School of Computing

INF11809 Assessment Brief

 

1.   Module number	INF11809
2.   Module title	Security, Audit and Compliance
3.   Module leader	Peter Cruickshank
4.   Tutor with responsibility for Assessment. Student’s first point of contact	Peter Cruickshank
5.    Assessment	Coursework
6.  Weighting	90% of module assessment
7. Size and/or time limits for assessment	Formative/indicative assessment: 500-700 word article Final coursework: 3000 word individual report.
8. Deadline of submission (UK Time throughout)	Formative assessment: 9am, 4 November 2019, UK time Final report: 9am, 16 December 2019, UK time Your attention is drawn to the penalties for late submission: coursework submitted after the agreed deadline will be markedatamaximumofP1.Ifyouwillbeunabletomeetthis deadline,pleasecontactthetutorwellinadvancetoagree an alternativedate.
9. Arrangements for submission	The assignment must be submitted using Turnitin. Paper versions are not acceptable.
10. Assessment Regulations	All assessments are subject to the University Regulations.
11. The requirements for the assessment	See below
12. Special instructions	Guidance, feedback assessment support materials will be available on Moodle.
13. Return of work and feedback	Within three weeks of submission date, written individual feedback will be supplied through TurnItIn. Generalfeedback will be offered to the class at the sametime.
14. Assessment criteria	See below

 

 

 

 

 

1 of 7

Assessment Brief – INF11809 2019_20 v1.docx/17-Sep-19

 

 

Requirements

The two courseworks described below cover all the module learning outcomes. Together they are worth90%ofyourmarkforthemodule.Theother10%ismadeoutofyourresponsestothetenend of unittests.

These courseworks address all of the module Learning Outcomes (LOs):

LO1:    Demonstrateanunderstandingoftherolesandresponsibilitiesoftheprofessionalsinvolved, including practical application of codes ofpractice/ethics.

LO2:    Review and critically appraise relevant laws and relevant standards, theirinterrelationships and international trends in theirdevelopment.

LO3:    Critically appraise the principles of information security management systems andtheroles of risk management, controls and audit in supporting ISgovernance

LO4:    Demonstrate an understanding of the role of human and organisational factorsindelivering informationsecurity

LO5:    Research,examineandevaluaterelevantacademicliteratureandreal-worldsituations, identify issues and solutions and make recommendations tomanagement

 

Part A: Indicative (formative) assessment

This coursework will be used to give you feedback on your progress and writing skills. You are required to submit this before you can complete and submit the coursework described in Part B below. This is worth 10% of the module marks.

You are allowed to adapt, use or amend the material from Part A to help you complete Part B.

 

Requirement

The importance of designing systems to respect and protect the privacy of user data has been emphasised by recent events such as data breaches and the implementation of the GDPR by the EU and similar laws in other countries around the world.

You are required to write a brief 500-700-word article which gives business managers an overview ofcurrentresearchintowhyrespectingcustomerprivacyisimportant,andtheimplicationsofprivacy for informationsecurity.

You should base your article around at least 5 (and no more than 10) relevant and good quality academic (ie peer reviewed) papers. You may use any of the module materials, resources or any other relevant materials that you find. The article should be supported by correctly formatted references.Itcanincludeoneortwodiagramsortables,andincludeappendiceswithsupplementary information.

You will receive feedback and a mark for this piece of work which you can use as a guide for improving your work in Part B.

This element should be submitted by the date indicated on the front cover so that feedback can be given in time to assist completion of the final coursework.

 

 

Part B: Final coursework

This is worth 80% of the module marks. You are allowed to adapt, use or amend the material from Part A to help you complete Part B.

You are a newly appointed Chief Information Security Officer (CISO) in an organisation. In the light of the recent high profile of poorly-handled information security incidents, you have been asked to write a 3000-word report to senior management in your organisation (which could be company orin the public or third sectors) which (a) proposes and evaluates a model for security incident handling, and (b) its application to the organisation you havechosen.

You should develop an incident handling model from academic or credible professional sources. Illustrate and analyse the model using examples from current news stories (from 2017 onwards). Assess its strengths and weaknesses, and the implications in the light of the increasing need to respect the privacy of the individuals whose data are stored in the systems.

