Tech-level in IT – Scheme of Work
Level 3 Technical Level IT: User Support
Unit: Organisational systems security Unit type: Externally assessed Guided learning hours: 90
Guidance notes:This scheme of work (SoW) illustrates how the unit content could be delivered using a three term, ten weeks per term, approach. Consideration should be given to the content in other units within this qualification when planning your unit and lessons – the content in some units for example would benefit from being covered prior to others – especially the knowledge and theory elements contained within the other externally assessed units.
It is recommended that learners have studied the following units prior to studying ‘Organisational Systems security’:
- Fundamental principles of computing.
- Unit 1 – Fundamental principles of computing
- Unit 3 – Developing and maintaining computer networks
- Unit 4 – Supporting end users.
- Unit 5 – Installing and maintaining software
- Unit 7 – Computer forensic investigation
- Unit 8 – Industrial Project
Week Number / Specification reference
Assessment outcome / Key learning objectives
Consider inclusion and differentiation (as appropriate and relevant) Equality and diversity in BLUE (to be enhanced by unit teacher as appropriate for learner group) / Learning activities and resources
What will be learner led?
What will be Tutor led?
Topics for plenary?
Homework?
Classroom based or off-site?
Employer engagement?
Stretch and challenge in RED (to be enhanced by unit teacher as appropriate for learner group) / Plenary
How will learner progress be checked?
Evidence requirements? / Embedding or contextualising (opportunities for skills development)
Maths in PURPLE
English in GREEN
Transferable skills in ORANGE
Autumn Term
1 / Assessment outcome 1 – Understand potential threats and risks to organisational systems / Information Security:
- explain the importance and relevance of the following to data in organisational systems:
- confidentiality
- integrity
- availability.
- overview of unit
- unit’s place in the IT: user support scheme
- overview of the structure and content of the lesson.
- research the types of data that organisational systems collect, create, store and modify.
- identify for each type of data:
- confidentiality (who should have access)
- integrity (how can the accuracy and trustworthiness of the data be assured?)
- availability (how can access be assured, when required?)
- presentation of findings by each group.
- large group discussion and agreement on definitions of confidentiality, integrity and availability of data
- how the level of confidentiality, integrity and availability may vary depending upon the organisational system.
- Discuss the following article with learners in relation to the content above:
cio.com/article/2857673/security0/5-information-security-trends-that-will-dominate-2015.html
The following slide presentation might also be useful: slideshare.net/mrmwood/25-safety-and-security-of-data-in-ict-systems
Recap of lesson.
Stretch and challenge: learner could develop an article for a security publication explaining, using examples from a real business and the three aspects of information of security.
Resources:
- Information security
- Organisational Structures and Systems
- Observation of:
- engagement in research activities
- contribution to group discussions
- contribution to preparation of presentation.
2 / Assessment outcome 1 – Understand potential threats and risks to organisational systems / Internal and external threats to organisational systems:
- explain the damage to data caused by internal threats that are accidental:
- localised disaster eg water leak, fire damage
- human error
- technical error
- equipment failure
- equipment damage
- accidental disclosure or deletion
- loss of data.
- natural disasters eg:
- earthquakes
- floods.
- recap of previous lesson and how it links to today
- overview of the structure and content of the lesson.
- research examples of accidental damage, including both internal and external activities
- analyse reasons for and ways of avoiding accidental damage
- present findings to large group.
- review of presentations and findings
- group agreement on what constitutes accidental damage
- how these can be avoided or mitigated
- recap on lesson
- overview of next session.
learners to prepare an article on three types of accidental incident, two internal and one external in nature.
Resources:
- newspaper and journal articles on accidental damage to computer systems
- hand-out on accidental damage
- case studies provided by own IT department or from local businesses
- Threats and vulnerabilities
- Threatasaurus – Computer threats from A to Z
- History of Computer Security Threats
- Observation of:
- engagement in research activities.
- contribution to group discussions.
- contribution to preparation of presentation.
3 / Assessment outcome 1 – Understand potential threats and risks to organisational systems / Internal and external threats:
- understand the dangers of internal threats caused by malicious, software-based events including:
- actions of disgruntled employees eg:
- introduction of viruses
- introduction of a Trojan.
- understand the dangers external threats caused by malicious, software-based events including:
- malware
- viruses
- spyware
- adware
- rootkits
- zombies
- botnets
- logic bombs
- exploits and backdoors.
- other internal threats
- intentional deletions, disclosures and alterations
- other external threats:
- spam
- phishing
- hacking
- denial of service
- zero day attacks.
