Lab 3 assignment

Anonymous
timer Asked: Nov 29th, 2017
account_balance_wallet $10

Question Description

Attached,please,find the assignment

Unformatted Attachment Preview

CSIA 310: Cybersecurity Processes & Technologies Lab Activity #3: Investigate System Backup and Restore Tools Purpose: Assess and Document Tools to Backup and Restore the System Hard Drive for a Windows 8.1 Workstation. 1. Assess and document the use of a system backup tool or disk imaging utility to create a “known-good” copy of the system hard drive for a Windows 8.1 Workstation. 2. Assess and document the use of “known-good” copies of system hard drives to restore system availability after an incident. Overview: For this activity, we will focus upon assessing and documenting tools which are used in the preparation phase and in the containment, eradication, and recovery phase of the Incident Response Process (as defined in NIST SP 800-61r2). These tools will support incident responders by providing “access to images of clean OS and application installations for restoration and recovery purposes" (Cichonski, Millar, Grance, & Scarfone, 2012, p. 23). Situation Report: Recent contracts with the Departments of Defense and Homeland Security have imposed additional security requirements upon the company and its SCADA lab operations. The company is now required to comply with NIST Special Publication 800-171 Protecting Controlled Unclassified Information in Nonfederal Information Systems and Organizations. The company must also comply with provisions of the Defense Federal Acquisition Regulations (DFARS) including section 252-204-7012 Safeguarding Covered Defense Information and Cyber Incident Reporting. These requirements are designed to ensure that sensitive technical information, provided by the federal government and stored on computer systems in the Sifers-Grayson SCADA lab, is protected from unauthorized disclosure. This information includes software designs and source code for Industrial Control Systems for which Sifers-Grayson is providing software support and maintenance. The contract requirements also mandate that SifersGrayson report cyber incidents to the federal government in a timely manner. The engineering and design workstations in the Sifers-Grayson SCADA Lab were upgraded from Windows XP to Windows 8.1 professional three years ago after the lab was hit with a ransomware attack that exploited several Windows XP vulnerabilities. A second successful ransomware attack occurred three months ago. The company paid the ransom in both cases because the lab did not have file backups that it could use to recover the damaged files (in the first case) and did not have system backups that it could use to rebuild the system hard drives (in the second case). The SCADA Lab is locked into using Windows 8.1. The planned transition to Windows 10 is on indefinite hold due to technical problems encountered during previous attempts to modify required Copyright ©2017 by University of Maryland University College. All Rights Reserved. CSIA 310: Cybersecurity Processes & Technologies software applications to work under the new version of the operating system. This means that an incident response and recovery capability for the lab must support the Windows 8.1 operating system and the related engineering software applications. But, the customer’s technical representatives have strongly suggested that Sifers-Grayson personnel use backup utilities that are not specific to the Windows 8.1 operating system. Reference Cichonski, P., Millar, T., Grance, T., & Scarfone, K. (2012). Computer security incident handling guide (NIST SP 800-62 rev. 2). http://dx.doi.org/10.6028/NIST.SP.800-61r2 Your Task Prepare draft incident response guidance to be included in the Sifers-Grayson Incident Responder’s Handbook. Your draft guidance will explain the use of a commercially available system hard drive backup tool. Your guidance will explain how to use your selected third-party tool to create either a system backup or a system image (bit for bit copy) of the system hard drive for a Windows 8.1 workstation. Suggested tools include: Acronis, FTK Imager, and Paladin. You will create two separate procedures. The first will explain how to perform a backup. The second will explain how to use the known-good backup to restore the system hard drive (also, how to restore to a new hard drive). Both procedures must address the use of cryptographic hash codes (e.g. MD5 or SHA-256) to verify the integrity of the backup files and/or system image files. Instructions Part (a): Creating a “Known-Good” (Clean) Disk Image for a Windows 8.1 Workstation 1. Using the Internet, research commercially available system backup tool or application. (Do not use any features or utilities that are part of the Windows operating system.) Then, identify appropriate sources of information and instructions for your selected tool. Using those sources, research the procedures required to a. Create a “known good” copy (system backup or complete system image) of the hard drive containing the Windows 8.1 system and installed applications for a workstation in the SCADA lab. b. Generate a hash code for use in verifying the validity and integrity of the backup file or system image file. (If your backup utility does not provide this, you will need to find a separate tool that will generate an MD-5 or SHA-256 hash value for the image file or backup file. See https://www.howtogeek.com/67241/htg-explains-what-aremd5-sha-1-hashes-and-how-do-i-check-them/ for an explanation of file integrity checking using hash codes.) Copyright ©2017 by University of Maryland University College. All Rights Reserved. CSIA 310: Cybersecurity Processes & Technologies c. You should also research and document best practices for labeling and storing the digital media containing the backup files and/or system image files. The storage location should provide secure storage yet be readily available to incident responders in the event of an incident. The label or storage log should include the hash value for each backup file and system image file. 2. Identify how the backup tool could be used during the preparation phase of the incident response and recovery process. Typical uses include: a. Create a “known good” backup that contains a complete, verified and approved system configuration that includes the operating system and all required application software. b. Create a copy of the original operating system installation (before software applications are installed). 3. Write a guidance document that identifies the tool, explains the capabilities it provides, and then lists and briefly describes the recommended uses identified under item #2. Add a list of resources that can be consulted for additional information. Next, summarize the procedures required to perform the tasks listed under item #1 (do not provide step-by-step instructions). Close your guidance document with a Notes / Warnings / Restrictions section that answers the question “Is there anything else the incident responder needs to be aware of when using this tool?” Part (b): Using a “Known-Good” (Clean) Disk Image to Restore the System Hard Drive for a Windows 8.1 Workstation 1. Use the same tool and tool research as performed for part (a) of this lab. If necessary, identify additional sources of information and instructions for using your selected tool(s) to perform the following tasks: a. Verify the validity of the backup image or file (using the hash code). b. Use the “known good” copy (system backup or system image) to rebuild a workstation hard drive so that it contains the Windows 8.1 operation system and installed applications. 2. Identify how the tool could be used during the containment, eradication & recovery phase of the incident response and recovery process. Typical uses include: a. Restore workstation hard drives to a “known good” configuration. b. Build a new system disk using a replacement or newly purchased hard drive. c. Restore the system to full operating status after an attack or suspected attack. 3. Write a guidance document that identifies the tool, explains the capabilities it provides, and then lists and briefly describes the recommended uses identified under item #2. Add a list of resources that can be consulted for additional information. Next, summarize the procedures Copyright ©2017 by University of Maryland University College. All Rights Reserved. CSIA 310: Cybersecurity Processes & Technologies required to perform the tasks listed under item #1 (do not provide step-by-step instructions). Close your guidance document with a Notes / Warnings / Restrictions section that answers the question “Is there anything else the incident responder needs to be aware of when using this tool?” Finalize Your Deliverable 1. Using the grading rubric as a guide, refine your incident response guidance. Your final products should be suitable for inclusion in the organization’s Incident Responder’s Handbook. Remember that you are preparing multiple guidance documents, which must be presented separately. 2. As appropriate, cite your sources using footnotes or another appropriate citation style. 3. Use the resources section to provide information about recommended readings and any sources that you cite. Use a standard bibliographic format (you may wish to use APA since this is required in other CSIA courses). Information about sources and recommended readings, including in-text citations, should be formatted consistently and professionally. 4. Your submission file for this assignment should start with a title page which lists the following information: • Lab Title and Number • Date • Your Name 5. The CSIA 310 Template for Lab Deliverable.docx file is set up to provide the required title page and two incident response guidance templates. Use the first template for your “How to Backup” guidance. Use the second procedure template for your “How to Restore” guidance. Copyright ©2017 by University of Maryland University College. All Rights Reserved. ...
Purchase answer to see full attachment

