CO4512- Information Security Management

Task

1.Learning Outcomes

This assignment addresses the following learning outcomes from the module syllabus:

LO1 – Select and use applicable standards and methods for information security and risk management.

LO3 – Conduct and properly document risk assessment based on a given scenario.

LO4 – Find and evaluate appropriate published information to remain up-to-date about threats, vulnerabilities and patches.

2.Assignment Description

This assignment requires you to plan, conduct and document a risk assessment based on the scenario described in Section 3. You should carefully read the marking scheme (refer to Section 5) to have a clear perception of what is the expected content of the risk assessment report you have to deliver and how it will be evaluated. 

The scenario is described in broad terms, therefore, you may need to make assumptions and set a scope for the risk assessment; all this has to be documented in the report. Additionally, any use of published information has to be properly referenced with in-text citation and a corresponding item in the references list using the Harvard style

3.Scenario Description

A cloud service provider in UK, CloudXYZ, hired your team to set up their IT network/system. The company provides (i) secure storage and (ii) virtual server services for both individual customers and organizations. The goal of the security system is to prevent or minimize the business loss caused by possible incidents, such as malfunction, information stealing, data modification, deletion or destruction, etc. Your colleagues in the team have proposed the first version of the security network architecture depicted in Figure 1. As a person responsible for risk assessment your task is to conduct a risk assessment on this system.

3.1.our task

The management board of the service provider would like to be sure if the proposed network system (in Figure 1) meets their goal, and hence, hired you, a security expert, to perform a risk assessment on this network. In this assignment you have to: 

1.Conduct a risk assessment on the network in Figure 1, based on the ISO standard.

2.Write a detailed risk assessment report (see Section 4 for the required structure).