COIT20262 - Advanced Network Security, Term 2, 2018 Assignment 1

Question 1. Cookie Stealing Attack
For this question you must use virtnet (as used in the workshops) to perform a cookie stealing attack. This assumes you have already setup and are familiar with virtnet. See Moodle and workshop instructions for information on setting up and using virtnet, deploying the website, and performing the attack. The tasks and sub-questions are grouped into multiple phases. You must complete all phases, in order.
Phase 1: Setup
1. Create topology 7 in virtnet.
2. Add a new normal student user to the MyUni grading system.
The user must have:
a. Username: [StudentID]
b. Password: [FirstName]
3. Add a new malicious student user to the MyUni grading system. The user must have: a. Username: 12345678 b. Password: [StudentID]
4. Add a grade for the normal student user for unit/course ‘coit20262’ with a grade of what you expect to receive this term, e.g. HD, D, C, P or F.
5. Change the title of the MyUni website by editing header_footer.php and changing the line to:
6. Change the domain of the MyUni website to www.[StudentID].edu by editing the /etc/hosts files.
7. Test that the existing users and new student can access the grading website. The roles of nodes in topology 7 are:
• node1: Web browser (lynx) of normal student user.
• node2: Web browser (lynx) of malicious student user.
• node3: Capture of packets with tcpdump.
• node4: MyUni grading website.
• node5: not used in this question.
Phase 2: Capture Cookies
8. Start capturing on node3 using tcpdump.
9. The normal student user must do the following on node1:
a. Visit the MyUni grading website, e.g. as below or with any options: lynx http://www.[StudentID].edu/grades/
b. Follow the “Login” link and login
c. Follow the “View grades” link and enter their username and ‘coit20262’ to view the course/unit grade, and submit.
d. Follow the “Logout” link.
e. Exit lynx by pressing q for quit.

10. Stop capturing on node3. Note that it is important that the start of the TCP connection (i.e. 3 way handshake), as well as all HTTP requests/responses are included in the capture.

Save the capture file as normal-student.pcap.

Phase 3: Masquerade Attack
Using information from the capture in part 2, the malicious student user must now perform a cookie stealing attack to masquerade as the normal student user. Although the capture may have recorded the normal student users’ password, you MUST NOT use it in the cookie stealing attack (e.g. assume the password was encrypted). Your cookie stealing attack must only use the cookie information (not the password).
11. Setup for the cookie stealing attack on node2.
12. Start capturing on node 3 using tcpdump.
13. The malicious student user must do the following on node2:
a. Visit the MyUni grading website, e.g. lynx http://www.[StudentID].edu/grades/
b. Follow the “View grades” link and enter the username of the normal user, leaving the course/unit field empty (see you see all grades), and submit.
c. Follow the “Logout” link.
d. Exit lynx by pressing q for quit.
14. Stop capturing on node3.
Note that it is important that the start of the TCP connection (i.e. 3 way handshake), as well as all HTTP requests/responses are included in the capture. Save the capture file as malicious-student.pcap. Phase 4: Analysis
Answer the following sub-questions regarding the previous phases and cookie stealing attack.
(a) Submit normal-student.pcap.
(b) Submit malicious-student.pcap.
(c) Draw a message sequence diagram that illustrates all the HTTP messages for the normal student user viewing the grades (i.e. the HTTP messages from normal-student.pcap from step 7 above). Do not draw any packets generated by other applications or protocols, such as ARP, DNS or SSH, and do not draw TCP connection setup or ACKS. Only draw HTTP messages. A message sequence diagram uses vertical lines to represent events that happen at a computer over time (time is increasing as the line goes down). Addresses of the computers/software are given at the top of the vertical lines. Horizontal or sloped arrows are used to show messages (packets) being sent between computers. Each arrow should be labelled with the protocol, packet type and important information of the message. Examples of message sequence diagrams are given in workshops. Note that you do not need to show the packet times, and the diagram does not have to be to scale.
(d) Based on your captures only, identify the following information. If the information is found in multiple packets, give the first packet from the capture. For example, if the information is found in packet numbers 3, 5 and 7, you would give the packet number as 3.
a. Packet number from normal-student.pcap that contains the normal students’ password
b. Packet number from normal-student.pcap in which the server originally sends the cookie to the browser
c. Last 4 HEX digits of the id_hash in the cookie (give the value of the last 4 digits, not the packet number)
d. Packet number from malicious-student.pcap that contains the normal students grade for coit20262.
e. Packet number from malicious-student.pcap in which the client originally sends the stolen cookie

(e) Explain how the id_hash is calculated, giving both the equation/algorithm for calculating it, as well as a description of the values used in calculating it (for example, where do the values come from? How are they set?).
(f) Explain how the id_hash provides security on the context that it is used in the grading web application.
(g) Explain a weakness or vulnerability of how the id_hash is calculated or used. For example, how could the security it provides be broken?
(h) In this question, the username and password of the normal student user are sent as plaintext from browser to server. This is an obvious weakness, as an attacker that intercepts the packets between browser and server immediately learns the password. A possible solution is for the client browser to calculate a hash of the password using JavaScript, and sending the hash of the password to the server, instead of the actual password. Discuss the strengths or weaknesses of such a scheme with respect to preventing an attacker from logging in using the normal student users’ password.
(i) In this question, the malicious student performing the cookie stealing attack uses lynx as a web browser. Explore how to edit or create cookies in common graphical web browsers (Firefox, Chrome, IE, Edge or Safari). Give a brief explanation of what you need to do to modify/create cookies (e.g. which options of the browser, or what software needs to be installed) and take a screenshot of a cookie you modified or created. The cookie in the screenshot MUST include your [StudentID] (e.g. put your [StudentID] in any field of the cookie).

