Tutorial 4.18: Unit 4 Integration and Case Studies

📑 Table of Contents

Learning Objectives
Overview
1. Recap of Unit 4 Topics
2. Integrative Framework: Defense-in-Depth and Layered Security
3. Case Study 1: Advanced Persistent Threat (APT) Attack
4. Case Study 2: Ransomware Attack and Incident Response
5. Case Study 3: Insider Threat and Data Loss
6. Case Study 4: Secure Communication Architecture
7. Synthesis: Designing a Security Architecture
Summary
Quiz
Exercises
Homework

🎯 Learning Objectives

After completing this tutorial, you should be able to:

Synthesize all Unit 4 topics into a coherent defense-in-depth strategy.
Analyze complex attack scenarios and map them to appropriate security controls.
Design an integrated security architecture that combines intrusion detection, prevention, firewalls, secure protocols, analytics, and incident response.
Evaluate the effectiveness of security controls in real-world case studies.
Apply incident response and security operations processes to realistic incidents.
Assess the role of security standards and frameworks in guiding security decisions.
Develop a comprehensive security strategy that addresses the entire threat lifecycle.

📖 Overview

Welcome to the final tutorial of Unit 4. Over the previous seventeen tutorials, we have explored the full spectrum of security systems and models: intrusions and threat landscapes, intrusion detection (host and network), prevention systems, firewalls (packet filtering, stateful, NGFW), security analytics (SIEM, UEBA, threat intelligence), secure internet protocols (IPsec, TLS, VPNs, secure email), security standards (IETF, NIST, ISO), and security operations integration (SOC, incident response). This tutorial is designed to integrate all these concepts into a coherent whole, demonstrating how they work together to defend modern enterprises.

We begin with a brief recap of the major Unit 4 topics to refresh your memory. We then present an integrative framework that shows how these technologies and processes fit into a defense-in-depth model, aligned with the NIST Cybersecurity Framework and Zero Trust principles. The core of the tutorial consists of four detailed case studies, each covering a different threat scenario:

Case Study 1: Advanced Persistent Threat (APT) – A sophisticated, multi-stage attack that leverages reconnaissance, spear-phishing, privilege escalation, lateral movement, and data exfiltration. We analyze how each layer of defense (IDS, IPS, firewalls, SIEM, threat hunting) contributes to detection and prevention.
Case Study 2: Ransomware Attack – A fast-moving ransomware incident that uses phishing and exploit vulnerabilities to encrypt critical data. We examine the role of email security, EDR, network segmentation, backups, and incident response in containing and recovering from the attack.
Case Study 3: Insider Threat – A malicious insider attempting to exfiltrate sensitive data. We explore the use of UEBA, DLP, privileged access monitoring, and forensic investigation to detect and respond to the threat.
Case Study 4: Secure Communication Architecture – A design scenario for a multi-site organization requiring secure remote access, site-to-site VPNs, and encrypted email. We integrate IPsec, TLS, S/MIME, and PKI to build a comprehensive secure communication solution.

After the case studies, we provide a synthesis exercise where you will design a complete security architecture for a fictitious enterprise, integrating all Unit 4 concepts. Finally, we offer a comprehensive quiz, exercises, and homework to reinforce your learning.

By the end of this tutorial, you will have a holistic understanding of how security systems and models work together to protect organizations against modern cyber threats, preparing you for Unit 5: Systems Security.

This tutorial aligns with Stallings & Brown (2024) and incorporates NIST, IETF, and SANS best practices.

