IT-4336 B

Project part 2

Sub-Template for the MITRE ATT&CK Framework
This is the sub-template for the MITRE ATT&CK Framework for use in Project Part 2 for both
IT 4336 and ITW 4336. ONLY copy the sub-heading (you already have that in your template)
and the information below it in THIS document into your paper. I strongly recommend that you
use bullet points as I have below. Use the formatting provided below.
You will do the following two tactic / techniques (sub-technique) combinations:
1. Tactic – Defense Evasion. Technique – Impair Defenses; Sub-technique – your choice
among Disable or Modify Tools, Disable or Modify System FW, or Impair Command
History Logging, only one of these three.
2. Tactic – Initial Access. Technique – Phishing; Sub-technique – Spearphishing
Attachment
MITRE ATT&CK FRAMEWORK
Tactic – Defense Evasion
•
Technique name and ID # – then briefly describe it
o Sub-technique name and ID # – then briefly describe it
o Mitigation name and ID # – then briefly describe it. You must include how you
would employ / implement this in Security Consulting (only choose ONE)
o Detection name and ID # – then briefly describe it. You must include how you
would employ / implement this in Security Consulting (only choose ONE)
Tactic – Initial Access
•
Technique name and ID # – then briefly describe it
o Sub-technique name and ID # – then briefly describe it
o Mitigation name and ID # – then briefly describe it. You must include how you
would employ / implement this in Security Consulting (only choose ONE)
o Detection name and ID # – then briefly describe it. You must include how you
would employ / implement this in Security Consulting (only choose ONE)
IT 4336 Semester Project Part 2
Student Your Name
student@georgiasouthern.edu
FIREWALLS
Research and Selection of Firewalls
Here you need to give results of your research. You should present at least two and perhaps as
many as four specific possible firewall solutions. You must describe what type of firewall they
are (types as defined in our textbook). You might want to use bullet points for each possible
firewall. At the end of this sub-section, you MUST select (one or two firewalls) for Security
Consulting.
This sub-section should be 300 to 500 words in length.
Demilitarized Zone
Here you will need to describe how you would do this, incorporating the firewall(s) you chose
above. This should be about 200 to 300 words in length. Your DMZ can be of the two-firewall
type, or the multi-homed type shown in the Palo Alto configuration, your choice. But you must
provide your rationale for whichever type you choose.
RESEARCH AND RECOMMENDATION OF THE MOST APPROPRIATE VPN
TECHNOLOGY
This should document your research and selection of the VPNs you will use. It should be
multiple paragraphs long, containing the entirety of your research and selection of the VPNs you
will use. You must present a minimum of two specific possible VPN solutions, and as many as
three to four specific possible VPN solutions. Each possible solution must be described by type
of VPN. At the end of this section, you MUST select one or two VPNs for Security Consulting.
You might want to use bullet points for each possible VPN. It should be about 400 – 600 words
in length.
MITRE ATT&CK FRAMEWORK
Given two different Tactic/Technique combinations, here you will describe: one Mitigation for
each Enterprise Tactic / Technique; one technique addressed by that mitigation; and one method
of detection for that Enterprise Tactic / Technique. Each mitigation, technique, and method of
detection should be described in detail. This should be about 200 to 400 words in length.
See the separate document on the MITRE ATT&CK FRAMEWORK. Copy its template (at the
bottom of the document) into this document.
OVERALL NETWORK RECOMMENDATIONS
This should contain your detailed recommendations for the various components of the network
that you have previously discussed above, from authentication methods, to recommendations for
firewalls, VPNs, Network Address Translation (if you’re going to employ it) and anything else
that you have previously written about. If it was recommended to you that you change
items/recommendations in previous parts, those changes should be reflected here. You MUST
include analysis on how going to ERP software will change your network’s topology (it will)
and your network’s security posture (it will). This should be about 300 to 500 words in length.
Your references should be at the end of the document, as end notes. So they will be
automatically placed in the document. You won’t need to have a section entitled
REFERENCES.
IT 4336 – Fall 2023 – Semester Project – Part 2: Final Network Design
Administrative
Date Assigned: Wednesday, October 11, 2023
Due Dates (TWO):
•
•
•
Sunday, November 19, at 11:59 pm. Submissions made to the dropbox before
November 19 at 11:59 pm will receive a 10% bonus, regardless of your score. However,
do not submit what could be a sub-standard submission just to get the bonus if your work
is not complete.
Wednesday, November 22 at 11:59 pm. This is the final due date. Submissions
uploaded between Sunday, November 19 at 11:59 pm and Wednesday, November 22 at
11:59 pm will not receive the bonus, but they will also not receive a deduction. Their
grade will not be adjusted in any manner.
No submissions will be allowed after Wednesday, November 22 at 11:59 pm without
a verified absence from the Office of the Dean of Students, as described in the syllabus.
Value of this part: 7.5% of the overall grade for the course, or 75 points out of 1000
Scenario – Four Major Elements in Your Paper
1. Firewalls
The senior network architect at Security Consulting has informed you that the existing border
firewall is old and needs to be replaced. He recommends designing a demilitarized zone (DMZ)
to increase network perimeter security.