Question 2. Cryptography
For this question you must use openssl to perform a set of cryptographic operations. When performing cryptographic operations you must be very careful, as a small mistake (such as a typo) may mean the result is an insecure system. Read the instructions carefully, understand the examples, and where possible, test your approach (e.g. if you encrypt a file, test it by decrypting it and comparing the original to the decrypted). It is recommended you use virtnet to perform the operations. The tasks and sub-questions are grouped into multiple phases. You must complete all phases.
Phase 1: Download
Normally in public key cryptography you generate your own public/private key pair. However in this assignment to simplify the tasks, the Unit Coordinator has generated a key pair for you. Your key pair will be available to you on Moodle to download, with filename: • [StudentID]-keypair.pem In addition to your key pair, a number of files will be available to all students on Moodle to download. Each file starting with [StudentID] must be downloaded by you. You may also need to download files with other student’s IDs (see the next phase). The download URL will be published on Moodle.
Phase 2: Read the Messages
The files for download have been created by another student, denoted as the sender:
1. Sender student created a message to you [StudentID]-message[N].txt, where [N] is an integer, e.g. 1, 2, 3, …
2. The sender signed the message to produce [StudentID]-message[N].sgn.
3. The sender wrote their student ID into a text file [StudentID]-sender[N].txt.
4. The sender signed the sender file to produce [StudentID]-sender[N].sgn.
5. The sender used openssl to generate a random 256-bit secret key, in Hex, and saved it in [StudentID]-key[N].txt.
6. The sender generated a random Initialisation Value (IV), in Hex, and saved it in [StudentID]-iv[N].txt.
7. The sender encrypted the message using symmetric key encryption, the random secret key, and the random IV, producing [StudentID]-message[N].enc.
8. The sender encrypted the random secret key file using public key encryption, producing [StudentID]-key[N].enc.
The sender then sends to you the necessary files from above. Note that the files were actually created by the Unit Coordinator, but in this assignment you can assume they were created by a student. The “sending” of files to you is performed by the sender (Unit Coordinator) uploading them to Moodle, and you downloading them from Moodle.

Your task is, for every message, decrypt and verify the files. Be careful: there may have been attacks on some messages! The algorithms used in this question are:
• Public key: RSA, 2048 bit
• Symmetric key: AES-256-CBC
• Hash: SHA256
Phase 3: Report Your Results
After downloading, decrypting and verifying all messages, you need to create a summary of the results for each message. The summary must be in a text file called [StudentID]- summary[N].txt. The summary must contain exactly two lines, of the format: ResultType Message where ResultType is one of the following strings:
• Success – means all files successfully decrypted and successfully verified.
• FailDecryptKey – means the decryption of secret key was unsuccessful.
• FailDecryptMessage – means the decryption of message was unsuccessful.
• FailVerifySender – means the verification of sender file was unsuccessful.
• FailVerifyMessage – means the verification of message was unsuccessful.
If ResultType is Success, then include the contents of the message on the next line.
If ResultType is another value, then include “NoMessage” on the next line. Examples of possible summary files are:
Example 1:
Success 12345678-3-hello
Example 2:
FailDecryptMessage NoMessage
Example 3:
FailVerifySender NoMessage
You must sign each summary file, producing [StudentID]-summary[N].sgn


Phase 4: Analysis
(a) Submit all summary text files, e.g. [StudentID]-summary1.txt, [StudentID]- summary2.txt, [StudentID]-summary3.txt, ... .
(b) Submit all summary signature files, e.g. [StudentID]-summary1.sgn, [StudentID]- summary2.sgn, [StudentID]-summary3.sgn, … .
(c) The sender generated a random 256-bit secret key to be used for encryption. Consider if the sender instead used the following approach: generate a random password of 12 uppercase or lowercase English letters (the password only contains letters; no numbers or other characters), and then apply SHA256 on that password, using the hash value as the encryption key. Discussion the security issues with such an approach of generating a secret key for AES-256-CBC encryption.
(d) The sender encrypted the random secret key, but not the IV. Discuss the security issues with not encrypting the IV.


Question 3. Ransomware
Research Ransomware attacks are increasingly publicised. In addition it is estimated there are many more ransomware attacks not being made public, e.g. companies and users paying a ransom but not disclosing the attack. The prevalence of ransomware, and the impact it has on organisations, has led to the discussion of ransomware insurance. Your task is to study what is ransomware, what are the challenges and possible countermeasures, and report on it in an easy-to-understand manner. You must write a short report on ransomware, covering the following sections.
Overview of Ransomware
Approximately ½ page of text explaining what is ransomware and how it works. Assume the audience of this section is the general public (non-technical). You must include real examples of ransomware and/or ransomware attacks.
Technical Details of Ransomware
Approximately ½ to 1 page of text explaining the technical aspects of ransomware, including:
• What are the common methods of infection?
• What are common payloads?
• What cryptographic techniques are commonly used?
• What technologies are used to obtain ransoms?
• Why are some ransomware very hard to break?
Assume the audience of this section is technical, i.e. have similar background on network security as you. You should refer to techniques and concepts covered in the unit, and give sufficient technical detail to demonstrate you understand the issues.

Recommendations
List and explain 4 recommendations for end-users and/or organisations to avoid ransomware and/or handle ransomware infections.

There is no minimum/maximum length of the report. As a guide 1 to 2 pages of text (not including pictures) may be appropriate. Do NOT include pictures or tables in the report. Use text only. While you may use numbered lists and dot points, the report cannot entirely be lists. References are not necessary (although the normal rules of academic integrity are expected).

Project Risk Management

(Project Name)




Student Name
Date

Table of Contents
Project Risk Management Approach 1
Project Risk Management Process 1
Project Risk Identification 1
Project Risk Assessment (Qualitative) 1
Project Risk Assessment (Quantitative) 2
Project Risk Response 2
Risk Monitoring and Control 2
Risk Register 3



Project Risk Management Approach
Project risk management planning involves deciding how risk management activities will be conducted over the life of a project. The output of project risk management planning is the project risk management plan. Risk management is an iterative process. The risk management plan should be updated when any substantial changes to the project are made and/or when a risk event occurs.
Describe the purpose of the project risk management plan.