1. Recap of Unit 4 Topics

Before diving into integration, let's briefly recap the key topics covered in Unit 4:

Intrusions and Threats: Attack lifecycle, threat actors, APTs, MITRE ATT&CK, kill chain, reconnaissance, privilege escalation, lateral movement, persistence, exfiltration.
Intrusion Detection (IDS): Signature-based, anomaly-based, specification-based; HIDS (file integrity, log analysis, system call monitoring) and NIDS (traffic analysis, DPI, signatures).
Intrusion Prevention (IPS): Inline deployment, blocking (drop, reject, rate limiting), false positives, signature updates.
Firewalls: Packet filtering (stateless), stateful, application/proxy, NGFW (DPI, application awareness, user identity, threat intelligence); deployment architectures (screened host, screened subnet, DMZ, internal segmentation).
Security Analytics: SIEM (log management, correlation, alerting), UEBA, threat hunting, threat intelligence integration, IOCs.
Secure Internet Protocols: IPsec architecture (SA, SPD, SAD, IKE), AH and ESP, transport vs. tunnel mode; TLS (handshake, certificate validation, cipher suites, TLS 1.3).
VPNs: Site-to-site and remote-access VPNs; IPsec vs. SSL/TLS VPNs; cloud VPNs.
Secure Email: S/MIME (PKI) vs. PGP (web of trust); digital signatures, encryption, enveloped data.
Security Standards: IETF RFC process, NIST SP 800 series, NIST CSF, ISO/IEC 27000 series; interoperability, compliance, procurement.
Security Operations: SOC structure, monitoring integration, incident response lifecycle (NIST SP 800-61), evidence collection, chain of custody, reporting, escalation, post-incident review, SOAR.

Key Takeaway: Unit 4 covered the entire spectrum of security systems and models, from detection to prevention to response, providing the tools to build a comprehensive defense.

2. Integrative Framework: Defense-in-Depth and Layered Security

The various security systems and models in Unit 4 are not isolated; they form a layered defense strategy. The defense-in-depth model positions multiple layers of controls to protect against failures in any single layer. The NIST Cybersecurity Framework (Identify, Protect, Detect, Respond, Recover) provides a useful organizing structure.

┌─────────────────────────────────────────────────────────────────────────────┐ │ DEFENSE-IN-DEPTH INTEGRATION │ ├─────────────────────────────────────────────────────────────────────────────┤ │ │ │ ┌─────────────────────────────────────────────────────────────────────┐ │ │ │ Identify (Asset Management, Risk Assessment) │ │ │ │ - Threat intelligence, vulnerability management │ │ │ └─────────────────────────────────────────────────────────────────────┘ │ │ │ │ │ ┌─────────────────────────────────────────────────────────────────────┐ │ │ │ Protect (Access Control, Awareness, Data Security) │ │ │ │ - Firewalls (NGFW), IPS, VPNs, secure email, PKI, IAM, encryption│ │ │ └─────────────────────────────────────────────────────────────────────┘ │ │ │ │ │ ┌─────────────────────────────────────────────────────────────────────┐ │ │ │ Detect (Anomalies, Events, Continuous Monitoring) │ │ │ │ - IDS (HIDS/NIDS), SIEM, UEBA, threat hunting, IOCs │ │ │ └─────────────────────────────────────────────────────────────────────┘ │ │ │ │ │ ┌─────────────────────────────────────────────────────────────────────┐ │ │ │ Respond (Incident Response, Mitigation) │ │ │ │ - SOC, incident response lifecycle, SOAR, evidence collection │ │ │ └─────────────────────────────────────────────────────────────────────┘ │ │ │ │ │ ┌─────────────────────────────────────────────────────────────────────┐ │ │ │ Recover (Business Continuity, Restoration) │ │ │ │ - Backups, disaster recovery, post-incident review │ │ │ └─────────────────────────────────────────────────────────────────────┘ │ │ │ └─────────────────────────────────────────────────────────────────────────────┘

Figure 1: Integrating Unit 4 Technologies into NIST CSF

Zero Trust principles (never trust, always verify) further inform the integration: micro-segmentation (internal firewalls), continuous validation (UEBA, SIEM), and least privilege (access controls). The technologies from Unit 4 are the enablers of Zero Trust.

Key Takeaway: The security systems and models in Unit 4 are complementary components of a layered defense that spans the entire threat lifecycle, from identification to recovery.

3. Case Study 1: Advanced Persistent Threat (APT) Attack

3.1 Scenario

A large defense contractor, DefenseTech Inc., has been targeted by a sophisticated APT group (aligned with a nation-state). The attackers are seeking intellectual property related to next-generation military systems. The attack unfolds over several months.

