CIS009-3 Incident Response Assessment Brief 2026/27 | University of Bedfordshire

Key assignment details

Understanding the assignment brief

You are asked to:

-   Complete the CyberOps final examination

-   Critically evaluate current issues in cybersecurity through research

-   Demonstrate that you know how to triage, categorise, respond to, investigate and report two different types of InfoSec events.

• CyberOps Skills Investigation - IR
• Rhino Hunt - DFIR

-   Give an incident-report with feedback and recommendations for lessons learned.

Task 1 – Introduction – Final Exam CyberOps Associate - 10%

Complete the final CyberOps Associate exam (closed-book). Add a screenshot of your gradebook showing your score to your report.

Completing module exams first is recommended but not required.

Task 2 – Cyberthreat Literature Review – 20% (750 words max)

Critical discuss the following, using research from respected academic sources: journals, articles and books.

“How have recent advances in artificial intelligence impacted the cybersecurity threat landscape, and what effect does this have on the Cyber Kill Chain and Incident Response Lifecycle? Please somewhere make mention that ‘A BeTCP Attack is still one of the most frequent.’

To what extent should digital investigation and incident response methodologies be adapted to address these changes while remaining compliant with UK legal and regulatory requirements?”

Note: Use recent (within 5 years) and relevant research, cited correctly using a standard format (e.g. Harvard – Cite Them Right). Your essay must be in your own words, with proper referencing. Plagiarism, including uncredited use of AI tools, will not be allowed. If you use AI-generated content, treat it like any other source: reword, integrate, and cite appropriately. Maximum length: 750 words.

Task 3 – Methodology – DFIR Tools and Incident Triage – 20% (500 words max)

You are investigating two separate cybersecurity incidents:

Virus Infection – Known malware has affected 6 of 12 machines in one department.

Suspected Illegal Activity – One user’s device may contain illegal content

(e.g. rhino images in sample data, potentially representing serious criminal material).

Evaluate and compare your team’s approach to both incidents, identifying any key differences in response. For each incident, briefly address:

Response Focus – What is your team trying to achieve?

Severity & Urgency – How serious is the incident? Use frameworks like NCSC if helpful.

Support Needed – Can your team handle it alone, or are external agencies required?

Legal Considerations – Are there any legal or regulatory issues to manage?

Response Tools – List tools used to detect and respond to malware (e.g. Security Onion, Squil, Kibana). A diagram is optional.

Forensics Tools – List tools used to investigate illegal content or data theft.

Be sure to highlight how and why your approach may differ between the two incidents

Task 4 – Research – Practical Tasks

The CyberOps Malware Investigation 20% – (250 words max) and The Rhino Hunt 20% – (250 words max)

Note: some of this work may be carried out during Week 4 and 5 lab classes.

You need to keep evidence/screenshots demonstrating your work and for your instructor to witness your investigation. Your screenshots/photos and write-up must be UNIQUE and demonstrably your own. E.g. please include date/timestamps and desktop backgrounds in images.

CyberOps Malware - IR Investigation Task (250 words)

You’ll be given a virtual machine containing logs from a cyber incident. Use Security Onion tools (e.g. Kibana and Squil) to investigate and report your findings professionally.

Login: Username analyst, Password cyberops

Target Event: Around June 2017

What to Do

Use the skillsexam questionsheet to guide your investigation

Create a research section: copy each question from the CyberOps Skills exam activity PDF and answer below it

Include annotated screenshots to support your findings

If you find malware or exploits, research their potential vulnerabilities and objectives using trusted sources (such as virustotal)

Summarise findings in your own words and reference appropriately

Remember your report is for executive-level, non-technical readers. Clearly explain:

-   What the malware was likely trying to achieve

-   What impact it could have had if not detected

The Rhino Hunt - DFIR Investigation Task (250 words max)

You’ll receive PCAP files and a disk image linked to a suspected illegal download. Use DFIR tools to investigate, locate evidence (e.g. 9 rhino images), and document your findings professionally.

Include annotated screenshots and complete any relevant incident response documentation

Write a brief summary suitable for legal review or referral to a digital investigator

Do your own work—copying online walkthroughs will result in zero or very low marks

Task 5 Discussion – Lessons Learned 10% – 250 words max

Having finished the investigations please add a ‘Discussion and Conclusions’ section which briefly summarises the ‘lessons learned’ from the investigation and makes recommendations to avoid further incidents like these ones.

In order to pass you need to submit a full report of the following tasks above, in particular showing evidence that you have carried out the practical skills investigations.  

To pass Assessment 1, you will need to:

Present the design of a digital investigation model and incident response methodology, with respect to the legal system in the UK
Identify the correct techniques and tools (peer-reviewed and ‘forensically sound’ tools) to perform forensic acquisition and analysis of digital evidence under given scenarios

• Utilise commercial and open-source tools to successfully analyse forensic artefacts and report findings

The marking criteria grid given below shows how your work will be assessed and what’s needed to achieve a good grade.

For a good grade make sure to attend the (a) lectures to understand the essence of the topics that the video is about and (b) the practical sessions where you can and should discuss the progress of your software artefact with your tutor.

This assessment is a problem-based report. This is designed to provide opportunities of consolidating the concepts and techniques introduced in the lectures and in the use of these concepts and technique to develop solutions to problems which are designed based on real-world environments. Also, to recognise the methods and techniques necessary for securing an organisation’s IT systems and networks.

The assignment uses a case study where students are required to engage in an enquiry around an activity including the development of a solution for the case study requirements. 

Within the University of Bedfordshire, graduate competencies refer to the skills, knowledge, attributes, and abilities that individuals are expected to possess upon completing their education at the graduate level. Our graduate competencies are the fundamental building blocks in preparing you for the future world of work. They form the foundation for learning outcomes within and beyond your course. They are relevant for every subject and you can work towards them in different ways, so that you can attain and benefit from them even if you have lots going on outside university. These competencies will be integrated across your course and units.

The table below indicates graduate competencies gained relevant to this assessment.

To submit assignments at the University of Bedfordshire, you will typically use the BREO (Bedfordshire Resources for Education Online) platform. Within BREO, locate the specific assessment you need to submit, and then follow the instructions provided to upload your work.

The University has produced a guide that is designed to help you understand the processes we use to deliver and manage assessment-related processes, what support is available to you and how we agree and approve your results. It also provides you with an explanation of the codes we use when we issue results and transcripts.

When submitting work for assessment, you must ensure that it is all your own work. Failure to do this could result in sanctions, including removal from your course. The Academic Integrity Resource (AIR) has been designed to introduce you to academic integrity and how to demonstrate this during your studies. Remember to use the self-help resources to support your skills in academic writing. You could also Improve your assignment grades by accessing free university support to develop a wide range of relevant and valuable academic skills.

The University provides access to Studiosity that connects students with a team of writing specialists who are here to help you with writing and core skills - anytime, anywhere. Studiosity provides you with two online services: Writing Feedback and Connect Live.  Their Writing Feedback gives feedback on referencing, choice of language, structure and spelling/grammar within 24 hours. If you are not sure how to use the feedback to enhance your work before making a final submission, you can arrange to discuss this with a member of the Study Hub team. Connect Live also offers live support in areas such as basic English, maths and stats, science and generic study skills. Both services are available 24/7, 365 days of the year, and you can access them for FREE via BREO.