Explain how risk management will be approached for the project.

Project Risk Management Process
The contents of a Risk Management Plan can be found in the PMBOK (PMBOK® Guide), in section 11.1.3.1.

Project Risk Identification
Once the approach and process for managing project risks have been determined, it is time to identify potential project risks and document them in a risk register. It is helpful to think about possible sources or categories of project risks as a way to organize the risk list. It may not be possible to identify every risk that could occur during the project, but risk management is an iterative process. Over the life of the project you will review risks often, and you will update the risk register as needed.

Describe the process you will use to identify risks. Who will you include? When will you conduct these activities? How will you document the results?

Describe the types of risks you will define, such as operational, technical, regulatory, etc.

Describe the source of project risks that you plan to use, such as weather, vendor, staffing, technology, etc.

Document project risks in the risk register in Columns A–F.

Project Risk Assessment (Qualitative)
Once project risks have been identified, the project team must analyze them to try to determine the likelihood (probability) of occurrence and the effect to the project (impact) should a given risk event occur. All risk analysis begins with qualitative analysis. To ensure accuracy and completeness, the project team should study both the risk event itself and the interactions between risk events.
Explain how risk measurement scales will be developed. Will you use a standard organizational set of measurements or define your own?

Explain how risks will be prioritized based on the defined qualitative measurement scales.

Document risk measurement scales and their meaning in the project risk register in Columns H–J. For example:

What does a “2” mean for probability? Is that 20% or 20–40%?

What does a “4” mean for impact? Is that “project fails to meet one objective” or “project exceeds budget or timeline by 20%”?

Project Risk Assessment (Quantitative)
Once project risks have been qualitatively assessed, the project team must review those with the highest risk factor scores (probability x impact) and further analyze them using quantitative risk analysis methods.

For this project, use expected monetary value (EMV) as your quantitative method.

Explain how risks will be prioritized based on the EMV method.

Document the EMV risk measurement information in the project risk register in Column K.

Project Risk Response
Document risk response strategies (plans) for each risk in the project risk register in Columns L–M. The risk response strategies should be derived from the ten strategies in the PMBOK (PMBOK® Guide) in sections 11.5.2.4 and 11.5.2.5.

Risk Monitoring and Control
Risk monitoring and control is about ensuring that you are responding to risks as planned, identifying and planning responses to newly identified risks, and reviewing and updating all contingency reserves (time and money). Your risk management plan should include the steps, processes, or procedures that you will use to continually monitor and update the risk register throughout the life of the project.

Describe the method(s) you will use to monitor if risks are being triggered.

Describe the method(s) you will use to identify and plan responses to newly identified risks.

Describe the method(s) you will use to review and update any contingency reserves.

Describe the timing on all of the above. For example, some you may do daily, others weekly, others monthly. Perhaps these tasks will be done as part of your regular status meetings or at special meetings to discuss risk.


Risk Register

Note: The first line is an example. Delete it when creating your own risk register.


A B C D E F G H I J K L M  
Risk No. Risk Name Risk Event Description Risk Impact Description Risk Type Risk Source Risk Trigger Impact Score
1 to 5 Prob. Score
1 to 5 Risk Factor
P*I EMV* Response Type
Response  
X Rain Rain on the day of the picnic reduces the number of attendees resulting in a less festive event, reduced employee morale, and costs that can’t be reimbursed. Other Weather Chance of rain ≥30% forecasted seven days prior to picnic. 4 2 8 $20,000 Mitigate Set up enough large tents to house all scheduled attendees. In addition to outdoor activities, plan indoor events or activities in tents. Encourage everyone to come rain or shine.  
1  
2  
3  
4  
5  
6  
7  
8  
9  
10



*EMV = probability of risk event * cost/impact if it does occur. Example: If it rains and we do nothing, people will not show up and we will lose the $100,000 that is due to caterers, event planners, etc. With a 20% chance of it raining, the EMV can be calculated as follows: $100,000 * 20% = $20,000. If we can mitigate the impact for less than $20,000 by implementing the response plan, it may be considered a good investment to do so.

Risk Monitoring and Control

Risk monitoring and control is about ensuring that you are responding to risks as planned, identifying and planning responses to newly identified risks, and reviewing and updating all contingency reserves (time and money). Your risk management plan should include the steps, processes, or procedures that you will use to continually monitor and update the risk register throughout the life of the project.
Address the following items for monitoring and controlling project risks in the provided Risk Management Plan Template:
Describe the method(s) you will use to monitor if risks are being triggered.
Describe the method(s) you will use to identify and plan responses to newly identified risks.
Describe the method(s) you will use to review and update any contingency reserves.
Describe the timing on all of the above. For example, some you may do daily, others weekly, others monthly. Perhaps these tasks will be done as part of your regular status meetings or at special meetings to discuss risk.
References:
Hampton, J. J. (2015). Fundamentals of enterprise risk management: How top companies assess risk, manage exposure, and seize opportunity. New York NY: American Management Association.
Project Management Institute. (2017). A Guide to the Project Management Body of Knowledge (PMBOK® Guide). Sixth edition. Newtown Square, PA: Author.

REQUIREMENTS
Monitoring       Risk  and control

COIT20264 Network Design (HT2, 2018)

Assessment Item 1 - Written Assessment

Due date: Part A:
On-campus students - During the workshop (Weeks 7);
Distance students - Discuss with Unit Coordinator
Part B: 08:00am AEST, Monday, Week 9 ASSESSMENT  
Weighting: Part A: 10%; Part B: 30% 1  
Length: Part A: Maximum of 10 minutes for presenting and       5 minutes for answering the questions and the discussion.
Part B: No word count limit.

Objectives
This assessment task relates to Unit Learning Outcomes 1 to 5 and can be undertaken in a group of up to 4 students or individually. Distance students can form groups with on-campus students as well. Using top-down network design methodology, you will develop your logical network design based on the scenario given on page 5 of this document. You may make any justifiable assumptions but you should mention them wherever you use. You are also expected to contribute to the Group Discussion Forum in Moodle by finding the answers to the recommended weekly group discussion questions. This assessment task has two parts, Part A and Part B.

