From bf7e409d950414f2c74b1992d394acb900ca623b Mon Sep 17 00:00:00 2001 From: Price Hiller Date: Sun, 27 Oct 2024 20:39:40 -0500 Subject: [PATCH] cs-3113: add group project audit checklist --- .../3-Audit-Checklist/Checklist.typ | 384 ++++++++++++++++++ .../3-Audit-Checklist/assets/globe-thick.svg | 22 + .../3-Audit-Checklist/assets/globe.svg | 241 +++++++++++ .../assets/shieldnet-logo-1.svg | 23 ++ .../assets/shieldnet-logo-2.svg | 23 ++ .../assets/shieldnet-logo-3.svg | 24 ++ .../assets/shieldnet-logo-4.svg | 23 ++ .../assets/shieldnet-logo-5.svg | 24 ++ .../assets/shieldnet-logo-6.svg | 21 + .../assets/shieldnet-logo-7.svg | 62 +++ .../assets/shieldnet-logo.svg | 23 ++ 11 files changed, 870 insertions(+) create mode 100644 Fall-2024/CS-3113/Group-Project/3-Audit-Checklist/Checklist.typ create mode 100644 Fall-2024/CS-3113/Group-Project/3-Audit-Checklist/assets/globe-thick.svg create mode 100644 Fall-2024/CS-3113/Group-Project/3-Audit-Checklist/assets/globe.svg create mode 100644 Fall-2024/CS-3113/Group-Project/3-Audit-Checklist/assets/shieldnet-logo-1.svg create mode 100644 Fall-2024/CS-3113/Group-Project/3-Audit-Checklist/assets/shieldnet-logo-2.svg create mode 100644 Fall-2024/CS-3113/Group-Project/3-Audit-Checklist/assets/shieldnet-logo-3.svg create mode 100644 Fall-2024/CS-3113/Group-Project/3-Audit-Checklist/assets/shieldnet-logo-4.svg create mode 100644 Fall-2024/CS-3113/Group-Project/3-Audit-Checklist/assets/shieldnet-logo-5.svg create mode 100644 Fall-2024/CS-3113/Group-Project/3-Audit-Checklist/assets/shieldnet-logo-6.svg create mode 100644 Fall-2024/CS-3113/Group-Project/3-Audit-Checklist/assets/shieldnet-logo-7.svg create mode 100644 Fall-2024/CS-3113/Group-Project/3-Audit-Checklist/assets/shieldnet-logo.svg diff --git a/Fall-2024/CS-3113/Group-Project/3-Audit-Checklist/Checklist.typ b/Fall-2024/CS-3113/Group-Project/3-Audit-Checklist/Checklist.typ new file mode 100644 index 0000000..4dfaff8 --- /dev/null +++ b/Fall-2024/CS-3113/Group-Project/3-Audit-Checklist/Checklist.typ @@ -0,0 +1,384 @@ +#let gold = rgb("#ffc500") +#set text(font: "Calibri") +#let gradient_fill = ( + color.hsl(230deg, 60%, 20%), + color.hsl(225deg, 60%, 15%), + color.hsl(220deg, 60%, 15%), + color.hsl(220deg, 60%, 15%), + color.hsl(220deg, 60%, 15%), + color.hsl(220deg, 60%, 15%), + color.hsl(210deg, 60%, 15%), + color.hsl(210deg, 80%, 20%), +) + +#let shieldnet_font = "IBM Plex Sans" +#set page( + margin: (x: 2cm, top: 3cm, bottom: 1cm), + header: context if here().page() > 1 { + align( + center + horizon, + box( + width: page.width, + height: 100%, + fill: gradient.linear(..gradient_fill), + [ + #place(left + horizon, dx: +page.margin.left)[ + #text( + size: 1.1em, + fill: gold, + font: shieldnet_font, + weight: "black", + )[SHIELDNET CYBERSECURITY], + #text(size: 1.1em, fill: white)[Cybersecurity Audit Checklist], + ] + #let icon_size = 45% + #place( + right + horizon, + dx: -page.margin.right, + box( + baseline: icon_size, + image( + "./assets/shieldnet-logo-7.svg", + height: icon_size, + fit: "contain", + ), + ), + ) + ], + ), + ) + }, + footer: context if here().page() > 1 { + text( + size: 0.8em, + fill: color.luma(35%), + [ + ShieldNet Cybersecurity + #h(1fr) + #{ + here().page() - 1 + } + #align( + center + bottom, + block( + width: page.width, + height: 30%, + fill: gradient.linear(..gradient_fill), + ), + ) + ], + ) + }, +) + +// COVER PAGE + +#set page(background: context if here().page() == 1 { + box( + fill: gradient.linear(angle: 60deg, ..gradient_fill), + width: 100%, + height: 100%, + ) + + place( + top + center, + rect( + width: 100%, + height: 100%, + fill: pattern( + size: (18pt, 18pt), + place( + dy: 3pt, + dx: 1pt, + circle( + radius: 3.5pt, + fill: blue.darken(65%), + ), + ), + ), + ), + ) + + let globe = read("./assets/globe-thick.svg").replace( + "#000000", + blue.darken(40%).to-hex(), + ) + place( + bottom + right, + dy: 70pt, + dx: 120pt, + rotate(-20deg, image.decode(globe, height: 600pt)), + ) + + + let darken_amount = 30% + place( + top + right, + stack( + dir: btt, + ..