2. VPNs
As you are aware, many remote users will soon need access to the internal network and services.
A remote access and virtual private network (VPN) plan are needed to connect it all together.
The senior network architect has asked you to create the plan that will allow secure remote
access to the internal network while preventing unauthorized access. He specifically requested
that all information transferred between remote users and the organizational servers be protected
against snooping. That is what your VN will do.
3. MITRE ATT&CK Framework
Given two MITRE ATT&CK Framework Enterprise Tactics / Techniques, provide:
One Mitigation for each Enterprise Tactic / Technique; one technique addressed by that
Mitigation; and one method of detection for that Enterprise Tactic / Technique. One class
period will be dedicated to the MITRE ATT&CK Framework.
You will be given the two Enterprise Tactic/Technique combinations. You must use
those that you are given. Choosing any other Tactic/Technique combinations will result
in a zero for each incorrect combination. You don’t have a choice in this matter.
IT 4336 – Fall 2023 – Semester Project – Part 2: Final Network Design
4. Final Network Design
You are ready to create and submit a final network design and plan to the senior network
architect, who will present it to senior management and other decision makers. As you do this,
besides the comment below, please remember that the two departments, Sales, and Accounting
(which essentially represent ALL the various departments in the company) are in the SAME
DOMAIN and use the SAME network protocols. This should inform you as to how they
would be connected.
IMPORTANT – this was mentioned in the OVERALL document. Security
Consulting is going to SAP, which is ERP (Enterprise Resource Planning)
software. Databases and Application Programs are stored differently in ERP
software in terms of the use of (and number of) servers than Security
Consulting WAS using. You need to research this before coming up with your
overall network design.
Tasks
Element 1 – Firewalls:
1. Research and select firewalls for the Security Consulting network.
a. Describe each firewall, why you selected it, and where it should be placed for
maximum effectiveness.
b. Address network, server, and workstation firewalls.
2. Describe a plan for creating a DMZ and explain how it makes the network more secure.
See my comment in the template.
Element 2 – VPNs
1. Research and recommend the most appropriate VPN technology.
2. The most likely solution is either an Internet Protocol Security (IPSec) VPN or SSL/TLS
VPN. Describe the VPN technology and explain why it is the best choice for Security
Consulting.
Element 3 – MITRE ATT&CK Framework
Given two TACTICS / TECHNIQUES give for each, describing each bullet point in detail:
• One Mitigation for each Enterprise Tactic / Technique.
• One Technique Addressed by that Mitigation.
• One Method of Detection for that Enterprise Tactic / Technique.
Element 4 – Final Network Design
1. Briefly summarize the items in Elements 1 and 2 above (so for these, this is just a brief
repetition – the details are in Elements 1 and 2 above). Then create an in-depth
description of the network design itself.
IT 4336 – Fall 2023 – Semester Project – Part 2: Final Network Design
2. Create a final network diagram that includes the basic diagram and all relevant network
enhancements. Your network diagram CANNOT be hand-drawn. It MUST be made
by using either:
a) A network diagramming tool, such as draw.io or
b) Using the network symbols provided in the Overall module and creating it in Word or
some other similar software (that I can open).
c) The network diagram MUST be different than what you created for Part 1
d) This diagram MUST be in a separate document than your written paper (so you are
submitting TWO documents)
Length, Number of Sources
You will submit one written document and your 2nd, complete Network Diagram (two separate
documents):
1. A document with the written description that covers the elements in the task list that is in
accordance with the template provided.
2. Your written document must be a minimum of four pages and a maximum of eight pages
(not including the endnote sources)
3. See the overall formatting document for the number of sources.
Formatting
See the Overall Formatting Document and the Phase 2 Template.
IT 4336 – Fall 2023 – Semester Project – Part 2: Final Network Design
Scoring Schema for Part 2
Item
Sources, including your adherence to the formatting/creation standards for
the sources. Quality of sources & correct number of sources is 75% of the
10%. Adherence to formatting standards is 25% of the 10%.
1. Research and select firewalls for the Security Consulting network.
a. Describe each firewall, why you selected it, and where it should be
placed for maximum effectiveness.
b. Address network, server, and workstation firewalls.
c. Include a plan for creating a DMZ, and explain how it makes the
network more secure
Research and recommend the most appropriate VPN technology. The most
likely solution is either an Internet Protocol Security (IPSec) VPN or
SSL/TLS VPN. Describe the VPN technology and explain why it is the
best choice for Security Consulting.
Given TWO MITRE ATT&CK Enterprise Tactics / Techniques give:
• One Mitigation for each Enterprise Tactic / Technique
• One Technique Addressed by that Mitigation.
• One Method of Detection for that Enterprise Tactic / Technique
Final Overall Network Recommendations. Must include a description of
how going to ERP software affected your recommendations and network
design (diagram). No mention of this, automatic 25% deduction of the
value of this section.
Final Network Diagram
Formatting, spelling/grammar (FSG)
Value
10%
20%
15%
15%
15%
15%
10%