Level 3 Technical Level IT: User Support

Level 3 Technical Level IT: User Support

Tech-level in IT – Scheme of Work

Level 3 Technical Level IT: User Support

Unit: Organisational systems security Unit type: Externally assessed Guided learning hours: 90

Guidance notes:
This scheme of work (SoW) illustrates how the unit content could be delivered using a three term, ten weeks per term, approach. Consideration should be given to the content in other units within this qualification when planning your unit and lessons – the content in some units for example would benefit from being covered prior to others – especially the knowledge and theory elements contained within the other externally assessed units.
It is recommended that learners have studied the following units prior to studying ‘Organisational Systems security’:
  • Fundamental principles of computing.
The following units are synoptically linked. This means that learning from the units listed can contribute to learning and formative assessment of this unit:
  • Unit 1 – Fundamental principles of computing
  • Unit 3 – Developing and maintaining computer networks
  • Unit 4 – Supporting end users.
  • Unit 5 – Installing and maintaining software
  • Unit 7 – Computer forensic investigation
  • Unit 8 – Industrial Project
The learners will be able to draw on their previous learning experience and transfer their technical knowledge, skills and understanding whilst working through the following activities. This unit is assessed through an external examination set and marked by AQA. The examination takes place under controlled examination conditions and the dates are published at the start of each academic year. Successfully completed practical activities should help prepare learners for the skills and knowledge tested during this external examination.
Week Number / Specification reference
Assessment outcome / Key learning objectives
Consider inclusion and differentiation (as appropriate and relevant) Equality and diversity in BLUE (to be enhanced by unit teacher as appropriate for learner group) / Learning activities and resources
What will be learner led?
What will be Tutor led?
Topics for plenary?
Homework?
Classroom based or off-site?
Employer engagement?
Stretch and challenge in RED (to be enhanced by unit teacher as appropriate for learner group) / Plenary
How will learner progress be checked?
Evidence requirements? / Embedding or contextualising (opportunities for skills development)
Maths in PURPLE
English in GREEN
Transferable skills in ORANGE
Autumn Term
1 / Assessment outcome 1 – Understand potential threats and risks to organisational systems / Information Security:
  • explain the importance and relevance of the following to data in organisational systems:
  • confidentiality
  • integrity
  • availability.
/ Tutor led:
  • overview of unit
  • unit’s place in the IT: user support scheme
  • overview of the structure and content of the lesson.
Learners to:
  • research the types of data that organisational systems collect, create, store and modify.
  • identify for each type of data:
  • confidentiality (who should have access)
  • integrity (how can the accuracy and trustworthiness of the data be assured?)
  • availability (how can access be assured, when required?)
  • presentation of findings by each group.
Tutor led:
  • large group discussion and agreement on definitions of confidentiality, integrity and availability of data
  • how the level of confidentiality, integrity and availability may vary depending upon the organisational system.
  • Discuss the following article with learners in relation to the content above:
5 Information security trends that will dominate 2015:
cio.com/article/2857673/security0/5-information-security-trends-that-will-dominate-2015.html
The following slide presentation might also be useful: slideshare.net/mrmwood/25-safety-and-security-of-data-in-ict-systems
Recap of lesson.
Stretch and challenge: learner could develop an article for a security publication explaining, using examples from a real business and the three aspects of information of security.
Resources:
  • Information security
gov.uk/service-manual/making-software/information-security.html
  • Organisational Structures and Systems
/
  • Observation of:
  • engagement in research activities
  • contribution to group discussions
  • contribution to preparation of presentation.
Contribution to class discussions. / Discussions.
2 / Assessment outcome 1 – Understand potential threats and risks to organisational systems / Internal and external threats to organisational systems:
  • explain the damage to data caused by internal threats that are accidental:
  • localised disaster eg water leak, fire damage
  • human error
  • technical error
  • equipment failure
  • equipment damage
  • accidental disclosure or deletion
  • loss of data.
Explain the damage to data caused by external threats that are accidental:
  • natural disasters eg:
  • earthquakes
  • floods.
/ Tutor led:
  • recap of previous lesson and how it links to today
  • overview of the structure and content of the lesson.
Learners:
  • research examples of accidental damage, including both internal and external activities
  • analyse reasons for and ways of avoiding accidental damage
  • present findings to large group.
Tutor led:
  • review of presentations and findings
  • group agreement on what constitutes accidental damage
  • how these can be avoided or mitigated
  • recap on lesson
  • overview of next session.
Learner led:
learners to prepare an article on three types of accidental incident, two internal and one external in nature.
Resources:
  • newspaper and journal articles on accidental damage to computer systems
  • hand-out on accidental damage
  • case studies provided by own IT department or from local businesses
  • Threats and vulnerabilities