3.2 Attack Timeline and Controls

Phase	Attacker Action	Defensive Controls & Detection
Reconnaissance	OSINT on employees, social media, job postings; scanning public IP ranges.	Threat intelligence (identifies scanning patterns); vulnerability management; network segmentation to limit exposure.
Initial Access	Spear-phishing email with a malicious Word document to a senior engineer.	Email security gateway (spam filtering, attachment sandboxing); user awareness training; EDR (detects macro execution).
Establish Foothold	Macro downloads and executes a backdoor; establishes C2 over HTTPS.	NIDS/IPS with SSL inspection (decryption) detects anomalous outbound connections; NGFW with threat intelligence blocks known malicious domains.
Privilege Escalation	Exploits a local vulnerability (zero-day) to gain administrator rights.	Host-based IPS (HIPS) or EDR detects privilege escalation via system call monitoring; SIEM correlates with vulnerability data; patch management reduces exposure.
Lateral Movement	Uses stolen credentials to move to other systems, using SMB and RDP.	Network segmentation (internal firewalls) limits lateral movement; NIDS detects anomalous SMB/RDP traffic; UEBA flags unusual login patterns.
Persistence	Installs scheduled tasks and registry entries to maintain access.	HIDS file integrity monitoring (FIM) detects changes; EDR monitors process persistence.
Data Exfiltration	Compresses and encrypts data, exfiltrates via encrypted channels to cloud storage.	DLP (data loss prevention) detects outbound data patterns; NIDS with DPI may detect large data transfers; UEBA flags anomalous data access.

Table 1: APT Attack Phases and Defensive Controls

3.3 Analysis

DefenseTech's security posture was not breached because they had integrated defenses:

Email security blocked the initial phishing attempt (the malicious attachment was detected by sandboxing).
EDR on the endpoint detected the macro and blocked execution.
NGFW with threat intelligence would have blocked the C2 domain.
SIEM correlation of failed logins and lateral movement would have alerted the SOC.
Internal firewalls and segmentation limited the blast radius.

The attack was prevented at multiple layers. However, if a zero-day exploit had succeeded, incident response would have been triggered, with SOAR automating containment and forensic evidence collection ensuring a post-incident review.

Key Takeaway: An APT attack requires a multi-layered defense across the entire kill chain; no single control is sufficient; integration is key.

4. Case Study 2: Ransomware Attack and Incident Response

4.1 Scenario

HealthCare Plus, a regional hospital network, experiences a ransomware outbreak. The attack starts with a phishing email that leads to the installation of ransomware on a single workstation, which quickly encrypts files and attempts to spread across the network.

4.2 Attack and Response Timeline

T=0: Employee opens a malicious Excel attachment, enabling macros. The malware downloads a ransomware executable.
T=5 min: Ransomware begins encrypting local files; EDR alerts on multiple file write events.
T=10 min: SOC Tier 1 analyst triages the alert, confirms malware, and escalates to Tier 2.
T=15 min: Tier 2 initiates containment: isolate the workstation from the network (via firewall policy or EDR response).
T=20 min: Incident Response team activates; they identify the ransomware variant (e.g., LockBit) and gather intelligence.
T=1 hour: The team checks backups; they have recent, clean backups stored off-site and offline.
T=2 hours: Eradication: remove the ransomware from the infected system and any other compromised endpoints.
T=4 hours: Recovery: restore encrypted files from backups; verify data integrity.
Post-incident: Conduct a review; identify that the phishing email bypassed the email gateway; implement additional email filtering and MFA.

4.3 Controls Involved

Email gateway – should have blocked the phishing email; review and enhance.
EDR – provided the initial detection and allowed rapid isolation.
Firewall – used to isolate the infected host.
Backup and recovery – essential for restoration.
Incident Response – structured process ensured timely response.
Network segmentation – if implemented, would have limited the spread.