Part A of Assessment Task
All students
In Part A of this assessment task, you will create and deliver an oral presentation on your logical network design and receive feedback from your peers and/or the tutor. The presentation should include the answers to the weekly discussion questions Q2 of Week 4, Q2 of Week 5 and Q2 of Week 6.

On-Campus students
On-campus students should deliver their presentations during their workshop in week 7. You will be required to work in groups of up to 4 or individually. The maximum duration for the presentation of your group will be 15 minutes, including 5 minutes for answering the questions and any discussion. This time frame will be strictly enforced due to time constraints.

Please note that the presentations must be completed on the scheduled day. If your group does not present on the scheduled day, each member of the group will receive 0 marks for Part A unless you have a valid reason supported by evidence such as a medical certificate. This also applies to any member of the group who does not present with the group on the scheduled day.

Distance students
Distance students should contact the unit coordinator by the end of week 3 and agree for a suitable presentation method and time. You (or the group) could also record your presentation and uploaded to YouTube with a link provided in the presentation slides. Answering of questions could then be undertaken via telephone at a mutually agreed time. You should complete your presentations in week 7 of the term.

Note: You must follow the Harvard citation and referencing guidelines when preparing your presentation slides.
Check the unit website at least once a week for further information relating to this part of the assessment task. Please ensure that you prepare your presentation slides in your own words to avoid possible plagiarism and copyright violation. You can understand the Plagiarism Procedures by following the corresponding link in the CQUniversity Policies section of the Unit Profile.

Assessment Criteria for Part A
In Part A of this assessment task, you are assessed mainly against your ability to analyse the given scenario and document and present a logical network design using the top-down network design methodology. The marking criteria for Part A of this assessment task are provided on page 3. You need to familiarise yourself with the marking criteria to ensure that you have addressed them when preparing and presenting your logical network design.
Each one of you in the group receives the same mark if you deliver your presentation on the scheduled day.

Note:
Marks of presentations will not be released to you until they have been moderated by the Unit Coordinator.


Marking Criteria for Part A


Criteria HD D C P F Max Mark Mark
Obtained  
  1 0.8 0.7 0.6 0.4 0  
1. Presentation structure:
a. Introduction
Introduce you and your group members, and the presentation road map. Aim to engage your audience from the beginning of the presentation. Contained all aspects. Contained all aspects but presentation road map was not clear Contained all aspects but poor engagement of audience. One aspect missing. Two or more aspects missing. 1
   
5 4.25 3.75 3.25 2.4 1.2  
b. Body
Marks will be given for the quality of the content that you deliver. The content must explain your logical design supported by the outcomes of specified weekly discussion questions. You cannot earn more than 1.2 marks without addressing the specified weekly discussion questions. Covered all information in detail. Covered all information but not enough detail. One or two items missing. Three or four items missing. Specified weekly discussion questions have not been addressed or most information missing. 5  
1 0.8 0.7 0.6 0.4  
c. Conclusion
Summarise the key points that you presented in the body. Contained all points. One point missing. Two points missing. Three points missing. Four or more points missing. 1  
2. Delivery
Do not read the full text, practice and keep to the time limit.
Use the time carefully without rushing at the end. Very clear delivery and within time. Very clear delivery and within time but rushed at the end. Not very clear delivery but within time. Not clear delivery and rushed at the end. Took more than 10 minutes. 1  
2 1.7 1.3 1 0  
3. Questions
Coping with questions at the end of the presentation (the telephone interview for the distance students). Answers to both questions were correct. Answer to only one question was correct. Answers to both questions were not very correct. Answers to both questions were incorrect. Could not answer the questions. 2  
4. Presentation slides
Ensure that the slide contents are clearly visible to entire audience and your slides are well–prepared and useful.
Use your slides effectively (i.e. integrated into the presentation). Prepared very well as specified with all key information. Prepared very well as specified with all key information but too small font. Contained all key information but too much text on slides. Lacked in information. Not clear or most information missing. 2  
Comments:  
Total 12



Part B of Assessment Task
In Part B of the assessment task, you will produce a written report of your logical network design taking the oral feedback that you received on your presentation in Part A of the assessment task into consideration.
Your report should include:
1) List of Business Goals and Constraints
2) List of Technical Goals and Tradeoffs
3) Table of User Communities, Data Stores, Network Applications and Traffic Flows
4) Model for addressing and naming
5) Explanation and justification of the logical network design
6) Logical network diagram(s) including addressing and naming
7) Discussion of routing and switching protocols
8) Discussion of security mechanisms
You should not include an executive summary, a table of contents, an introduction or a conclusion.

Note: You must follow the Harvard citation and referencing guidelines when writing your report.
Check the unit website at least once a week for further information relating to Part B of the assessment task. Please ensure that you write your report in your own words to avoid possible plagiarism and copyright violation. You can understand the Plagiarism Procedures by following the corresponding link in the CQUniversity Policies section of the Unit Profile.

Assessment Criteria for Part B
In Part B of this assessment task, you are assessed mainly on your ability to analyse the given scenario and design & document a logical network using the top-down network design methodology. The marking criteria for Part B of this assessment task are provided on page 6.
You need to familiarise yourself with the marking criteria to ensure that you have addressed them when preparing your logical network design report.

Submission
Each one of you in the group must upload the same presentation slides and the same written report to Moodle on or before the due date.


