Threat Model - Penetration Testing

Learning Outcome 1: Critically analyse and evaluate security techniques used to protect complex heterogeneous environments and apply their findings for offering advice regarding solutions to decision makers

Learning Outcome 2: Apply advanced and current concepts/issues of computer systems risks, vulnerabilities, threats analysis, and software security in the context of a penetration test

Task

Your task is to critically analyse the literature with an emphasis on the current threat landscape. The current threat landscape identifies the threats, major trends observed with respect to threats, threat actors and attack techniques and it changes on an annual basis.

Based on this, you are asked to produce an Attack Tree against an organisation of your choosing and provide recommendations on how to protect against the attacks that you have modeled. Towards the completion of this task you need to:

Select an organisation and provide your assumptions about the company. Each organisation has a different threat profile, you need to specify your assumptions that make the Attack Tree relevant to the organisation and the current threat landscape.

Create an attack tree that matches the assumptions that you defined as well as is relevant to the threat landscape. The attack tree must show different ways in which the organisation can be attacked. Please do not submit hand-written attack trees. You will not score high marks unless your Attack Tree is relevant to the current threat landscape and your assumed scenario (i.e. organisation's threat profile). Please note that you will not receive any marks if you just provide yet another Attack Tree. The emphasis of your work should be the justification of how the Attack Tree models the threat profile of your selected organisation and how it relates to the current threat landscape.

c). Critically analyse and evaluate the security techniques, methods, controls and procedures that need to be applied in the scenario that you have provided in (a) and the Attack Tree that you have produced in (b). Similarly, to the advice that you were given for b) above, the empasis of the work is on the critical analysis and justification on how the proposed security recommendations match the assumptions that you have made and the Attack Tree that you have come up.

Your report must include a number of references to academic literature or industrial best practices to secure the organisation of this scenario. At minimum you are expected to have read 10 such resources.

You are required to submit a text report (up to 1000 words) written in either Microsoft Word or OpenOffice and submitted in a doc, docx, odt or fodt format using the submission link provided on Canvas. Please note it is your responsibility to ensure you will submit on time.
The following report structure is expected:

Chosen organisation and assumptions (200 words)
Attack Tree based on current threat landscape and scenario (400 words)
Security recommendations (400 words)

References.