- recap of previous lesson and how it links to today
- overview of the structure and content of the lesson.
Computing Security article:
explainingcomputers.com/security.html
Learners: to:
- research examples of dangers arising from the introduction of malicious software from internal and external threats
- analyse reasons for and ways of avoiding intentional damage
- present findings to large group.
- review of presentations and findings.
- group agreement on what constitutes intentional damage
- how these can be avoided or mitigated
- recap on lesson
- overview of next session.
learners to prepare an article or leaflet on three types of software threats, two external and one internal in nature.
Resources:
- newspaper and journal articles on intentional damage to computer systems
- hand-out on intentional l damage
- case studies provided by own IT department or from local businesses
- Threats and vulnerabilities
- Threatasaurus – Computer threats from A to Z
- History of Computer Security Threats
- Observation of:
- engagement in research activities
- contribution to group discussions
- contribution to preparation of presentation.
Oral discussions on the research.
4 / Assessment outcome 1 – Understand potential threats and risks to organisational systems / Other potential threats to organisational systems:
- theft or loss of data
- intentional discloser
- theft of assets
- identify theft:
- eavesdropping
- shoulder surfing
- dumpster diving
- snooping
- malicious damage
- website defacement
- counterfeit goods:
- products
- trading standards
- copyright
- industrial espionage
- unauthorised access
- actions of disgruntled employees.
- recap of previous lesson and how it links to today
- overview of the structure and content of the lesson.
- research examples of physical threats, listed in key learning objectives, covering internal and external events
- physical threats to systems:
- analyse reasons for and ways of avoiding physical damage
- present findings to large group.
- review of presentations and findings.
- group agreement on what constitutes physical damage
- how these can be avoided or mitigated.
- recap on lesson
- overview of next session.
- newspaper and journal articles on intentional damage to computer systems
- hand-out on intentional damage
- case studies provided by own IT department or from local businesses.
- Threats and vulnerabilities
- Threatasaurus – Computer threats from A to Z
- History of Computer Security Threats
- Observation of:
- engagement in research activities.
- contribution to group discussions
- contribution to preparation of presentation.
Oral discussions on the research.
5 / Assessment outcome 1 – Understand potential threats and risks to organisational systems / Be able to evaluate the impact of threats on an organisation such as:
- increased costs
- loss of service
- loss of business or income
- loss of property
- loss of reputation and customers
- legal liability.
- recap of previous lesson and how it links to today
- overview of the structure and content of the lesson.
- using case studies and/or presentation by an organisational IT manager identify the types of impact that threats identified in previous weeks may have on organisations
- compare the impact that the threats can have on an organisation.
- large group discussions of research outcomes
- discussion of why the impact of threats may differ from one organisation to another.
- recap on lesson
- overview of next session.
Stretch and challenge:
- prepare a guidance booklet/leaflet for your organisation’s students to give an overview of good behaviour, explaining the impact of a range of internal and external threats on your centre.
- Observation of:
- engagement in research activities
- contribution to group discussions
- contribution to preparation of presentation.
Discussions on the research.
6 / Assessment outcome 1 – Understand potential threats and risks to organisational systems / Risk categorisation and risk assessment:
- risk severity: high, medium or low
- probability: unlikely, likely, very likely
- loss: minor, moderate, major.
- recap of previous lesson and how it links to today.
- overview of the structure and content of the lesson.
- discussion of risk, including probability, severity and loss.
- discussion of risk assessments, documentation, rationale.
- sample risk assessments:
and
- Three software risk assessment examples:
Learners, in small groups:
- using case studies and/or presentation by an organisational IT manager:
- execute a risk assessment procedure and use the correct associated documentation
- differentiate the findings by risk severity, probability and loss.
- recap on lesson and overview of next session.
- ICT Risk Assessment
- 5 steps to cyber security risk assessment
- Observation of:
- engagement in research activities
- contribution to group discussions
- contribution to preparation of presentation.
7 / Assessment outcome 1 – Understand potential threats and risks to organisational systems / Understand and carryout a risk assessment. / Tutor led:
- recap of previous lesson and how it links to today
- overview of the structure and content of the lesson.
Tutor Led:
- large group discussion of risk assessment and outcomes including
- risk severity: high, medium or low
- probability: unlikely, likely, very likely
- loss: minor, moderate, major.
- Learners, individually:
- Carry out a risk assessment on a new information system identifying at least six possible threats
- analyse the findings
- judge the gravity of the potential threats.
- generate a report defining the threats in terms of severity, probability and loss.
- recap on lesson
- overview of next session
- Observation of:
- engagement in research activities
- contribution to group discussions
- contribution to preparation of presentation.