The Scenario for Network Design Assessment Tasks
Your company in Australia specialises in designing networks for local and international clients. Your company has signed a contract with NTN private nursing school located in Sydney, Australia to design their network.
The main campus of NTN is located in Sydney and the satellite campuses are located in Darwin and Cairns. NTN has made agreements with three private hospitals in Sydney, Darwin and Cairns to provide the internship and training to the students of the nursing school. All three private hospitals have Wi-Fi access points that can provide a minimum of 100Mbps data rate to a user. The 2-storey buildings of main and satellite campuses are less than 200m away from the corresponding private hospitals. Each campus building is approximately 15m wide and 40m long.
Lecture, tutorial and laboratory classes are conducted in the campus in Sydney and they are live-video streamed to the satellite campuses forming a virtual classroom. The instructors and the students in the satellite campuses can directly communicate with the lecturer in the Sydney campus when a virtual class is in progress. At any time, there will be at most 200 students in the main campus and a maximum of 100 students in each satellite campus participating in a virtual class. However, these numbers are expected to double within the next couple of years.
NTN also plans to provide a telemedicine and healthcare service to the community in a radius of about 200km from each satellite campus by having a small mobile team of doctors and nursing students. The mobile team in Darwin as well as in Cairns provide consultations and services to the needy patients at their homes. The mobile teams travel around in a specially equipped vehicles called the home-care vehicles, however, unlike in the conventional ambulance services, they do not carry the emergency patients to the hospitals. The mobile team should be able to scan/photograph and send the reports of the patients immediately to the corresponding private hospital and communicate directly with the medical staff there via the network in the home-care vehicle.
Using the top-down network design methodology, you are to design the networks of the main campus, satellite campuses and the home-care vehicles. You are allowed to make assumptions in relation to business and technical goals if they are really required for undertaking your network design. Each step of your network design should clearly explain and justify how you satisfy the business and technical goals.
Note: This scenario was created by Dr Rohan de Silva on 12th December 2014 and no part of this scenario should be reproduced by any individual or organisation without written permission from CQUniversity, Australia.


Marking Criteria for Part B


Criteria HD D C P F Max Mark Mark  
  3 2.55 2.5 2.25 2 1.95 1.9 1.5 1.4 0.7 0  
1) List of Business Goals and Constraints Thorough accurate list. One or two items missing. Three or four items missing. More than four items missing. Not clear or most information missing. 3  
2) List of Technical Goals and Tradeoffs Thorough accurate list. One or two items missing. Three or four items missing. More than four items missing. Not clear or most information missing. 3  
3) Table of User Communities, Data Stores, Network Applications and Traffic Flows Thorough accurate table. One or two items missing. Three or four items missing. More than four items missing. Not clear or most information missing. 3  
4) Model for addressing and naming Thorough accurate model. One or two items missing. Three or four items missing. More than four items missing. Not clear or most information missing. 3  
HD D C P F  
4 3.4 3.3 3 2.9 2.6 2.5 2 1.9 0.95 0  
5) Explanation and justification of the logical network design Covered all information in detail. Covered all information but not enough detail. One or two items missing. Three or four items missing. Not clear or most information missing. 4  
6) Logical network diagram(s) including addressing and naming Covered all information in detail. Covered all information but not enough detail. One or two items missing. Three or four items missing. Not clear or most information missing. 4  
7) Discussion of routing and switching protocols Covered all information in detail. Covered all information but not enough detail. One or two items missing. Three or four items missing. Not clear or most information missing. 4  
8) Discussion of security mechanisms Covered all information in detail. Covered all information but not enough detail. One or two items missing. Three or four items missing. Not clear or most information missing. 4  
  Copy the presentation (Part A) mark here 12  
Late submission penalty  
 
40

MGMT 20134 Business Ethics and Sustainability

Individual Assignment ( essay)


Assessment Due Date Week 6 Friday (24-Aug-2018) 23:55 PM AEST

Return Date to Students Week 8 Friday (09-Sep-2017)

Weighting 40%

Word Guide: 2000-2500 words

Essay Task

Students are required to discuss the following:

Many managers, when working overseas in particular in developing countries, engage in bribery and corruption as a way of securing contracts or ensuring that business transaction occur in a timely fashion. They often argue that whilst they would not engage in such practices in their home country, it is a common accepted practice and part of the culture of many developing countries.
Explain what is bribery, corruption and its link to ethics.
Examine bribery and corruption using ethical relativism. Can such practices be seen as part of a nation’s culture? If so what are the implications.
Contrast bribery and corruption from the perspective of consequentialism, deontology and virtue ethics and how a manager would use to explain, defend or refute the practice.
Contrast the Australian legislation that addresses the bribery of foreign officials with at least 1 other country’s approach.
Based on the above discussion, draw your own conclusions as to whether you believe bribery and corruption is or is not ethical.

Assessment Criteria

Students are to demonstrate knowledge of the subject matter by:
Defining key terms and concepts related to ethics, morality, personhood and moral accountability
Advancing a resolution to the ethical dilemmas using ethical theories and concepts with examples to illustrate
Demonstrating a breadth and quality of research by using a minimum of 12-16 academic sources
Correctly using of the APA in text referencing system to correctly citing academic sources.

These are the minimum requirements. Students should note that satisfactorily meeting the minimum requirements will typically result in the minimum pass grade being awarded.

As Masters students you are required to engage in research as per the Australia Quality Framework (AQF) guidelines.
Two specific requirements need to be considered.
1. Students need to demonstrate “a body of knowledge that includes the understanding of recent developments in a discipline and/or area of professional practice, and
2. Students must demonstrate "knowledge of research principles and methods applicable to a field of work and/or learning”.

Each unit in the MBA has a number of required weekly readings in terms of academic texts, journals and business publications that represent the appropriate body of knowledge and recent developments referred to by the AQF. In order to demonstrate the ability to engage in appropriate research, students should read and utilise these texts and journals and publications. As Masters students you are expected to research beyond this minimum standard through additional texts, journals and studies to demonstrate an ability to engage in independent research.
Your attention is drawn to the University’s stated position on plagiarism. THE WORK OF OTHERS, WHICH IS INCLUDED IN THE ASSIGNMENT MUST BE ATTRIBUTED TO ITS SOURCE (a full list of references must be submitted as part of the assessment).