  • Threatasaurus – Computer threats from A to Z
sophos.com/en-us/security-news-trends/security-trends/threatsaurus.aspx
  • History of Computer Security Threats
slideshare.net/Dell/history-of-computer-security-threats /
  • Observation of:
  • engagement in research activities.
  • contribution to group discussions.
  • contribution to preparation of presentation.
Contribution to class discussions. / Discussions.
3 / Assessment outcome 1 – Understand potential threats and risks to organisational systems / Internal and external threats:
  • understand the dangers of internal threats caused by malicious, software-based events including:
  • actions of disgruntled employees eg:
  • introduction of viruses
  • introduction of a Trojan.
  • understand the dangers external threats caused by malicious, software-based events including:
  • malware
  • viruses
  • spyware
  • adware
  • rootkits
  • zombies
  • botnets
  • logic bombs
  • exploits and backdoors.
  • other internal threats
  • intentional deletions, disclosures and alterations
  • other external threats:
  • spam
  • phishing
  • hacking
  • denial of service
  • zero day attacks.
/ Tutor led:
  • recap of previous lesson and how it links to today
  • overview of the structure and content of the lesson.
Tutor led:
Computing Security article:
explainingcomputers.com/security.html
Learners: to:
  • research examples of dangers arising from the introduction of malicious software from internal and external threats
  • analyse reasons for and ways of avoiding intentional damage
  • present findings to large group.
Tutor led:
  • review of presentations and findings.
  • group agreement on what constitutes intentional damage
  • how these can be avoided or mitigated
  • recap on lesson
  • overview of next session.
Learner led:
learners to prepare an article or leaflet on three types of software threats, two external and one internal in nature.
Resources:
  • newspaper and journal articles on intentional damage to computer systems
  • hand-out on intentional l damage
  • case studies provided by own IT department or from local businesses
  • Threats and vulnerabilities
niatec.info/viewpage.aspx?id=168
  • Threatasaurus – Computer threats from A to Z
sophos.com/en-us/security-news-trends/security-trends/threatsaurus.aspx
  • History of Computer Security Threats
slideshare.net/Dell/history-of-computer-security-threats /
  • Observation of:
  • engagement in research activities
  • contribution to group discussions
  • contribution to preparation of presentation.
Contribution to class discussions. / Presentation of results.
Oral discussions on the research.
4 / Assessment outcome 1 – Understand potential threats and risks to organisational systems / Other potential threats to organisational systems:
  • theft or loss of data
  • intentional discloser
  • theft of assets
  • identify theft:
  • eavesdropping
  • shoulder surfing
  • dumpster diving
  • snooping
  • malicious damage
  • website defacement
  • counterfeit goods:
  • products
  • trading standards
  • copyright
  • industrial espionage
  • unauthorised access
  • actions of disgruntled employees.
/ Tutor led:
  • recap of previous lesson and how it links to today
  • overview of the structure and content of the lesson.
Learners:
  • research examples of physical threats, listed in key learning objectives, covering internal and external events
  • physical threats to systems:
dpworkshop.org/dpm-eng/oldmedia/threats.html
  • analyse reasons for and ways of avoiding physical damage
  • present findings to large group.
Tutor led:
  • review of presentations and findings.
  • group agreement on what constitutes physical damage
  • how these can be avoided or mitigated.
  • recap on lesson
  • overview of next session.
Resources:
  • newspaper and journal articles on intentional damage to computer systems
  • hand-out on intentional damage
  • case studies provided by own IT department or from local businesses.
  • Threats and vulnerabilities