4.4 Lessons Learned

Email security must be strengthened (DMARC, advanced threat protection).
MFA should be enforced for all remote access.
Regular tabletop exercises improve response speed.
Offline backups are critical to ransomware recovery.

Key Takeaway: Ransomware response requires rapid containment, eradication, and recovery; detection (EDR, SIEM) and incident response integration are vital.

5. Case Study 3: Insider Threat and Data Loss

5.1 Scenario

FinSecure Bank detects that a senior financial analyst, who has been given a poor performance review, has been accessing large volumes of customer records outside normal business hours. The analyst is planning to sell the data to a competitor.

5.2 Detection and Investigation

UEBA flagged the analyst's behavior: unusual access to customer records, downloading large files, and accessing data not related to their current projects.
SIEM correlated with login logs, showing that the analyst was logging in from an unusual location (a coffee shop) after hours.
DLP (Data Loss Prevention) detected an attempt to copy a large dataset to a USB drive (blocked by DLP policy).
Log analysis revealed that the analyst had accessed sensitive files and sent emails with attachments to an external address.

5.3 Response

The SOC escalated to the incident response team and legal/HR.
The analyst's access was revoked (but with preservation of evidence).
Forensic investigation confirmed the data theft intent.
The analyst was terminated, and legal action was pursued.
Post-incident review enhanced DLP policies and tightened access controls.

5.4 Controls Involved

UEBA – detected behavioral anomalies.
SIEM – correlated events.
DLP – prevented data exfiltration.
Privileged Access Management (PAM) – would have limited the analyst's access.
Logging and monitoring – provided the evidence.

Key Takeaway: Insider threats can be detected using behavioral analytics and data protection controls; response must involve legal and HR, and evidence must be preserved.

6. Case Study 4: Secure Communication Architecture

6.1 Scenario

GlobalCorp is a multinational corporation with headquarters in New York, data centers in London and Singapore, and 50 branch offices worldwide. They need to secure communications across all locations, remote workers, and external partners (e.g., suppliers). They also need to ensure email confidentiality and integrity.

6.2 Design

Site-to-Site VPNs: Use IPsec with IKEv2, certificate-based authentication, AES-256-GCM, and PFS for connecting branch offices to data centers. Deploy in hub-and-spoke with redundancy.
Remote Access: Use SSL/TLS VPN (e.g., Cisco AnyConnect) for remote workers, integrated with MFA (SMS/authenticator).
Cloud Connectivity: Use cloud-native VPN (AWS Site-to-Site) to connect on-prem to cloud VPCs.
Secure Email: Deploy S/MIME for internal email (using corporate PKI) and PGP for external secure email with partners who prefer it. Use a hybrid approach.
PKI: Establish a corporate PKI with an internal root CA for certificates; use Let's Encrypt for public-facing TLS certificates.
Standards Compliance: Align with NIST SP 800-52 for TLS, ISO 27001 for ISMS, and IETF RFCs for IPsec and TLS.

6.3 Rationale

IPsec provides network-layer security for all traffic, transparent to applications.
SSL/TLS VPN offers flexibility for remote workers and is firewall-friendly.
S/MIME and PGP provide end-to-end email security.
PKI enables authentication and non-repudiation.

Key Takeaway: A secure communication architecture integrates multiple protocols and standards to provide comprehensive protection for data in transit.

7. Synthesis: Designing a Security Architecture

Now, integrate all Unit 4 concepts into a single security architecture for a fictitious enterprise. EduTech Inc. is an educational technology company with 1,500 employees, a multi-cloud environment (AWS, Azure), on-premises data center, and remote workers. They handle sensitive student data and intellectual property.

7.1 Requirements

Protect against external attacks (phishing, malware, APTs).
Detect and respond to insider threats.
Ensure secure remote access for all employees.
Comply with GDPR and FERPA regulations.
Implement a Zero Trust model.