Referencing Style American Psychological Association (APA)
Submission Online
Hard copy





MGMT20134 (BES) Assess 1 of 3
Business Ethics & Sustainability 
Individual Essay e-Proposal (10% of 40%)
Edit/Bring/Submit e-Copy
Proposal 10%+ Main Business Plan 30%=Total of Business Plan 40%
MARK:          % of    10%
Name:
Essay  Title: 
Table of Content:
Introduction: Reason/Rationale:
Personal Career-relevance
Description of Key Ethics Scenario:
Applied Theories:
Deontology (Fundamental Moral Duties)
Utilitarian
Relativism
Reality seen through:
Ontology (Existence/Being)
Epistemology (Understanding/Functions) 
Key body of Arguments
Examples
Conclusion
References & Bibliography: Harvard system (*on portal)
Appendices: Statistics, Tables, Figures, Pictures, YouTubes etc.…

Assess 1 of 3: Examining Ethical Issues in Business
Assessment Type
Written Assessment
Task Description
This assessment task is designed to assist students to examine a range of ethical issues and to apply ethical theories as means of arriving at a justifiable decision. Students will have the opportunity to examine international business ethics issues, specifically related to corruption, bribery and practice using ethical concepts and theories.
A detailed rubric and an audio file are available on the Moodle site that provides further details regarding this
assessment.
Assessment Due Date
Week 6 Friday (24 Aug 2018) 11:59 pm AEST
Submit via the Moodle site
Return Date to Students
Week 8 Friday (7 Sep 2018)
Feedback will be provided via Feedback studio.
Weighting: 40%
Assessment Criteria
Students are to demonstrate knowledge of the subject matter by:
Defining key terms and concepts related to ethics, morality, personhood and moral accountability
Advancing a resolution to the ethical dilemmas using ethical theories and concepts with examples to illustrate
Demonstrating a breadth and quality of research by using a minimum of 12-16 academic sources
Correctly using of the APA in text referencing system to correctly citing academic sources.
These are the minimum requirements. Students should note that satisfactorily meeting the minimum requirements will typically result in the minimum pass grade being awarded.
Research Requirement:
As Masters students you are required to engage in research as per the Australia Quality Framework (AQF) guidelines.
Two specific requirements need to be considered.
Students need to demonstrate “a body of knowledge that includes the understanding of recent developments in a discipline and/or area of professional practice, and
Students must demonstrate "knowledge of research principles and methods applicable to a field of work and/or learning”.
Each Masters unit has a number of required weekly readings in terms of academic texts, journals and business publications that represent the appropriate body of knowledge and recent developments referred to by the AQF.
In order to demonstrate the ability to engage in appropriate research, students should read and utilise these texts and journals and publications. As Masters students you are expected to research beyond this minimum standard through additional texts, journals and studies to demonstrate an ability to engage in independent research.
Your attention is drawn to the University’s stated position on plagiarism.
THE WORK OF OTHERS, WHICH IS INCLUDED IN
THE ASSIGNMENT MUST BE ATTRIBUTED TO ITS SOURCE using the APA in text referencing system (a full list of references must be submitted as part of the assessment).
Referencing Style
American Psychological Association (APA)
Submission: Online
Learning Outcomes Assessed
investigate the interconnections between business ethics, sustainability and globalisation; and evaluate the differences between ethics, legal requirements and cultural factors in a business setting;
explain the various aspects of business sustainability and how these impact upon business strategy;
critique the major ethical theories and frameworks and be able to compare these in a contemporary business setting;
discuss the management of business ethics within an organisation and explore the role of tools such as Codes of Conduct, Risk Management frameworks and gift policies in assisting such management; and demonstrate commonly accepted professional ethical standards in the work place and in your behaviour toward others.
Graduate Attributes
Knowledge
Cognitive, technical and creative skills
Self-management
Ethical and Professional Responsibility

Pepsi Risk Management.