{ + let rect_height = 30pt + ( + rect( + width: 50pt, + height: rect_height, + fill: red.darken(darken_amount), + ), + rect( + width: 75pt, + height: rect_height, + fill: gold.darken(darken_amount), + ), + rect( + width: 100pt, + height: rect_height, + fill: blue.darken(darken_amount), + ), + ) + }, + ), + ) + + place( + horizon + left, + rect( + fill: blue.darken(darken_amount), + height: 100%, + width: 8pt, + ), + ) + +}) + +#context { + let icon_size = 36pt + place( + left + top, + align( + horizon, + grid( + columns: 2, + column-gutter: 5pt, + image( + "./assets/shieldnet-logo-7.svg", + height: icon_size, + fit: "contain", + ), + text( + size: 1.6em, + font: shieldnet_font, + fill: gold, + weight: "black", + )[SHIELDNET\ CYBERSECURITY], + ), + ), + ) + place( + center + horizon, + box( + width: page.width, + text( + font: "Roboto", + size: 5em, + fill: blue.lighten(75%), + weight: "black", + )[Cybersecurity Audit Checklist], + ), + ) + + place( + left + bottom, + dy: +2%, + text( + size: .75em, + fill: white, + style: "italic", + )[ShieldNet Cybersecurity _|_ Prepared for NARO, Inc.], + ) +} +#pagebreak() + + +// Actual Content +#let sec(title, subtitle, ..checklist_items) = { + let inset = (x: 8pt, y: 5pt) + [ + #block( + inset: inset, + radius: 100%, + fill: gold, + text( + font: "Roboto", + fill: black, + size: 1.3em, + tracking: .1pt, + weight: "black", + )[= #title], + ) + #v(-.75em) + #block( + inset: (right: 6pt, bottom: 6pt), + stroke: (right: .6pt, bottom: .6pt), + radius: 5pt, + )[ + #box( + width: 100%, + inset: inset, + radius: 100%, + fill: rgb("#00265E"), + text(fill: white, weight: "bold", size: 1.2em)[#subtitle], + ) + #align( + center, + text( + size: 1.1em, + table( + columns: (5%, 90%), + stroke: (_, y) => if y > 0 { + (top: 0.6pt) + }, + align: left, + ..checklist_items + ), + ), + ) + ] + ] +} + + +#sec( + "IDENTIFY", + "RISK AWARENESS, MANAGING ASSETS, RISK MANAGEMENT STRATEGY", + [☐], + [Do you maintain an updated inventory of IT assets?], + [☐], + [Are guests properly identified when visiting a business location?], + [☐], + [Do you conduct background checks for new staff and external contractors?], + [☐], + [Do you require individual accounts for each employee?], + [☐], + [Are employees familiar with company policies on information security?], + + [☐], + [Have you evaluated which users require access to an administrator account on their computer?], + + [☐], + [Do you utilize session locks when a user is away from their computer?], + [☐], + [Do you use a badge-in system to restrict access to the physical business and other business locations?], +) +\ + +#sec( + "PROTECT", + "TRAINING, ACCESS CONTROL, DATA SECURITY", + [☐], + [Do you conduct cybersecurity awareness training for employees?], + [☐], + [Do you regularly patch/update operating systems and software?], + + [☐], + [Do you require two factor or multi factor authentication (2FA/MFA) for all logins?], + + [☐], + [Do you employ full disk encryption on your systems?], + [☐], + [When