7.2 Proposed Architecture

Perimeter: NGFW with IPS and threat intelligence; DDoS protection.
Network Segmentation: Internal firewalls to segment departments (R&D, HR, Finance).
Endpoint Security: EDR on all endpoints, with HIDS capabilities (FIM, log monitoring).
SIEM and UEBA: Central SIEM with user behavior analytics.
Threat Hunting: Dedicated Tier 3 analysts.
Secure Communications: IPsec VPNs for site-to-site, SSL/TLS VPN for remote workers, TLS 1.3 for all web services.
Email Security: Secure email gateway with sandboxing, S/MIME for internal, PGP for external.
Incident Response: Established IR plan, SOAR for automation, and regular tabletop exercises.
Compliance: NIST CSF framework, ISO 27001 certification.

7.3 Integration with Zero Trust

Micro-segmentation via internal firewalls.
Continuous verification using UEBA and SIEM.
Least privilege access control.

Key Takeaway: A comprehensive security architecture integrates all Unit 4 systems and models into a unified defense that addresses the entire threat landscape.

📌 Summary

This capstone tutorial integrated all the concepts from Unit 4 through comprehensive case studies and synthesis. We began with a recap of the major topics: intrusions, threat actors, IDS, IPS, firewalls, security analytics, secure protocols (IPsec, TLS, VPNs, secure email), security standards, and security operations. We then presented an integrative framework mapping these technologies to the NIST CSF and defense-in-depth model.

Four detailed case studies illustrated the practical application of Unit 4 concepts:

APT Attack: Demonstrated how layered defenses (NGFW, IDS/IPS, SIEM, EDR) can detect and prevent a sophisticated, multi-stage attack.
Ransomware: Showcased the importance of EDR, network segmentation, backups, and rapid incident response.
Insider Threat: Highlighted the use of UEBA, DLP, and privileged access monitoring to detect and respond to malicious insiders.
Secure Communication Architecture: Integrated IPsec, TLS, VPNs, and secure email protocols to protect data in transit across a global enterprise.

Finally, we synthesized all concepts into a security architecture design exercise for a fictitious company, reinforcing the need for an integrated, defense-in-depth approach.

The key takeaway is that modern cybersecurity requires a holistic strategy that combines prevention, detection, response, and recovery, enabled by a diverse set of security systems and models. No single technology is sufficient; integration and continuous improvement are essential. This concludes Unit 4. You are now well-prepared for Unit 5: Systems Security, which will dive into operating system security, application security, and secure coding.

Next: Unit 5: Systems Security (Tutorial 5.1).

📝 Quiz

1. In the APT case study, which control is most effective at detecting lateral movement?

A. Firewall
B. UEBA
C. NIDS
D. Email gateway

Answer

C. NIDS (network-based intrusion detection) can detect anomalous traffic patterns indicative of lateral movement, especially when combined with SIEM correlation.

2. Which of the following is a primary benefit of integrating SIEM with threat intelligence?

A. Reducing log volume
B. Providing context and prioritization for alerts
C. Replacing EDR
D. Automating all responses

Answer

B. Threat intelligence enriches alerts with context (e.g., threat actor attribution, known malicious indicators), enabling better prioritization.

