COM7006:The Case Of Network Data Reveals Theft Of Trade Secrets :Xiaolang Zhang worked as an engineer for Apple’s autonomous car division. He had been with the company 2 ½ years when, IT Security Management Report, MU, Singapore

Assignment Tasks

Part 1: The Case of Network data reveals theft of trade secrets

The fact:

Xiaolang Zhang worked as an engineer for Apple’s autonomous car division. He had been with the company 2 ½ years when he announced that he would be resigning and returning to China to take care of his elderly mother. He told his manager that he would be working for an electric car manufacturer in China. The conversation left the manager suspicious. Company security started an investigation. They searched Zhang’s two work phones and laptop—but were most alarmed when they reviewed Zhang’s network activity. The story the network data told was that Zhang’s activity had spiked to a two-year high in the days leading up to his resignation. It consisted of “bulk searches and targeted downloading copious pages of information” taken from secret databases he could access. When confronted, Zhang admitted to taking company data. The matter was referred to the FBI for investigation. In a proactive move to mitigate against the risk of disgruntled staff members who may attempt to breach company policies to impart information from its facilities, an external digital forensic examiner was employed to analyse all storage media being used within the enterprise.

The investigation is to be conducted using the following scope for all Application Administrator team members.

• Company Policy # 197801 – No data relating to Active Directory strategy must be copied or saved to portable devices.
• Company Policy # 197812 – A Project Manager must approve all electronic communication between technical staff and clients.
• Company Policy # 197806 – Access to all financial institutions is restricted within the organisation’s network in alignment with session 2211 of government financial regulations.
• Company Policy # 197823 – All Virtualization software, proxy bypass and VPN access are limited to the Server Pro Teams.
• Company Policy # 197880 – Deletion of all data and viruses must be reported to the support team and processed by the Data Sanitation Unit.

The takeaway

Above are company policing (digital image) of Zhang storage device that must be urgently analysed. Additionally, reports were received from the helpdesk that the storage media assigned to Zhang was recently formatted and Apple’s autonomous car division team suspects that a phantom Virtual Server was created by a member of the Application Administrator Unit on the 21st of June 2019. The scenario envisioned, in this case, is within the scope of well-defined company policies and procedure focusing on computer savvy individuals. Therefore, one must examine the recovered files to obtain the facts regarding Zhang ’s recent activities. Please note that Zhang is proficient in file editing and renaming extensions and the Company only uses Microsoft Outlook to send emails. This part is a technical one that does not require many words, screenshots of your investigations, an executive summary of the findings and a conclusion will do the job.

Learning Outcomes:

After completing the module, you should be able to:

1) Evaluate the fundamentals theories, models, and ethical practices of security management in an enterprise.

2) Critically understand the fundamentals of the security risk management process.

3) Analysing existing theories and methodologies in the field of IT Security Management.

4) Critically investigate an organization’s IT Security Management policy.

5) Proposing countermeasures for security attacks.

6) Critically apply security detection techniques, auditing, testing, incident management, and recovery plan.

7) Effective Communication: Communicate effectively both, verbally and in writing, using a range of media widely used in relevant professional context. Be IT, digitally and information literate.