the overall effectiveness of the presentation. | The presentation is minimally organized, and may lack detail or have many inconsistencies. The visual aids are poorly designed, unprofessional, and do not effectively support the content of the presentation. | The presentation is somewhat organized but may lack detail or have many inconsistencies. The visual aids are functional, but may not be as well-designed or professional at the higher levels. | The presentation is generally well-organized, but may lack detail or have some inconsistencies. The visual aids are well designed and support the content of the presentation, but there may be some minor errors or inconsistencies. | The presentation is well organised, easy to follow, and logical. The presentation is easy to follow and understand. The visual aids are well designed, professional, and effectively support the content of the presentation. |
Presentation Skills (9 marks) Individual | The student does not present the information in a clear, concise, and confident manner, and has many issues with verbal and nonverbal communication. | The student presents the information in a minimal manner, and may lack confidence or have many issues with verbal and nonverbal communication. | The student presents the information in a general manner, and may lack confidence or have many issues with verbal and nonverbal communication. | The student presents the information in a clear and concise manner, but may lack confidence or have some issues with verbal and nonverbal communication. | The student presents the information in a clear, concise, and confident manner, and demonstrates good verbal and nonverbal communication skills. |
Knowledge (6 marks) Individual | Lack or poor knowledge of the topic is presented, and most questions were left unanswered. | Basic knowledge of the topic is presented, and many questions were left unanswered. | Good understanding of some parts of topic is presented, but few elements went unanswered. | Very Good understanding of most parts of topic. The response was informative, but few elements went unclear. | Extensive knowledge of the topic is presented. The member showed complete understanding of assignment. Accurately answered all questions posed. |
Assessment 4: Critique Report
Due date: | Week 12 |
Group/individual: | Individual |
Word count/Time provided: | 1500 words |
Weighting: | 20% |
Unit Learning Outcomes: | ULO1, ULO2, ULO3, ULO4 |
Assessment 4 Detail
Students will be allocated a roadmap from another group submitted as part of Assessment 3. Each student will prepare a critique on that report identifying strengths and weaknesses in the report and providing recommendations for improvement.
The critique should focus on evaluating the report’s content, organization, and presentation, as well as the effectiveness of the security program, incident management and response, implementation plan, monitoring and evaluation, and any other relevant information.
The student should aim to provide a balanced critique that identifies both the strengths and weaknesses of the report and provides specific examples to support their evaluation. The student should also provide relevant and feasible recommendations for improvement, highlighting areas where the report could be enhanced or strengthened.
The critique should be presented in a clear, well-organized and logical manner, using appropriate language, grammar, and free of errors. The critique should be easy to follow and understand.
The critique will be graded based on the student’s ability to effectively evaluate the report and provide relevant and feasible recommendations for improvement. The critique should also be well organized, easy to follow and understand, and the language used should be appropriate and free of errors.
Submission: Each student has to submit his/her critique as a report (pdf file) containing the following components:
1. Identification of Strengths
2. Identification of Weaknesses
3. Recommendations for Improvement
Assessments 4 Marking Criteria and Rubric
The assessment will be marked out of 100 and will be weighted 20% of the total unit mark. The marking criteria and rubric are shown on the following page.
Assessment 4 Marking Criteria and Rubric
Marking Criteria Total: 40 marks | Not Satisfactory (0-49% of the criterion mark) | Satisfactory (50-64% of the criterion mark) | Good (65-74% of the criterion mark) | Very Good (75-84% of the criterion mark) | Excellent (85-100% of the criterion mark) |
Identification of Strengths (30 marks) | The student does not identify any strengths in the report or the evaluation is not relevant to the report. | The student identifies minimal strengths in the report and provides minimal examples to support their evaluation, or the evaluation may not be relevant to the report. | The student identifies some strengths in the report and provides examples to support their evaluation, but the evaluation may lack detail or not fully address all strengths. | The student identifies a range of strengths in the report and provides examples to support their evaluation, but the evaluation may lack detail or not fully address all strengths. | The student identifies a comprehensive range of strengths in the report and provides specific examples to support their evaluation. or the evaluation may not be relevant to the report. |
Identification of Weaknesses (30 marks) | The student does not identify any weaknesses in the report or the evaluation is not relevant to the report. | The student identifies minimal weaknesses in the report and provides minimal examples to support their evaluation, or the evaluation may not be relevant to the report. | The student identifies some weaknesses in the report and provides examples to support their evaluation, but the evaluation may lack detail or not fully address all weaknesses. | The student identifies a range of weaknesses in the report and provides examples to support their evaluation, but the evaluation may lack detail or not fully address all weaknesses. | The student identifies a comprehensive range of weaknesses in the report and provides specific examples to support their evaluation. |
Recommendations for Improvement (30 marks) | The student does not provide any recommendations for improvement or the recommendations are not relevant to the report. | The student provides minimal recommendations for improvement that are relevant and specific, or the recommendations may not be relevant to the report. | The student provides some recommendations for improvement that are relevant and specific, but may lack detail or not fully address all areas for improvement. | The student provides a range of recommendations for improvement that are relevant and specific, but may lack detail or not fully address all areas for improvement. | The student provides a comprehensive range of recommendations for improvement that are relevant, specific, and feasible. |
Organization and Clarity (10 marks) | The student presents the critique in a disorganized and difficult to follow manner, and the language used has errors that affect the understanding of the critique. | The student presents the critique in a minimal organized manner, and may lack detail or have many inconsistencies. The language used may have many errors. | The student presents the critique in a somewhat organized manner, but may lack detail or have many inconsistencies. The language used is appropriate, but may have some errors. | The student presents the critique in a generally clear and well-organized manner, but may lack detail or have some inconsistencies. The language used is appropriate, but may have some errors. | The student presents the critique in a clear, well organised, and logical manner, easy to follow and understand. The language used is appropriate, grammatically correct and free of errors. |
Leave A Comment