3. In the ransomware case study, what was the critical factor that enabled recovery?

A. Strong passwords
B. Offline, clean backups
C. Antivirus software
D. Firewall rules

Answer

B. Offline backups allowed restoration of encrypted data without paying the ransom.

4. Which security control is most directly associated with detecting insider threats?

A. Firewall
B. UEBA
C. IPsec
D. TLS

Answer

B. UEBA (User and Entity Behavior Analytics) is specifically designed to detect anomalous user behavior.

5. In a secure communication architecture, which protocol would you use for site-to-site VPNs?

A. TLS
B. IPsec
C. SSH
D. S/MIME

Answer

B. IPsec is the standard for site-to-site VPNs, providing network-layer security.

6. Which of the following is a key principle of Zero Trust that is enabled by internal segmentation firewalls?

A. Implicit trust
B. Micro-segmentation
C. Single perimeter
D. Static passwords

Answer

B. Internal segmentation firewalls enable micro-segmentation, a core Zero Trust principle that limits lateral movement.

7. In the APT attack, which phase is most effectively countered by user awareness training and email filtering?

A. Lateral movement
B. Initial access
C. Data exfiltration
D. Persistence

Answer

B. Initial access via phishing can be prevented by user awareness and email filtering.

8. Which standard is specifically designed to ensure interoperability of security products?

A. ISO 27001
B. NIST CSF
C. IETF RFCs
D. NIST SP 800-53

Answer

C. IETF RFCs define protocols that ensure interoperability (e.g., IPsec, TLS).

9. Which incident response phase involves restoring systems and data to normal operation?

A. Containment
B. Eradication
C. Recovery
D. Post-incident

Answer

C. Recovery restores systems and data to normal operation after eradication.

10. Which of the following is a benefit of using a SOAR platform?

A. It reduces the need for security analysts
B. It automates repetitive tasks and orchestrates responses
C. It replaces SIEM
D. It encrypts all data

Answer

B. SOAR automates and orchestrates response actions, improving efficiency and consistency.

11. In the context of secure email, which standard uses a hierarchical PKI with CAs?

A. PGP
B. S/MIME
C. OpenPGP
D. SMTP

Answer

B. S/MIME uses a hierarchical PKI with Certificate Authorities (CAs).

12. Which of the following is NOT a component of a comprehensive security architecture as discussed in the synthesis section?

A. NGFW
B. SIEM
C. Physical access control
D. IPsec VPNs

Answer

C. Physical access control was not explicitly discussed; while important, it is not a core Unit 4 topic.

🛠️ Exercises

Exercise 1: APT Attack Mapping Intermediate

For the APT attack described in Case Study 1, map each phase of the attack to a specific MITRE ATT&CK technique (e.g., T1566 - Phishing, T1078 - Valid Accounts, T1021 - Remote Services). For each technique, identify at least one defensive control from Unit 4 that can detect or prevent it.

Sample Solution

Initial Access: T1566 - Phishing; Control: Email filtering, user training.
Execution: T1059 - Command and Scripting Interpreter; Control: EDR/application whitelisting.
Privilege Escalation: T1068 - Exploitation for Privilege Escalation; Control: HIPS, vulnerability management.
Lateral Movement: T1021 - Remote Services (RDP); Control: NIDS, internal firewalls.
Exfiltration: T1048 - Exfiltration Over Alternative Protocol; Control: DLP, NIDS with DPI.

Exercise 2: Ransomware Playbook Advanced

Develop a detailed incident response playbook for a ransomware attack. Include steps for detection, containment, eradication, recovery, and communication. Specify roles and responsibilities. Use the NIST SP 800-61 lifecycle.

Sample Solution

Playbook Outline:

Preparation: Backups, EDR deployment, IR team trained.
Detection: Alert from EDR (file encryption), SIEM correlation (multiple file writes).
Containment: Isolate infected host (network block), disable user accounts, block C2 IPs.
Eradication: Remove malware, identify root cause (phishing, vulnerability), wipe and reinstall if necessary.
Recovery: Restore from offline backups, validate data integrity, monitor for reinfection.
Communication: Internal: IT, management, legal. External: regulators, customers (if data breached).
Post-incident: Lessons learned, update policies, improve controls.

Exercise 3: Insider Threat Investigation Intermediate

You are a forensic analyst investigating the insider threat case (Case Study 3). Outline the steps you would take to collect evidence, preserve chain of custody, and analyze the data. Include the types of logs and data you would examine.

Sample Solution

Preserve the analyst's workstation (disk image with write-blocker).
Collect logs: Active Directory authentication logs, SIEM logs, email logs, DLP alerts, file access logs.
Examine USB device history, network connections, and process execution.
Document all actions with timestamps for chain of custody.
Correlate findings to establish timeline and intent.

Exercise 4: Secure Communication Design Advanced

Design a secure communication architecture for a global law firm with offices in 20 countries, 5,000 employees, and many external clients. They need secure email, remote access for lawyers, and site-to-site connectivity. Specify protocols, authentication methods, and key management.