  • Threatasaurus – Computer threats from A to Z
sophos.com/en-us/security-news-trends/security-trends/threatsaurus.aspx
  • History of Computer Security Threats
slideshare.net/Dell/history-of-computer-security-threats /
  • Observation of:
  • engagement in research activities.
  • contribution to group discussions
  • contribution to preparation of presentation.
Contribution to class discussions. / Presentation.
Oral discussions on the research.
5 / Assessment outcome 1 – Understand potential threats and risks to organisational systems / Be able to evaluate the impact of threats on an organisation such as:
  • increased costs
  • loss of service
  • loss of business or income
  • loss of property
  • loss of reputation and customers
  • legal liability.
/ Tutor led:
  • recap of previous lesson and how it links to today
  • overview of the structure and content of the lesson.
Learners:
  • using case studies and/or presentation by an organisational IT manager identify the types of impact that threats identified in previous weeks may have on organisations
  • compare the impact that the threats can have on an organisation.
Tutor led:
  • large group discussions of research outcomes
  • discussion of why the impact of threats may differ from one organisation to another.
  • recap on lesson
  • overview of next session.
Learners to prepare an article, leaflet or annotated poster on three types of physical damage, one internal and two external in nature.
Stretch and challenge:
  • prepare a guidance booklet/leaflet for your organisation’s students to give an overview of good behaviour, explaining the impact of a range of internal and external threats on your centre.
/
  • Observation of:
  • engagement in research activities
  • contribution to group discussions
  • contribution to preparation of presentation.
Contribution to class discussions. / Presentation of results
Discussions on the research.
6 / Assessment outcome 1 – Understand potential threats and risks to organisational systems / Risk categorisation and risk assessment:
  • risk severity: high, medium or low
  • probability: unlikely, likely, very likely
  • loss: minor, moderate, major.
/ Tutor led:
  • recap of previous lesson and how it links to today.
  • overview of the structure and content of the lesson.
  • discussion of risk, including probability, severity and loss.
  • discussion of risk assessments, documentation, rationale.
  • sample risk assessments:
crisismapper.wordpress.com/2011/12/14/crisis-mapping-and-cybersecurity-part-ii-risk-assessment/
and