PROJECT RISK MANAGEMENT APPROACH
Purpose of Risk Management Plan
Purpose of a risk management plan is to identify potential risks before they happen.  Being able to identify such risks before they occur will help the organization to plan on how to counter such risks with a perfect solution. The aspect of the early preparation of such risk occurring will help in planning and minimizing effects of the risks. Also, different ways of handling the risk will be developed in advance and a technical team will be ready to implement such plans to avoid time wastage and potential damage during the process of implementing the strategic measures to counter the potential effects of the risk.
Explain how risk management will be approached for the project.
Risk Management Approach.
Risk management involves the following steps, first, the risk needs to be identified, then the risk is assessed and the final process is minimizing the effects of the risks to an acceptable level. The risk management process will determine the process used to handle the risk encountered in Pepsi. In my case, I will use the five known risk process which is as follows.
1. Identifying the risk. The step involves doing a research about likely risks which may affect the organization day-to-day business activities such as fire and many others and writing them down.
2. Analyzing the risk. Then the risk identified needs to be analyzed to understand it better so as to draw a perfect conclusion about it.
3. Ranking the risk. The risk identified will then be weighed then as per the weight of effects likely to be caused by the risk then it will be ranked or rated in a scale of ten.
4. Treating the risk. This step involves actual planning of dealing with the risk identified if it occurs. These step also involves identifying the risk with the highest rate of damages and working on it until it reaches an acceptable level.
5. Monitoring and reviewing the risk. This step involves constantly checking the risk identified if it will happen or not. These step involves actively monitoring the possibility of the risk occurring so that it can be taken care of faster before widespread influence has been witnessed.
Risk management approach also covers the tools which will be used to handle the risk. The organization needs to have the right tools to be able to combat and solve risks successful. A good example is a fire, Pepsi needs to equip its branches with adequate firefighting equipment in case the risk of fire happens. Tools help in making the work easier or some of these risks won't be solved without the use of the right tool. So the management of Pepsi needs to have enough tools at their disposal for their technical team to use.
PROJECT RISK MANAGEMENT PROCESS
Risk management process is a step to step process just like any other process with an aim of identifying risk and solving its effects or minimizing the cost of damages the risk might cause if it happens. Risks are uncertain in nature their might happen or fail to happen and sometimes it might cause a small effect and also it might cause a huge effect. So the organization should be ready to tackle such issues that is why a risk management plan is very crucial for organizations such as Pepsi.
Project Risk Identification
The methods used to identify the possibility of the risk occurring are as follows.
Brainstorming I will implement this idea by exchanging ideas with the risk management team of Pepsi with an aim of coming up with potential ideas of risks which might happen to the organization. Another viable method to use is a direct observation of how the employees. There is a lot of information which can be gathered by just viewing the operations of the business operations.
Observation method will give the risk management team enough information needed to develop a perfect plan to counter risks because small errors which might cause the risks can be identified. The employees might be careless when handling their cigarette smoking habits which might cause a problem these can be observed and the risk causing factor eliminated in advance.
An interview is a method which will help the team to get important information from the employees of Pepsi. The person doing the interview should focus on getting information which relates to certain risks which might be encountered by the organization. The nature of the interview should be kept private to protect the employees who provide important information.
An incident analysis will assist the team in understanding risks which have already happened in the past. The risk register is a very important source of information for this method. This method helps the team to understand issues which might affect the organization and have already happened. The team should be able to analyze if the same risks might happen to the organization again and take pre-caution steps in preventing the risk from happening.
Types of risks which might happen to Pepsi organization are varied in nature, the organization should be wary of them and plan how to handle the varied types of risks which are as follows.
Reputational risk. There is a type of risks which target the name of an organization. These type of risk might bring bad press which might result in a potential loss of customers. These risk might cause an organization to reduce its operations in some areas which will result in loss of the market share and their profit margins.
Operation risk is another type of risk which should be avoided or solve when it is first noticed. These risks affect the operations or workings of an organization. Such a risk can render an organization obsolete because their operations are compromised and they might not be able to provide goods or services to their customers.
Compliance risk is brought about when an organization fails to fulfill the requirements needed for the organization to run the business. There are many compliances which the government has set which they require all business to comply with the failure to do so might result in shut down, huge fines and even jail terms.
Other risks which might affect a business organization are strategic and financial risks. Strategic risks relate to the strategies which have been developed by the business organization. These risk might arise when the strategies are compromised or they fail to provide the results which are favorable. Financial risk happens when an organization faces funding related issues which might be bankruptcy or even their accounts have been frozen.
There are many sources of project risks which might affect the organizations. One of them is the staff of the organization. Human beings are prone to errors when they are tired or just when they don't want to do a task. They can cause massive errors which might cause problems to the organization due to malice or just pure negligence. Vendors who are also human beings can provide shipments which are not satisfied which might cause accidents and possible risks to the organization. Another source of risks is the law of the land, these laws can be the cause of compliance related risks which any organization can suffer from these can be solved by hiring qualified legal advisors. Other sources of risks are technology which the staff is not able to operate well it can cause risks. The one source of risks which can not be controlled by man is weather, which can cause huge damages luckily there are insurance companies which can help sort these out.
Project Risk Assessment.
I will develop risk measuring scales which can explain my findings better since the whole undertaking was done by me and my team using a scale we understand well will help in bringing out a perfect outcome.
Risks will be prioritized based on the effects it can cause according to the measurement scale. The risks which can cause a huge damage will be ranked higher as compared to a risk which will cause a small damage which will be ranked lower and given smaller priorities.
Project Risk Assessment (Quantitative)
Risk will be prioritized using EMV based on the cost of damages they can cause. The risk which can cause a huge cost in damage using EMV will be prioritized more than the risk which can cause a small damage based on the EMV which will be given lower priorities.
Project Risk Response
Identifying and responding to new risks is very vital in the risk management planning. Methods in identifying risks are through observation, interviews, surveys, past incidents analysis and many more. The response to every newly identified risk should be according to the ten strategies in the PMBOK.
Risk Monitoring and Control
Methods used to monitor the risk of occurrence in Pepsi are voluntary, obligatory and continual. These three methods of monitoring the occurrence of risks cover all aspect and make it simple to handle the effects of a potential risk. Voluntary is a monitoring method which is not obligatory and an organization have a choice to monitor a risk or not using the voluntary method. Obligatory monitoring method is a method which is required by the law of the land and the organization has no choice but to monitor risks. The third monitoring method is continual. This method is important while monitoring major risks because the risk is monitored continuously over a long period of time.
The method I will use in reviewing and updating the contingency reserves is expected value method. Contingency reserves involve the amount of anticipated amount of money which will cover the damages which might be caused due to the occurrence of a risk. The expected value method (EVM) uses the formula EV = x1p1 + x2p2 + .... xnpn.
N refers to the number of observations and p represent the probability of risk to happen and its outcome.

Risk Register



 REFERENCES
Hampton, J. J. (2015). Fundamentals of enterprise risk management: How top companies assess risk, manage exposure, and seize opportunity. New York NY: American Management Association.
Project Management Institute. (2017). A Guide to the Project Management Body of Knowledge (PMBOK® Guide). Sixth edition. Newtown Square, PA: Author.

SWK201e Legal & Ethical Issues in Helping Professions Tutor-Marked Assignment July 2018 Presentation

TUTOR-MARKED ASSIGNMENT (TMA) This assignment is worth 35% of the final mark for SWK201e Legal and Ethical Issues in Helping Professions. The cut-off date for this assignment is Monday, 2nd of September 2018 2355. Assignment guidelines: 1. Please include a cover page that shows the title of the course, the assignment topic, the submission date, your name and student ID. 2. The total length of your paper should not be more than 1400 words. It should be typewritten, double-spaced, with 1-inch margin all round, and ‘Times New Roman’ fontsize 12. The file name should be in this format: FullName_TMA01 3. Plagiarism and collusion are forms of cheating and are entirely unacceptable. SUSS has extremely strict procedures for dealing with plagiarism and collusion. Please ensure that you do not inadvertently commit these offences by quoting and referencing correctly according to APA guidelines. 4. Provide at least 2 other references (besides your textbook) and cite them in APA format.