Sample Solution

Site-to-site: IPsec with IKEv2, certificate-based auth, AES-256-GCM.
Remote access: SSL/TLS VPN (e.g., Cisco AnyConnect) with MFA.
Email: S/MIME for internal and client communication using a corporate PKI; for clients without S/MIME, use a secure portal.
Key Management: Internal PKI for S/MIME and IPsec; certificates issued by internal CA.
Standards: TLS 1.3 for web, NIST SP 800-52.

Exercise 5: Security Architecture Synthesis Advanced

Using the EduTech Inc. scenario, design a comprehensive security architecture that integrates all Unit 4 technologies. Provide a detailed diagram (ASCII or described) and a justification for each component. Include how you would address the Zero Trust requirements.

Sample Solution

Architecture:

Perimeter: NGFW with IPS, DDoS protection, and threat intelligence.
Network: Internal segmentation firewalls for departments; micro-segmentation using SDN.
Endpoint: EDR with HIDS capabilities.
Monitoring: SIEM with UEBA, threat intelligence feeds, and SOAR for automation.
Secure Connectivity: IPsec VPNs for sites, SSL VPN for remote users, TLS 1.3 for web.
Email: Secure email gateway, S/MIME for internal.
IR: Established IR plan, tabletop exercises, evidence collection procedures.
Zero Trust: Continuous authentication via UEBA, least privilege via PAM, micro-segmentation.

Justification: Each component addresses a specific threat vector and contributes to a layered defense.

📚 Homework

Homework 1: Write a 2,500-word capstone paper that synthesizes all Unit 4 topics. Choose a real-world organization (e.g., a bank, hospital, or tech company) and propose a comprehensive security architecture using the concepts from Unit 4. Include a risk assessment, threat modeling, and a detailed justification for each control. Reference relevant standards (NIST, ISO) and protocols.

Sample Answer

Key points: Introduce the organization, its assets, and threats. Apply NIST CSF to structure the architecture. Describe perimeter, network, endpoint, and application controls. Discuss secure communications, monitoring, and incident response. Reference specific standards and protocols. Conclude with a roadmap and budget considerations.

Homework 2: Conduct a security assessment of a fictional company's existing security posture based on the Unit 4 topics. Identify gaps and propose a prioritized remediation plan. Use a scoring system (e.g., from 1 to 5) for each control area.

Sample Answer

Assessment: Evaluate firewalls, IDS/IPS, SIEM, email security, endpoint security, secure communications, IR. Identify missing or weak controls. Prioritize based on risk (high, medium, low). Propose timeline and cost estimates.

Homework 3: Write a case study analysis of a recent major cyber incident (e.g., the SolarWinds attack, Colonial Pipeline). Map the attack to the Unit 4 concepts and assess which controls could have prevented or mitigated the incident. Provide recommendations.

Sample Answer

Example: SolarWinds attack: supply chain compromise. Analysis: lack of supply chain security, insufficient monitoring of trusted updates. Recommendations: implement NGFW with IPS, SIEM correlation, threat hunting, and Zero Trust principles.

Homework 4: Design a comprehensive incident response plan that integrates SIEM, SOAR, and threat intelligence. Include sample playbooks for phishing, malware, and insider threat scenarios.

Sample Answer

Plan outline: IR team structure, communication plan, escalation matrix, playbooks for each scenario, integration with SIEM for alerting, SOAR for automation, and threat intelligence for enrichment.

Homework 5: Research and compare the secure email solutions (S/MIME and PGP) and secure messaging (Signal Protocol) in terms of cryptographic strength, trust models, and usability. Write a recommendation for a multinational enterprise.

Sample Answer

Comparison: S/MIME uses PKI, PGP uses web of trust, Signal Protocol uses double ratchet. For enterprise, S/MIME is easier to manage with corporate PKI, while PGP is better for external partners. Signal Protocol is excellent for real-time messaging. Recommendation: Use S/MIME for email, Signal for internal messaging, and a secure portal for external communication.

COMP400 – Computer and Network Security (Revision 3) • Unit 4: Security Systems and Models