In more detail, the report should follow the following structure:

• Cover sheet (as describedbelow)
• Executive summary 250-300 words1 (This does not count towards the 3000-wordlimit)
• Introduction: An overview of the aim and scope of the report and its intended purpose, and the context (ie relevant details of company sector andlocation2).
• Proposed model – Model selection: Identification, selection3 and adaption of framework(s) for informationsecurityincidenthandlingthatareappropriatefortheorganisationyouhavechosen, justifying your choice. A diagram or table to illustrate the model would beuseful.
• Proposed model – Explanation. This section should be structured around each of the stages in the model that you have developed, illustrated using examples from relevant and current news stories.Itshouldidentifytheissuesinvolved(forinstancedatabreach,ransomware)andexplain how they relate to the model of incident handling that you havedeveloped.
• Discussion: Shouldevaluate
  • the relationship of the information security incident response with other information security processes such as riskmanagement
  • the privacy and ethical implications of the available options and actual steps taken in the examples you areusing.
  • the role of audit in providing assurance that the incident handling process iseffective
  • governance issues raised and the professional rolesinvolved.
• The Conclusion should include recommendations to management, strengths and weaknesses of the model you have evaluated, and consideration of likely developments in next fewyears.
• References: All sources, formatted as described in the nextsection
• Optionally:

 

InformationSecurityeventsarenowregularlyinthenewsandwellreportedandyoushouldhaveno problems finding examples to illustrate yourreport.

 

 

 

 

1 An executive summary should be around 10% of the length of the main work. It should be placed straight after the cover sheet, be written in the present tense, and outline the purpose/objectives, findings and key recommendations of the main report. Citations are not normally expected.

2 You need to supply (minimal) details of your company to contextualise the report.

3 Including how you decided the sources used can be considered credible

 

 

General submission rules

The aim of these individual assignments is to assess your knowledge, understanding, application, etc. of the module material. Copying from any source or collusion between two or more students prevents thisaimfrombeingachieved.So,thecontentofsourcesusedmustbeEXPLAINED,notcopied;youmay help each other by DISCUSSION only, not by sharing material you have written. Copying and collusion are serious matters and will be dealt with through the University’s Academic ConductRegulations.

This assignment is due to be submitted electronically via Moodle on or before the due date above. Youshouldusetheoriginalityreportyouobtainaftersubmissiontoensurethatyourreportcontains no significant copying from anysource.

If you have any problems with this assignment, please contact the module leader, preferably well before the submission date. Grades and feedback will be available to students as indicated on the ModulePlanintheModuleHandbook.Worksubmittedaftertheduedatewillbemarkedandreceive a maximum mark of P1 (the lowest pass). Prior warning of problems will help avoidpenalties.

Style and format notes

The report will be marked online.  Please take this into account when preparing your document.

You should use a formal style. Your work should be properly referenced throughout and include a reference list. (You are not required to supply a separate bibliography. A reference list will be sufficient.)

Front page should include: your matric number, the module id, word count, the coursework title.

Word length: It is suggested that your work should be near the upper limit; report of much less is unlikelytocontainadequatecontent,whichwillreducethemarksavailable.Themarkforworkover the maximum wordcount will bereduced.

You may include appendices, tables and diagrams, the content of which should not be included in the main word count. They can be used to justify and support the arguments in the main text; they cannot earn you marks in their own right.

Page layout: Submissions should be single column, in a clear black font (eg Arial) 10-12pt in size, justified and 1.5 line spaced. Captions for tables and figures should use an alternative font style to the main text (eg italic or bold).

References: All sources used must be formally acknowledged. The author-date system of source citation should be used in the text, e.g. (Smith, 2017) – use the published guidelines if necessary. The APA formats used by Word and Mendeley are acceptable. Please do NOT use footnotes for references (even for websites – they should also be properly cited)4.

Failure to meet this specification

Anassignmentwhichdoesnotmeetthisspecificationmightnotbeacceptedformarking.Correction and re-submission after the hand-in date will be awarded a maximum mark ofP1.

 

 

 

 

 

 

 

4 Footnotes are best used for short explanations of specific points which would break up the flow of your argument if included in the main text. Some readers will read them, some ignore them.

 

 

Assignment Forms and Marking Criteria

 

Part A: Indicative (formative) assessment

Feedback on this assessment will be made electronically using Turnitin’s Grademark system on the submitted coursework, highlighting areas where improvement could be made in future.

Each element of the marking grid will be graded using Napier’s 16-point qualitative grading scale (ie F6-F1, P1-P5, D1-D5).

Please refer to the rubric overleaf to understand the weightings of the criteria and their expectations.

 

 

Part B: Summative assessment

Feedback on the report will be made electronically using Turnitin’s Grademark system on the submitted coursework, highlighting areas where improvement could be made in future.

Each element of the marking grid will be graded using Napier’s 16-point qualitative grading scale (ie F6-F1, P1-P5, D1-D5.

Please refer to the rubric overleaf to understand the weightings of the criteria and their expectations.

 

 

Assessment Criteria: Part A: Formative assessment	Wtg	Distinction	Pass	Fail
Contextual discussion   Clear aim and scope of the report	20	Clear aim and scope and includes an overview of how the article approaches them.	Aims, scope and approach taken are addressed to some extent.	Missing or not clearly addressed.
Knowledge & Understanding   Research activity, range of materials used and topic coverage, including evaluation of the literature.	20	Evidence of clear and insightful critical analysis and application of relevant areas of academic literature. Discussion of theoretical aspects evaluating a range of alternative viewpoints. The literature is effectively synthesised and critically discussed	Demonstrates satisfactory to good knowledge and understanding of the academic literaturefrom a range of academic sources. Some critical discussion andsynthesis.	Insufficient demonstration of the necessary knowledge and understanding of the theoretical and empirical academic literature on the topic. Poor use of source material
Application:   Discussion of topic, Synthesis and analysis of the main issue under discussion.	25	Thorough and original analysis that effectively synthesises literature and practical implications to reveal new insights. Presents points in a persuasive manner.	Some synthesis of theory and practical implications, possible limited in scope or in depth of analysis. Reasonable, but limited insight.	Limited or no application of the relevant literature. Poorly developed critique with little or no new insights developed.
Conclusions and recommendations   Conclusions drawn and overall critical evaluation and any recommendations	25	Comprehensive conclusions, very well supported by the preceding analysis.	The conclusions are broadly supported by the preceding analysis.	The conclusions are not supported by the preceding analysis, or are inconsistent with each other and the general arguments(s) given.
Professionalism   Including presentation, use of diagrams, readability, structure, referencing	10	Well-structured essay, with clear and logical arguments development. Clear and effective presentation throughout; meaning clear and fluid with an articulate professional writing style. Literature is accurately integrated into the text.	Satisfactory to good structuring of essay content. Some argument development. Satisfactory to good presentation overall; style generally consistent with professional essay writing. Most sources acknowledged and generally accurately integrated into the text	Poorly structured essay; limited attention to argument development. Poor lay-out with inconsistent or inappropriate writing style. Sources poorly cited and referenced.

 

 

You are allowed to adapt, reuse or amend the material from Part A to help you complete Part B.

 

 

Assessment Criteria: Part B: Report to management	Wtg	Distinction	Pass	Fail
Executive Summary, Introduction   Clear aim and scope of the report	20	Executive summary is clear and shows knowledge of audience expectations. Introduction has clear aim and scope and includes an overview of factors to consider and how the report approaches them.	Executive summary addresses most of the expectations. Introduction is mainly clear about aims, scope and approach taken.	Executive summary missing or doesn’t meet expectations. Introduction is vague or does not set out the aim and
Knowledge & Understanding   Research activity, range of materials used and topic coverage, including evaluation of the literature and selection and development of model.	25	Use of appropriate and current literature.  Evidence of clear and insightful critical analysis and application of relevant areas of literature.Discussion of theoretical aspects from a comprehensive range of academic sources, evaluating a range of alternative viewpoints. Theoretical and empirical literature is effectively synthesised and critically discussed.	Demonstrates satisfactory to good knowledge and understanding of the academic literature from a range of academic sources. Some critical discussion and synthesis of the theoretical and empirical literature	Insufficient demonstration of the necessary knowledge and understanding of the theoretical and empirical academic literature on the topic. Poor use of source material.
Application:   Application and Analysis of model against examples and evaluation of wider implications	25	Thorough and original critique of case-study that effectively synthesises literature and practical implications to reveal new insights. Presents points in a persuasive manner, that demonstrates insight in to effective practice in the field	Some application of the literature to the case-study. Some synthesis of theory and practical implications, possible limited in scope or in depth of analysis. Reasonable, but limited insight in to effective practice in the field.	Limited or no application of the relevant literature to the case-study material. Poorly developed critique with little or no new insights developed.
Conclusions and recommendations   In the light of the aims and objectives and findings	20	Comprehensive conclusions, very well supported by the preceding analysis. Clear demonstration of evidence based principles being used to draw clear and feasible conclusions and recommendations for improved practice.	The conclusions drawn from the study are broadly supported by the preceding analysis. Apparent but limited demonstration of evidence based principles being used to draw clear and feasible conclusions and recommendations.	The conclusions drawn from the study are not supported by the preceding analysis, or are inconsistent with each other and the general arguments(s) given. No apparent demonstration of evidence based principles being used to draw conclusions
Professionalism   Including presentation, use of diagrams, readability, structure, referencing	10	Well-structured management report, with clear and logical arguments development. Clear and effective presentation throughout; meaning clear and fluid with an articulate professional writing style. Literature is accurately integrated into the text.	Satisfactory to good structuring of report content. Some argument development. Satisfactory to good presentation overall; style generally consistent with professional report writing, and a reflective, practice- based viewpoint. Most sources acknowledged	Poorly structured report; limited attention to argument development. Poor lay-out with inconsistent or inappropriate writing style. Sources poorly cited and referenced.

 

You are allowed to adapt, reuse or amend the material from Part A to help you complete Part B.