Oral discussions on the research.
8 / Assessment outcome 1 – Understand potential threats and risks to organisational systems / Review assessment outcome 1. / Tutor led:
- recap of the learning outcome.
9 / Assessment outcome 2 – Understand how to secure organisational systems / Physical security:
For example:
- doors
- locks
- 3 barrier systems
- mantras
- cable shielding
- signing in/out procedures
- visitor passes
- smart cards
- access to areas
- biometrics eg:
- retinal scan
- finger print scan
- voice recognition.
- employee training
- code of conduct
- a list of expected behaviours that employees sign to confirm their intended compliance.
- computer misuse agreement
- surveillance.
- recap of previous session
- overview of session.
- small group research in to at least six different physical security methods drawing on experience from placement, tutor provided case studies.
- Physical security – Risks to assets:
- Physical security case studies:
- presentation outcomes of research
- carry out an audit of the physical security of own workplace or learning environment and identify six possible improvements that would enhance the security and produce a set of notes with recommendations.
- review of presentations
- recap of session
- overview of next session.
- case studies
- learner log of placement activities
- real life examples issues arising from poor physical security
- presentation by IT security officer
- access to audit location
- audit recording documentation.
- observation of:
- engagement in research activities
- contribution to group discussions
- contribution to preparation of presentation.
Oral discussions on the research.
Spring Term
10 / Assessment outcome 2 – Understand how to secure organisational systems / Software and network security:
- consider aspects of the following range:
- encryption techniques public and private
- virtual private networks (VPNs)
- data encryption
- passwords
- access levels
- software updates
- firewalls
- anti-virus
- anti-spyware
- copyright
- software licensing
- open source
- shareware and freeware
- commercial software.
- recap of previous session
- purpose of session.
- provide an overview of encryption and VPN, plus a range of the other methods listed below:
- Encryption:
and
computerhope.com/jargon/e/encrypt.htm
and
howtogeek.com/howto/33949/htg-explains-what-is-encryption-and-how-does-it-work/
- VPN
and
howtogeek.com/133680/htg-explains-what-is-a-vpn/
Learner led:
- In small groups:
- research a range of software and network facilities that contribute to organisational security
- explain the precise contribution made by each item
- present findings to the wider group.
- review of presentations
- recap of session
- overview of next session.
- hand-outs
- articles on security and security infringements
- cases studies on security provided by IT specialists.
- Observation of:
- engagement in research activities
- contribution to group discussions
- contribution to preparation of presentation.
11 / Assessment outcome 2 – Understand how to secure organisational systems / Understand the role and importance of:
- hardening
- authentication methods
- recap of previous session
- purpose of session.
- in small groups:
- define the term “hardening” in respect of organisation systems security
- identify a range of hardening activities such as:
- hotfixes
- patches
- service packs
- pack management
- group policies.
- outline the purpose of each activity
- present findings to the larger group
- define the term “authentication as it relates to organisational system security
- describe the following authentication methods:
- one, two and three factor authentication
- single sign-on
- password updating
- rigour of password.
- review of presentations
- recap of session
- overview of next session
- handout practical task.
- Security Awareness – Hardening your computer
- Server hardening
- hand-outs.
- Observation of:
- engagement in research activities.
- contribution to group discussions.
- contribution to preparation of presentation.
12 / Assessment outcome 1 – Understand potential threats and risks to organisational systems
Assessment outcome 2 – Understand how to secure organisational systems / Work Placement for two weeks, working with IT professionals on securing organisational systems. This could be linked with:
- Unit 4: Installing and Maintaining Software
- Unit 7: Developing and maintaining Computer Networks.
- interpret oral instructions or requests
- interpret written instructions or requests
- carry out investigations and risk assessments into at least six different threats
- analyse the outcomes
- compare the potential impact of these threats on the organisation
- monitor the systems in terms of the threats identified
- configure a computer system for secure use and document the process
- reflect on how hardening benefits the systems
- Investigate technical group securities policies within the organisation.
- real work experience.
- feedback from placement supervisor on engagement with activities.
- feedback on aptitude and accuracy when undertaking risk assessments
- feedback on accuracy of interpretation of risk assessment outcomes for at least six different risks.
Discussion.
13 / Assessment outcome 1 – Understand potential threats and risks to organisational systems
Assessment outcome 2 – Understand how to secure organisational systems / Work Placement for two weeks, working with IT professionals on securing organisational systems. This could be linked with:
- Unit 4: Installing and Maintaining Software
- Unit 7: Developing and maintaining Computer Networks.