Question 1
You are a social worker of a youth work organisation, providing school social work. The Health Promotion Board has engaged your organisation to provide the Youth Sexuality Program in secondary schools. Recently, after running a psychoeducation group for 16 year-old students in a school, one of the students Xavier came to see you. He looked very distressed and wanted to see you for some advice. Apparently, he had been experiencing painful sensation when he urinates. He has also observed unusual sores around his sexual organ. Xavier admitted that he was curious about sex and had followed some older friends to engage in paid sex. They usually looked for prostitutes who advertised their services online. On a few occasions, Xavier had unprotected sex. Xavier was extremely worried that he might be infected with a sexually transmitted disease (STD). However, he had not gone to seek medical help as he did not want his parents to know. He also did not know how to handle if he was found to have contracted HIV/AIDS. Xavier told you that if that was to happen, he would be devastated.
1. Identify and discuss clearly the ethical problem presented in this case.
2. Using the Ethical Principle Screen Model, explain how you would resolve this ethical problem. You have to apply every principle in the EPS. If a particular principle is not relevant in the case, you have to explain why it is not relevant. Your paper should be properly formatted to discuss the 2 relevant sections, keeping to a word limit of 1,400 words.

---- END OF ASSIGNMENT ----

NAME : MARIAH BILL
REGISTRATION NUMBER :
COURSE TITLE :
COURSE CODE :
DATE OF SUBMISSION :






Based on the case, identify ethical problems.
Based on the case there are ethical problems which have been encountered. Ethics is the aspect of living in the right way whether by following laws which govern the nation or through habits which are accepted by the society. Having taken these into consideration now a clear point of discussion about our topic kicks in. The topic is very sensitive to our generation because it affects younger members of the society. The issue which involves minors engaging in paid sex with adults is very serious and necessary steps need to be taken to address these issue. These issue of sex between minors and adults is a major factor to me as a social worker. There were many ethical problems which were encountered in these case of Xavier who is a minor.
There was an instance where the taboo of the society was broken. The aspect of minors paying prostitutes who are adults so that they can have sex with them is a big issue. Ias we all understand that prostitutes are not perceived well in the society they are taken as out-casts who bring bad image to the community. So the kids including Xavier breached the way in which the community viewed these prostitutes and in the process committing a taboo. It is not allowed for teenagers to be running up and down paying money for sex. There is a high probability that the money used was given to them by their parents.
According to the case, there is an absolute corruption of the teenage morals. The reality of going around and influencing each other by the students to buy sex from prostitutes is a total moral decay. The norm is unacceptable because the students behaved in a manner which is contrary to what is expected of them. The prostitutes who allowed the kids to have sex with them knowing well that they are under-age lack morals. The prostitutes should envision their sons doing the same act. They should have acted responsibly and denied them the opportunity to do sex and report them to police even anonymously. Acting in that manner could have helped the young Xavier the troubles of dealing with possible Sexual Transmitted Disease and even possible Aids infection. The prostitutes should have also ensured that the teenagers wear a condom if it was a must they engage in sexual activities with them.
Another ethical problem visible in the case is that there is minor corruption. Which needs to be addressed by teaching kids well when they are younger. The kids should understand that such behaviors corrupts the mind and the soul and will only be led to downfalls and bad grades. The aspect of a minor being corrupted needs to be addressed by both teachers and mainly parents. The parents should follow all the materials which the teenage has access to online. Such behaviors can be caused by lack of proper monitoring and also education to the younger generation. The parent needs to monitor what their kids watch while browsing online because there are a lot of materials online which can corrupt the mind and soul of the kids. The parents should ensure their cable television are censored and also their home internet is closely monitored and sexual material sites are censored.
According to my view to these case, there is an aspect of unprofessional behavior. These ethical problems exist in the case the only problem is that I am not sure if prostitution is a profession. Some suggest it is the oldest profession in the world. The prostitute who had sex with Xavier behaved in an unprofessional manner by having sex with a client without ensuring proper protection such as a condom. The prostitute acted in a reckless way and could endanger the lives of her clients. She could also be endangering her life through such acts which can cause them to be infected with disease or even get pregnant to unwanted and unplanned for baby.
Based on the case, identify ethical dilemma.
An ethical dilemma arises when an individual is at a problem to choose between choices. The agent or individual in our case is Xavier who had a choice to make of either telling his parents, keeping quiet or seeking for help from a professional. The agent Xavier was having problems while urinating after engaging in unprotected sex with prostitutes. He had sores on his private parts because he had not sought medical help because his parents would know of it. He feared his parents because he did not know how they would react to the issue. Keeping quiet had also affected him because the sexually transmitted disease was eating him up he needed help quickly. The option he had was seeking help from the professionals who will help him advise him and keep secret about it.
Another major dilemma which Xavier had to face was about HIV and AIDS. He was at a crossroad because he did not know how to handle the fact if he had been exposed to the virus and had not sought medical help. Xavier was a dilemma in such instance that he did not know how to handle the news if he had been infected with Aids. He also did not want his parents to learn of such news which can be received badly. He was hoping for the best because he had no other option but to just hope that he is HIV negative.
Conclusion.
As per my assumptions, social workers have an obligation of trying to correct such wrong-doings in the society. They can achieve so by reporting such matters to the right governmental bodies which are tasked with handling the issue and bringing it to an end. I hope the social worker responsible for reporting the case of Xavier reported to the school administration and also the policing arm of government so that the prostitutes can be arrested. There are sections in the law which states the professionals should report such acts to the responsible bodies so that necessary steps can be followed to curb such behaviors.



References
Richard, C. (2011). Ethical problems (the list). Retrieved from https://mediacultureclass.wordpress.com/2011/11/21/ethical-problems-the-list/
The New Social Worker. (2012). What Is an Ethical Dilemma?. Retrieved from http://www.socialworker.com/feature-articles/ethics-articles/What_Is_an_Ethical_Dilemma%3F/