19; 20; 21 2021

MODULE NAME: MODULE CODE:

PRINCIPLES OF SECURITY PRSE6212/d

ASSESSMENT TYPE: ASSIGNMENT 1 (PAPER ONLY)

TOTAL MARK ALLOCATION: 100 MARKS

TOTAL HOURS: 10 HOURS

By submitting this assignment, you acknowledge that you have read and understood all the rules
as per the terms in the registration contract, in particular the assignment and assessment rules in
The IIE Assessment Strategy and Policy (IIE009), the intellectual integrity and plagiarism rules in
the Intellectual Integrity Policy (IIE023), as well as any rules and regulations published in the
student portal.

INSTRUCTIONS:

1. No material may be copied from original sources, even if referenced correctly, unless it is a
direct quote indicated with quotation marks. No more than 10% of the assignment may
consist of direct quotes.
2. Make a copy of your assignment before handing it in.
3. Assignments must be typed unless otherwise specified.
4. All work must be adequately and correctly referenced.
5. Begin each section on a new page.
6. Follow all instructions on the assignment cover sheet.
7. This is an individual assignment.

© The Independent Institute of Education (Pty) Ltd 2021

Page 1 of 5
19; 20; 21 2021

Referencing Rubric

Providing evidence based on valid and referenced academic sources Markers are required to provide feedback to students by indicating
is a fundamental educational principle and the cornerstone of high- (circling/underlining) the information that best describes the
quality academic work. Hence, The IIE considers it essential to student’s work.
develop the referencing skills of our students in our commitment to
achieve high academic standards. Part of achieving these high Minor technical referencing errors: 5% deduction from the
standards is referencing in a way that is consistent, technically overall percentage – the student’s work contains five or more
correct and congruent. This is not plagiarism, which is handled errors listed in the minor errors column in the table below.
differently.
Major technical referencing errors: 10% deduction from the
Poor quality formatting in your referencing will result in a penalty of overall percentage – the student’s work contains five or more
a maximum of ten percent being deducted from the percentage errors listed in the major errors column in the table below.
awarded, according to the following guidelines. Please note,
however, that evidence of plagiarism in the form of copied or If both minor and major errors are indicated, then 10% only (and
uncited work (not referenced), absent reference lists, or not 5% or 15%) is deducted from the overall percentage. The
exceptionally poor referencing, may result in action being taken in examples provided below are not exhaustive but are provided to
accordance with The IIE’s Intellectual Integrity Policy (0023). illustrate the error

Required: Minor errors in technical correctness of Major errors in technical correctness of referencing
Technically correct referencing referencing style style
style Deduct 5% from percentage awarded Deduct 10% from percentage awarded
Consistency Minor inconsistencies. Major inconsistencies.
• The referencing style is generally • Poor and inconsistent referencing style used in-
• The same referencing format consistent, but there are one or two text and/or in the bibliography/ reference list.
has been used for all in-text changes in the format of in-text • Multiple formats for the same type of referencing
references and in the referencing and/or in the bibliography. have been used.
bibliography/reference list. • For example, page numbers for direct • For example, the format for direct quotes (in-text)
quotes (in-text) have been provided for and/or book chapters (bibliography/ reference
one source, but not in another instance. list) is different across multiple instances.
Two book chapters (bibliography) have
been referenced in the bibliography in
two different formats.
Technical correctness Generally, technically correct with some Technically incorrect.
minor errors. • The referencing format is incorrect.
Referencing format is technically • The correct referencing format has been • Concepts and ideas are typically referenced, but a
correct throughout the consistently used, but there are one or reference is missing from small sections of the
submission. two errors. work.
• Concepts and ideas are typically • Position of the references: references are only
Position of the reference: a referenced, but a reference is missing given at the beginning or end of large sections of
reference is directly associated from one small section of the work. work.
with every concept or idea. • Position of the references: references • For example, incorrect author information is
are only given at the beginning or end of provided, no year of publication is provided,
For example, quotation marks, every paragraph. quotation marks and/or page numbers for direct
page numbers, years, etc. are • For example, the student has incorrectly quotes missing, page numbers are provided for
applied correctly, sources in presented direct quotes (in-text) and/or paraphrased material, the incorrect punctuation is
the bibliography/reference list book chapters (bibliography/reference used (in-text); the bibliography/reference list is
are correctly presented. list). not in alphabetical order, the incorrect format for
a book chapter/journal article is used, information
is missing e.g. no place of publication had been
provided (bibliography); repeated sources on the
reference list.
Congruence between in-text Generally, congruence between the in- A lack of congruence between the in-text
referencing and bibliography/ text referencing and the bibliography/ referencing and the bibliography.
reference list reference list with one or two errors. • No relationship/several incongruencies between
• There is largely a match between the the in-text referencing and the
• All sources are accurately sources presented in-text and the bibliography/reference list.
reflected and are all accurately bibliography. • For example, sources are included in-text, but not
included in the bibliography/ • For example, a source appears in the in the bibliography and vice versa, a link, rather
reference list. text, but not in the bibliography/ than the actual reference is provided in the
reference list or vice versa. bibliography.
In summary: the recording of In summary, at least 80% of the sources In summary, at least 60% of the sources are
references is accurate and are correctly reflected and included in a incorrectly reflected and/or not included in
complete. reference list. reference list.

