Business Simulation – Cyber Security
2,500 words
L7 Business Simulation – Cyber Security: Ethical Hacking and Vulnerability Assessment
This assessment is an individual cybersecurity portfolio based on a simulated business environment involving a fictional client, VulnTech Inc. Students take the role of a junior cybersecurity analyst and investigate vulnerabilities within a server deployed for the organisation’s legacy systems. The practical activities use the TryHackMe platform to simulate the web server environment and require students to apply ethical hacking techniques within an authorised scenario. The assessment focuses on the first three phases of ethical hacking: footprinting, scanning and enumeration, and gaining access. Students are required to gather information about the VulnTech server, including relevant details about its domain, IP range, network infrastructure, operating system, name servers, open ports and other technical information. They must provide evidence of the tools used, justify their selection, critically evaluate the methodology adopted and recommend appropriate mitigation strategies. The second task involves scanning and enumerating the server using information obtained during the footprinting stage. Students must identify potential vulnerabilities and provide evidence of the tools and methods used. The assessment requires students to critically evaluate their available options, explain the reasoning behind their decisions and recommend suitable strategies for mitigating identified risks. The third task requires students to gain access to the VulnTech server by exploiting one of the vulnerabilities identified during scanning and enumeration. Evidence of the tools and methodology must be provided, together with a critical evaluation of the approach, justification of decisions and recommendations for addressing the identified vulnerabilities. Students must also provide evidence of completing at least four different TryHackMe rooms or modules undertaken during the semester. The final component is a 1,500-word summary report reflecting on the key insights gained throughout the tasks. This report should consolidate the student's learning, discuss the main challenges and vulnerabilities identified, evaluate mitigation recommendations and critically examine the legal and ethical considerations associated with cybersecurity and ethical hacking practices. The assessment is designed to develop students' ability to analyse business and cybersecurity environments, identify organisational issues, evaluate alternative approaches, make informed management decisions and justify resource allocation. It also requires consideration of Environmental, Social and Governance (ESG) implications and the potential effect of cybersecurity practices on organisational perception and performance. The portfolio uses Harvard referencing, with appropriate academic and external sources cited throughout.
Read Model Answer →
Ethical Hacking
2,500 words
Ethical Hacking – Professional Penetration Testing Report
This resit coursework for the Ethical Hacking module at Coventry University requires students to conduct a professional penetration testing examination of a small office environment represented by a number of virtual machines. The purpose of the assessment is to evaluate the security of the target environment, identify vulnerabilities, demonstrate appropriate exploitation techniques within the authorised assessment environment, and produce professional recommendations for improving the security of the systems. The assignment carries 15 credits and requires a report of approximately 2,000 words, with a permitted variation of ±10%. The report should follow a structured penetration-testing approach. The first section covers reconnaissance and target analysis, requiring students to investigate the target environment and identify its structure, services and potential attack surfaces. The marking criteria emphasise the use of appropriate tools to identify network structure and services and the identification of vulnerabilities during the scanning process. Students are expected to analyse the results rather than simply reproduce the output of scanning tools. The second section focuses on exploitation. Students must describe in detail the steps taken and the tools used to exploit relevant vulnerabilities identified during the assessment. The marking criteria distinguish between compromising the desktop and gaining access to the server, with higher achievement involving multiple relevant vulnerabilities and successful access through more than one vulnerability. The report should provide appropriate screenshots and sample sessions to support the findings. The third section addresses post-exploitation activities. Students are required to document and analyse activities carried out after gaining access to the target systems. Examples identified in the marking criteria include dumping password hashes and creating a persistent backdoor. For server assessment, the criteria also consider activities such as obtaining root access or establishing a persistent connection. The report should explain the significance of the activities rather than merely listing technical actions. The fourth section provides recommendations for securing the target machines. Recommendations must address all vulnerabilities identified during the assessment, not only vulnerabilities that were successfully exploited. Security issues should be discussed using an established risk-rating approach such as OWASP, and proposed countermeasures should be relevant to the specific vulnerabilities discovered. The report should also analyse how vulnerabilities relate to one another and fit within the wider security context. The final section presents the conclusions, including an evaluation of the penetration-testing work and alternative approaches that could have been taken. The overall learning outcomes require students to critically discuss the legal, technical and ethical scope of ethical hacking, evaluate penetration-testing methodologies and security assessment tools, analyse vulnerabilities, and professionally report penetration-test outcomes with suitable countermeasures.
Read Model Answer →