ICTCYS407 Gather, Analyse and Interpret Threat Data

Assessment 2 Overview

The purpose of this assessment task is to demonstrate the skills and knowledge required to gather data from various sources, analyse, and interpret information for threats, inconsistencies and discrepancies.

▢ You may use resources on the Skillage I.T. website to assist you with completing this assessment.

▢ You must use any templates provided to document your answers for each of the activities that make up this project.

▢ You must follow the word limits specified in the templates.

▢ Your trainer/assessor will assess you using the performance checklists provided.

Assessment Scenario:

You have just started working as an IT Consultant with Skillage I.T. Your supervisor is Alexander Hillman, one of the IT Consultants at Skillage I.T.

Your supervisor Alexander has advised you that your task is to familiarise yourself with the cyber security strategy.

Assessment requirements

Successful submission of the project means that you submit evidence for each of the Activities listed below.

Activity 1: Gather, analyse, interpret and finalise threat data

Task 1: Interpret Threat Data Report

In this assessment activity, you are required to demonstrate your skills to analyse threat data. 

A Threat Intelligence Service collects raw data from multiple sources on current or emerging threats and threat actors and compiles it into a historic data breach log. The data includes the date the information was made public, the company involved, the type of breach, along with the description of the incident. This resource is available for you to view in ‘Other Resources’ called Skillage IT Data Breach Log.

Data from different sources of threats vary in consistency and structure and need to be checked. Validating data includes the compilation, sorting and interpretation of human and computer analysis methods.

You are required to process and filter this data in the form of an administrative report to provide useful information. Your primary aim is to make sure the organisation recognises and defends itself against zero-day attacks, advancing persistent threats and exploitations.  

Create a short report to give to your supervisor Alexander to interpret and summarise the data you have found in the Skillage IT Data Breach Log:

▢ Include details of common types of breaches with examples.

▢ Suggestions of the top three threats that pose the biggest risk.

▢ Identify possible security equipment for data and networks.

▢ Identify the legislative requirements, including government requirements, for the handling of threat data.

▢ Identify Skillage IT’s organisational policies and procedures for the handling of threat data.

Task 2: Identify Threats Report

In this assessment activity, you are required to demonstrate your skills to identify potential threats.

Apparent threats also add to the whole pool of threats to recognise trends that suggest suspected or malignant behaviour and are also aligned with technological categorisation indicators. Finally, the data is translated into structures that provide insights into the strategies and actions of evolving or advanced threats and threat actors.

Ultimately, the knowledge of vulnerabilities and threats must be reliable, timely, customer-relevant, consistent with customer security policies and easily integrated into current security systems.

In ‘Other Resources’, you will find a file called Skillage IT Defender Events. In this assessment activity, you are required to create another short report for Alexander identifying at least three different threats from the log of events. These could be inconsistent IP Addresses, Malicious domains, Malicious URLs, Phishing URLs, Malware hashes or similar.

▢ Document your findings including:

Existing threats 

Emerging threats

Threat actors and their motives 

▢ Detail the risks and their likelihood of occurrence and the impacts of risks.

▢ Identify the current version of the security intelligence service.

▢ Discuss how you would check for false positives and false-negative results.

▢ Explain how to detect and describe discrepancies and inconsistencies in data.

▢ Suggest recommendations, strategies and action steps.

Task 3: Create Data Set Report

In this assessment activity, you are required to demonstrate your skills to gather threat data. 

Gather information from alerts, logs and reported events and create a dataset using your computer. Use these instructions to assist you.

To view Microsoft Defender Antivirus logs:

Open 

Event Viewer

.

In the console tree, expand 

Applications and Services Logs

, then 

Microsoft

, then 

Windows

, then 

Windows Defender

.

Double-click on 

Operational

.

In the details pane, view the list of individual events to find your event.

Click the event to see specific details about an event in the lower pane, under the 

General

 and 

Details

 tabs.

In this assessment activity, you are required to create another short report for Alexander explaining how to create a data set of threat data.

▢ Explain in your own words how you create an event log of threat data.

▢ Include screenshots of completing this task in Event Viewer on your own PC.

▢ Explain how to interpret threats from non-threat data.

▢ Explain how to analyse results for reliability and consistency.

▢ Discuss methods to distribute documentation to required personnel.

▢ Discuss methods to store documentation according to organisational policies and procedures.