Tutor Answer

professor.sherryT
School: University of Virginia

Attached.

Running head: CAREER PORTFOLIO

1

Career Portfolio
Name of student
Name of Instructor
Course title
Date

Running head: CAREER PORTFOLIO

2

CAREER PORTFOLIO
Name of Student
Name of Instructor
Course Title

Running head: CAREER PORTFOLIO

3

Running head: CAREER PORTFOLIO

Table of contents
page

1. Introduction
2. Professional Emphasis
3. Community Service(s)
4. Professional Periodicals & Conferences
5. Professional Development
6. Internship & Volunteer Work
7. Interviews
8. Appendix

4

Running head: CAREER PORTFOLIO

5

Introduction
My whole life I have strived to better myself through learning new things, meeting new
people, and putting myself in a position to have opportunity. Whether this means pursuing
individual study on various subjects such as religion and literature, teaching myself to play guitar, or
enrolling in classes at the University, my goal is to become better for it in the end. In doing so, I see
my major strengths and attributes as being flexible and motivated. I have been in the IT field since
September 1998. Mostly in some sort of Network Operations role supporting computer networks,
I'm currently a Senior network engineer, and I can see the future role of the network engineer
changing where it may either be merged with Programming or IT Security. Knowing the intrinsic
value I derive from pursuing these endeavours, I am certain I have the drive and ability to
consistently better myself. In the process of attempting to reach my own goals, I have learned that
within the human service industry it’s very rewarding to help other attain theirs as well. This could
mean tutoring adjudicated youth or assisting in drug and alcohol counselling. Instilling agency values
into others while reinforcing the core beliefs of the people I’ve worked with is a challenging and
rewarding venture.

2. Professional Emphasis
I studied at the following institutions: Prince George’s Community College, Largo
Md.
Cyber Security AAS. (54 credits towards degree)
Computer Learning Centre, Alexandria, VA
Network Engineering and Management.

Running head: CAREER PORTFOLIO

6

I am highly skilled in the following fields:

IP, IPV6, Static, DNS, BGP, ISIS, OSPF, EIGRP, Multicast, Serial, VPLS, PPP,
VTP, 802.1 Q Trunking, TLS, IOS, IOS-XE, NX-OS
VLAN, HSRP, VOIP, SIP, Site to Site VPN, VTI, VRF/VRF lite, Load balancing,
GSLB, VPC, MEC, VSS, Cisco ISE.
Remedy, Omni Peek, Riverbed App Response Expert & Transaction, Solar Winds,
PRTG, Cisco Prime, Microsoft Windows 10, Microsoft Office 2016 Visio 2013, Ubuntu
linux, Microsoft Server 2016.
Cisco 7200, ISR 4451, ASR 903, ASR 1000x routers,
Cisco 3650, 3850, 450x switches, Nexus 5 & 7K switches, Juniper MSeries
routers. Cisco AS 5500x Firewa...

flag Report DMCA
Review

Anonymous
Thanks, good work

Brown University





1271 Tutors

California Institute of Technology




2131 Tutors

Carnegie Mellon University




982 Tutors

Columbia University





1256 Tutors

Dartmouth University





2113 Tutors

Emory University





2279 Tutors

Harvard University





599 Tutors

Massachusetts Institute of Technology



2319 Tutors

New York University





1645 Tutors

Notre Dam University





1911 Tutors

Oklahoma University





2122 Tutors

Pennsylvania State University





932 Tutors

Princeton University





1211 Tutors

Stanford University





983 Tutors

University of California





1282 Tutors

Oxford University





123 Tutors

Yale University





2325 Tutors