  • Three software risk assessment examples:
gov.uk/government/uploads/system/uploads/attachment_data/file/400106/Common_Cyber_Attacks-Reducing_The_Impact.pdf
Learners, in small groups:
  • using case studies and/or presentation by an organisational IT manager:
  • execute a risk assessment procedure and use the correct associated documentation
  • differentiate the findings by risk severity, probability and loss.
Tutor Led:
  • recap on lesson and overview of next session.
Resources:
  • ICT Risk Assessment
ictknowledgebase.org.uk/riskassessment
  • 5 steps to cyber security risk assessment
govtech.com/security/5-Steps-to-Cyber-Security.html /
  • Observation of:
  • engagement in research activities
  • contribution to group discussions
  • contribution to preparation of presentation.
Contribution to class discussions. / Discussions.
7 / Assessment outcome 1 – Understand potential threats and risks to organisational systems / Understand and carryout a risk assessment. / Tutor led:
  • recap of previous lesson and how it links to today
  • overview of the structure and content of the lesson.
Learners, in small groups, present and justify their risk assessment and outcomes.
Tutor Led:
  • large group discussion of risk assessment and outcomes including
  • risk severity: high, medium or low
  • probability: unlikely, likely, very likely
  • loss: minor, moderate, major.
Learner led:
  • Learners, individually:
  • Carry out a risk assessment on a new information system identifying at least six possible threats
  • analyse the findings
  • judge the gravity of the potential threats.
  • generate a report defining the threats in terms of severity, probability and loss.
Tutor led:
  • recap on lesson
  • overview of next session
/
  • Observation of:
  • engagement in research activities
  • contribution to group discussions
  • contribution to preparation of presentation.
Contribution to class discussions. / Presentation of results.
Oral discussions on the research.
8 / Assessment outcome 1 – Understand potential threats and risks to organisational systems / Review assessment outcome 1. / Tutor led:
  • recap of the learning outcome.
/ Contribution to class discussions.
9 / Assessment outcome 2 – Understand how to secure organisational systems / Physical security:
For example:
  • doors
  • locks
  • 3 barrier systems
  • mantras
  • cable shielding
  • signing in/out procedures
  • visitor passes
  • smart cards
  • access to areas
  • biometrics eg:
  • retinal scan
  • finger print scan
  • voice recognition.
  • employee training
  • code of conduct
  • a list of expected behaviours that employees sign to confirm their intended compliance.
  • computer misuse agreement
  • surveillance.
/ Tutor led:
  • recap of previous session
  • overview of session.
Learner led
  • small group research in to at least six different physical security methods drawing on experience from placement, tutor provided case studies.
  • Physical security – Risks to assets:
it.ox.ac.uk/policies-and-guidelines/is-toolkit/risk-assessment
  • Physical security case studies:
securitymagazine.com/topics/2663-case-studies-physical
  • presentation outcomes of research
  • carry out an audit of the physical security of own workplace or learning environment and identify six possible improvements that would enhance the security and produce a set of notes with recommendations.
Tutor led:
  • review of presentations
  • recap of session
  • overview of next session.
Resources:
  • case studies
  • learner log of placement activities
  • real life examples issues arising from poor physical security
  • presentation by IT security officer
  • access to audit location
  • audit recording documentation.
/ Formative assessment:
  • observation of:
  • engagement in research activities
  • contribution to group discussions
  • contribution to preparation of presentation.
Contribution to class discussions. / Preparation of the presentation of results.
Oral discussions on the research.
Spring Term
10 / Assessment outcome 2 – Understand how to secure organisational systems / Software and network security:
  • consider aspects of the following range:
  • encryption techniques public and private
  • virtual private networks (VPNs)
  • data encryption
  • passwords
  • access levels
  • software updates
  • firewalls
  • anti-virus
  • anti-spyware
  • copyright
  • software licensing
  • open source
  • shareware and freeware
  • commercial software.
/ Tutor led:
  • recap of previous session
  • purpose of session.
  • provide an overview of encryption and VPN, plus a range of the other methods listed below:
  • Encryption:
securitymagazine.com/topics/2663-case-studies-physical
and
computerhope.com/jargon/e/encrypt.htm
and
howtogeek.com/howto/33949/htg-explains-what-is-encryption-and-how-does-it-work/
  • VPN
lifehacker.co.uk/2012/09/05/start-using-vpn-choose-best-one-needs
and
howtogeek.com/133680/htg-explains-what-is-a-vpn/
Learner led:
  • In small groups:
  • research a range of software and network facilities that contribute to organisational security
  • explain the precise contribution made by each item
  • present findings to the wider group.
Tutor led:
  • review of presentations
  • recap of session
  • overview of next session.
Resources:
  • hand-outs
  • articles on security and security infringements
  • cases studies on security provided by IT specialists.
/
  • Observation of:
  • engagement in research activities
  • contribution to group discussions
  • contribution to preparation of presentation.
Contribution to class discussions. / Discussions.
11 / Assessment outcome 2 – Understand how to secure organisational systems / Understand the role and importance of:
  • hardening
  • authentication methods
in securing organisational systems. / Tutor led:
  • recap of previous session
  • purpose of session.
Learner led:
  • in small groups:
  • define the term “hardening” in respect of organisation systems security
techopedia.com/definition/24833/hardening
  • identify a range of hardening activities such as:
  • hotfixes
  • patches
  • service packs
  • pack management
  • group policies.
  • outline the purpose of each activity
  • present findings to the larger group
  • define the term “authentication as it relates to organisational system security
  • describe the following authentication methods:
  • one, two and three factor authentication
  • single sign-on
  • password updating
  • rigour of password.
Tutor led:
  • review of presentations
  • recap of session
  • overview of next session
  • handout practical task.
Resources:
  • Security Awareness – Hardening your computer
colorado.edu/oit/it-security/security-awareness/hardening-your-computer
  • Server hardening
serverhardening.com/
  • hand-outs.
/
  • Observation of:
  • engagement in research activities.
  • contribution to group discussions.
  • contribution to preparation of presentation.
Contribution to class discussions. / Presentation and discussion.
12 / Assessment outcome 1 – Understand potential threats and risks to organisational systems
Assessment outcome 2 – Understand how to secure organisational systems / Work Placement for two weeks, working with IT professionals on securing organisational systems. This could be linked with:
  • Unit 4: Installing and Maintaining Software
  • Unit 7: Developing and maintaining Computer Networks.
/ Learner led:
  • interpret oral instructions or requests
  • interpret written instructions or requests
  • carry out investigations and risk assessments into at least six different threats
  • analyse the outcomes
  • compare the potential impact of these threats on the organisation
  • monitor the systems in terms of the threats identified
  • configure a computer system for secure use and document the process
  • reflect on how hardening benefits the systems
  • Investigate technical group securities policies within the organisation.
Resources:
  • real work experience.
/ Observation of:
  • feedback from placement supervisor on engagement with activities.
  • feedback on aptitude and accuracy when undertaking risk assessments
  • feedback on accuracy of interpretation of risk assessment outcomes for at least six different risks.
/ Presentation.
Discussion.
13 / Assessment outcome 1 – Understand potential threats and risks to organisational systems
Assessment outcome 2 – Understand how to secure organisational systems / Work Placement for two weeks, working with IT professionals on securing organisational systems. This could be linked with:
  • Unit 4: Installing and Maintaining Software
  • Unit 7: Developing and maintaining Computer Networks.
/ Learners: