Assignment tasks

The timeline above presents a security incident as it was observed by the ACME invest company. The scenario is fictitious however it is based on real-world security incidents and attacker groups, which means you will find information online. You have to complete the following tasks:

• identify the Indicators of Compromise (IoCs) from the timeline and use them to determine the identity of the attacker

• based on the identity of the attacker, its Mode of Operation, and the profile of the company, what do you think the attacker is after?

• incident response process

– based on the IoCs identified by the IT administrator and the MO of the attacker, what do you think is the current stage of the attack, within the attack cycle? (3 pt)

∗ please provide details that consider the MO and tools of the attacker

– what would be the next steps in the attack cycle?
– detail the measures to be taken for containment, eradication, and recovery

• write a 1 page lessons learned report

– this should list the organisation policies that were correct, as well as those that were incorrect

– it should list necessary changes to the organisation policies and practices, as well as any immediate user training sessions that should be performed.