7COM1069-0901 Cyber Operations Individual Assignment Brief

7COM1069-0901 Description Assignment brief 

This individual assessment is designed to assess your ability to detect, analyse, and mitigate sophisticated cyberattacks from a national security perspective. You will be provided with a PCAP file and other evidence related to an attack targeting the critical national infrastructure. 

Your task is to act as a cyber operations analyst for a government agency tasked with protecting national assets. The report will simulate the critical decision-making process involved in a real-world cyber incident affecting the nation's defence capabilities, public safety, and economic stability. 

This assessment is weighted at 60% of the overall mark and should take you approximately 30 hours to complete. The report is expected to be around 3500 words, and you will submit both a technical report and a defensive bash script that automates network defences. 

7COM1069-0901 Scenario Overview:

The UK government has been under constant cyberattacks in recent months due to rising geopolitical tensions. Critical National Infrastructure (CNI), including power grids, financial institutions, and transportation systems, has been targeted by state-sponsored and independent adversaries. These attackers use advanced techniques such as:

• Psychological operations (e.g., deepfake media, misinformation campaigns). 
• Phishing attacks (targeting government employees via email). 
• Advanced Persistent Threats (APTs) (stealthy network intrusions). 

Current Incident Cyberattack on London Traffic Light Management System  London, the UK's financial and political hub, has recently suffered a cyberattack on its Traffic Light Management System (TLMS). This system plays a crucial role in controlling traffic flow across the capital. A disruption in its operation could lead to major transportation chaos, accidents, and economic losses. 

Initial intelligence reports suggest that a transportation department employee fell victim to a phishing attack. This incident may have provided attackers with access to critical systems.

Your Role

You are part of an incident response team tasked with analysing a PCAP file containing network traffic data from the attack. Your objective is to: 
1. Identify the attack method - How did the adversaries gain access? 
2. Determine the infected systems - Which devices were compromised? 
3. Understand the attacker's actions - What were their tactics after gaining access? 
4. Assess the impact - How severe was the breach? 5. Recommend mitigation steps - What security measures should be taken? 

7COM1069-0901 Deliverables:

1. Executive Summary: 

• A high-level overview of the attack, including the cyber and psychological components, and the potential impact on the London traffic light system. 

2. Threat Intelligence Analysis:

• Attacker Profile (Use MOC attributes): 
• Analyse the pcap data and the multimedia evidence to determine the potential actors involved (nation-state, hacktivist, etc.). 
• Identify their motivations, capabilities, and likely capabilities, and likely objectives. 
• Disinformation Campaign Analysis: 
• Analyse the deepfakes and morphed media: 
• Identify the target audience and the intended message. 
• Assess the potential impact on public perception and behaviour. 
• Analyse the distribution method of the deepfake media. 
• Impact Assessment: 
• Evaluate the potential consequences of the combined cyber and psychological attack on the London traffic light system and the wider community. 
• Consider the impact on public safety, traffic flow, emergency services, and public trust.

3. Technical Analysis of Cyber Components:

•  Analyse the pcap data to identify the technical aspects of the attack 
• Reconnaissance, exploitation, C2, and nnr,