Network Security and Cryptography | Assignment title: Forest Academy Trust

Scenario
Established in 2013, Forest Academy Trust began supporting Primary Schools in North
Yorkshire and through their success they soon began supporting secondary schools as
well. The trust, known as a Multi-Academy Trust or MAT continues to grow and has just
taken on the management of a smaller trust in Norfolk, Holden Academy Trust. Holden
Academy Trust has two long established Secondary Academies, a Sixth Form College and
a specialist behavioural unit spread across a small town. All schools from the Holden
Academy Trust currently operate their own LAN. However, Forest Academy Trust staff are
expected to work across the MAT, although this will remain predominantly in their local
area. The CEO has therefore decided that she wants to run a unified system where users
can gain access to their user accounts and the network resources regardless of which
academy they are working at. She has been advised to use a VPN to make the
connection between sites.
All academies within the MAT run a LAN, with access to the Internet. Each LAN includes
servers with financial systems, student record data and human resources (employee)
data.
All students and staff will require secure access to the system. Staff connected to any
LAN also have access to network folders containing college policies, procedures,
committee minutes, etc. Staff use both wired and wireless devices, including laptops and
tablets to connect to the network. All schools within the trust host their own marketing
website and intranets. Schools from the Holden Trust are currently using Microsoft Office
Suite 2010 and Outlook on the web (formerly known as Outlook Web App or Outlook Web
Access) using an exchange server for all staff and student email accounts. However,
Forest MAT use Office 365 and Windows 10 and all schools will eventually need to
integrate these systems.
The staff have been requesting to have access to their network resources when working at
the alternative academy or at home, and concerns have been raised about there being too
many differences between how each site operates their IT systems. During the last two
years, Forest Academy Trust wants to build a culture of being one organisation. The CEO
wants to continue this culture by creating one network, but has no knowledge of how a
VPN operates, and is aware that the Headteachers are concerned about the security
implications; particularly due to the increase in reports of cyber security attacks.
Furthermore, the CEO is also concerned about fines she could receive if there were
security breaches.
The CEO has decided to initially join the two secondary schools in Norfolk together via a
VPN connection, as staff will regularly need to work between these two schools. Both
schools will migrate their email systems over to Office 365 and will later be upgraded to
running Windows 10. She has asked you to undertake a consultancy for her about using a
VPN connection and how this would work, she has also asked you to consult on security
matters. Specifically, she wants you to identify the key security challenges faced by the
partnership and recommend solutions.

Page 3 of 5

Network Security and Cryptography © NCC Education Limited 2019
Task 1 – Risk Assessment - 10 Marks
a) Analyse the scenario and identify what you consider to be the 5 most important
electronically held information assets for the partnership. Justify your decision. You will
need to make some reasonable assumptions here, since the scenario is brief.
This section of the report should be approximately TWO HUNDRED AND FIFTY (250)
words.
b) Create a table (see below) which lists the assets. For each asset identify the main
security threats that you think could affect its confidentiality (C), integrity (I) or
availability (A). Remember, threats can be accidents as well as malicious. There are
likely to be multiple threats for each asset and the same threats are likely for several
assets.
Asset Threat CIA? Likelihood Impact Risk
E.g. Student
personal data

Server failure A Low Medium Low
Employee theft C Low High Medium
c) Complete the columns of the table by assessing the likelihood of the threat being
successful and the impact that it would have on the company. In this scenario you
should consider Low/Medium and High definitions as follows:
Likelihood Impact

Low Less than once per year Inconvenience may affect operation

for a day or two

Medium Once per year to once

per week

Operation may be impacted for over
a week, loss of students.
High Several times a week College may not survive – lost
reputation and students
d) Now complete the Risk column by using the following Risk matrix.

Impact

Likelihood

Low Medium High
Low Very Low Low Medium
Medium Low Medium High
High Medium High Very High

Task 2 – Controlling the risks – Explanation - 45 Marks
Once you have identified the highest risks, you need to make recommendations of how to
control those risks, i.e. what security you will put in place.
a) Discuss each of the threats you have identified and explain what security you
recommend they use to reduce the risk. You should include the key benefits the use of
a VPN will have with regards to security and recommendations. To access the highest
grades, you should consider alternatives where they exist, and justify your choice.
Where you use a technical term, you should explain it.

Page 4 of 5

Network Security and Cryptography © NCC Education Limited 2019
b) Where you use encryption, explain why and the protocol(s) you recommend.
This section of the report should be approximately SEVEN HUNDRED AND FIFTY (750)
words.
Task 3 – Setting up the VPN - 30 Marks
a) You should explain the two site-to-site VPN connection options for using either the
Intranet or Extranet outlining the differences and benefits. You should make
recommendations regarding which option would be the best option for Forest Academy
Trust to implement with the schools from Holden Trust that are now joining the MAT
and justify your recommendation.
b) Draw a diagram, showing the components that will be needed to create the site-to-site
VPN connection between the two schools. Each client PC need not be shown, but all
other components should be included.
c) As part of the security features of using a VPN you should discuss the use of Firewalls
and the rules that should be used should be listed and explained in a table.
This section of the report should be approximately FOUR HUNDRED AND FIFTY (450)
words.

Task 4 – Maintaining Security – 5 Marks
a) Explain any actions you would recommend for ensuring security is taken seriously
across the partnership by all users and how you would monitor the effectiveness of the
Information Security Management System.
This section of the report should be approximately ONE HUNDRED AND FIFTY (150)
words.

Task 5 Reflective commentary – 10 Marks
You should use this section to reflect on what you learned from completing the
assignment.
a) Explain any problems you had and how you went about solving them.
b) Explain anything you would do differently if you were to start it again.
c) Explain if the CEO’s concerns are justified.
This section of the report should be approximately ONE HUNDRED AND FIFTY (150)
words.