Overall Feedback about the consistency, technical correctness and congruence between in-text referencing and bibliography:
........................................................................................................................................................................................................................................................................................

........................................................................................................................................................................................................................................................................................

© The Independent Institute of Education (Pty) Ltd 2021

Page 2 of 5
19; 20; 21 2021

Case study

You have recently been appointed as the new IT risk manager of a countrywide online trading
business called DirectToCust which sells items directly to the public. Its headquarters are located
in Cape Town, in the Western Cape and have warehouses in Gauteng, KZN, and the Free state. The
company employs over 200 call center agents and about 10 business managers for both inbound
and outbound transactions and logistics. They work both day and night shifts in an open-plan
workspace of around 40 x 38 m with each agent having their own desk, networked computers and
essential office stationery to conduct business. Most, if not all, call center agents’ desktop PCs are
connected to a local network using Ethernet cabling while most line managers’ laptops are
wirelessly connected to enable free movement around the premises. All the servers, switches,
router, gateways, firewalls, etc., are located at the adjacent IT office and maintained by one
network administrator and six support technicians (four dayshifts and two nightshifts), the
company opted for software-as-a-service, through various cloud computing services provider for
all their software needs and therefore the presence of IT personnel is for day-to-day business
support only. Before your recruitment, the company was experiencing a couple of complaints
such as:

1. Theft of personal belongings during working hours.

2. The network policy can be amended by the IT support team without the knowledge of the
IT administrator.
3. Employees spending more time on social media than working.
4. Theft of customers’ details for own and commercial use, using USB and other portable
storage.
5. Infected and corrupted employees and customer databases.
6. The local IT team often experiences issues when communicating with the overseas cloud
service provider team.
7. All employees must change their password every week, and as a result, many employees
who cannot memorise their new password simply write them down for safekeeping.
8. Regular firewall breaches were observed during the last couple of months and resulting in a
bottleneck and unauthorised access.
9. Some employees can easily guess their colleague's password to log in.
10. The website was recently hacked, disfigured and propaganda message posted, and it took
the local IT team 48 hours to take back control of the website.

© The Independent Institute of Education (Pty) Ltd 2021

Page 3 of 5
19; 20; 21 2021

11. Misappropriation of business funds by some employees.

12. Easy access to the server room and malicious reconfiguration of proxy-server mostly during
the night shift.
13. Managers are unable to monitor employer activities live.
14. Poor financial accountability and traceability; all managers are able to edit log files without
authorisation.
15. Information and communications were being hijacked or looked into before reaching their
destination.

Question 1 (Marks: 50)

Using the knowledge and expertise you have accumulated from the above case study information,
answer the following questions.

Q.1.1 In a 10-line paragraph, briefly explain the overall IT security and why it is (8)
important to always align IT/IS strategy and business strategy.

Q.1.2 Exploring the role and importance of the commission for the investigation of (8)
abuse of authority (CIAA) within an enterprise, and on a scale of 1 to 10, how do
you rate the DirectToCust data security approach and implementation?

Q.1.3 As the new DirectTocust IT risk manager, how will you balance the right of staff (8)
privacy, the company network and physical security?

Q.1.4 The use of Adhoc network as presented above presents other security (8)
challenges; explain how you will make sure that wireless connectivity does not
lead to network breaches.

Q.1.5 As the new DirectTocust IT risk manager, how will you protect the information (8)
and communications from being looked at during transmission before they
reach their respective destinations?

Q.1.6 Based on the above case study, demonstrate how internal IT and network risk (10)
policies can play an important role in combating staff’s lack of organisational
compliance.

© The Independent Institute of Education (Pty) Ltd 2021

Page 4 of 5
19; 20; 21 2021

Question 2 (Marks: 50)

Write a report which, if implemented, will address all the issues identified in the case study. The
report must have the following structures:

Q.2.1 Your report must be structured in the following approach.

Q.2.1.1 Executive summary. (5)
Q.2.1.2 Background (case study’s IT security issues only). (5)
Q.2.1.3 Development of the proposed solution. (5)
Q.2.1.4 The role of the IT risk manager in addressing physical and network (5)
risk.
Q.2.1.5 The best methods of combating the network-based attack. (5)
Q.2.1.6 The impact of social engineering when combating network security. (5)
Q.2.1.7 The most appropriate mechanism in implementing network access (5)
authentication and authorisation without compromising network
security.
Q.2.1.8 The implementation of the best strategy to fight against hacking, (5)
hijacking and maintain the online presence.
Q.2.1.9 The most appropriate location and strategy for the DMZ and firewall (5)
implementation.
Q.2.1.10 Conclusion. (5)

© The Independent Institute of Education (Pty) Ltd 2021

Page 5 of 5