you dispose of a system, do you ensure the data is securely wiped?], + + [☐], + [Do you use a virtual private network (VPN) for out of office connections?], + + [☐], + [Do you have firewalls in place to secure business networks?], + + [☐], + [Do you change the default password for WiFI and/or other networks?], + [☐], + [Do you utilize anti-virus/anti-malware on your systems?], + [☐], + [Do you enforce a minimum password complexity?], +) +\ + +#sec( + "DETECT", + "MONITORING, THREAT ANALYSIS, VERIFICATION", + [☐], + [Do you employ an Intrusion Detection System (IDS)?], + [☐], + [Are all personal devices used for work protected with security software and encryption?], + + [☐], + [Are you running regular vulnerability scans? (E.g. using Nessus)], + [], + [How often do you audit existing user accounts? (Never, Daily, Weekly, Monthly, Annually, Other) \ #box(fill: luma(220), height: 2em, width: 100%)[]], + + [☐], + [Do you collect any logs?], + [☐], + [If you do collect logs, do you monitor them?], + [], + [If you do collect logs, how long do you retain them?\ #box(fill: luma(220), height: 2em, width: 100%)[]], + + [☐], + [Are physical devices and sensitive physical areas monitored?], + [☐], + [Do you conduct any audits for unusual employee behaviors? (e.g. checking for employees regularly logging in outside of business hours)], +) +\ + +#sec( + "RESPOND", + "RESPONSE PLANNING, DISASTER MITIGATION, COMMUNICATION", + [☐], + [Do you have dedicated cyber security staff?], + + [☐], + [Do you have a internal process for raising concerns about potential cyber incidents?], + + [☐], + [Are you able to quickly lock down physical locations during a crisis?], + + [☐], + [Have you determined when it may be necessary to include law enforcement in your disaster response?], + + [☐], + [Are you able to alert users if you suspect their information may have been stolen?], + + [☐], + [Are you prepared to respond to an environmental crisis that may impact your ability to continue normal business operations?], + + [☐], + [Are you able to quickly quarantine any computer that is identified as compromised?], + + [☐], + [Are employees aware of their responsibilities in the event of a security incident?], +) +\ + +#sec( + "RECOVER", + "RECOVERY PLANS, CONTINUOUS IMPROVEMENTS", + [☐], + [Do you create full backups?], + [☐], + [If you do create backups, do you encrypt them?], + [], + [If you do create backups, how often do you test restoring from them? (Never, Daily, Weekly, Monthly, Annually, Other)\ #box(fill: luma(220), height: 2em, width: 100%)[]], + + [☐], + [If you do create backups, do you keep at least 3 copies, on at least 2 different media types (e.g. a hard drive and a tape drive), and have at least 1 copy stored offsite (outside of your business)?], + + [☐], + [Do you have a formal method or process for improving cybersecurity regularly?], + + [☐], + [In the event of hardware failure, do you have a way to restore function? E.g. router failure.], + + [☐], + [Are you currently enrolled in a Cyber Insurance program?], + [☐], + [Do you know how long it would take to carry out your recovery plan after an incident?], +) diff --git a/Fall-2024/CS-3113/Group-Project/3-Audit-Checklist/assets/globe-thick.svg b/Fall-2024/CS-3113/Group-Project/3-Audit-Checklist/assets/globe-thick.svg new file mode 100644 index 0000000..7868221 --- /dev/null +++ b/Fall-2024/CS-3113/Group-Project/3-Audit-Checklist/assets/globe-thick.svg @@ -0,0 +1,22 @@ + + + + +Created by potrace 1.15, written by Peter Selinger 2001-2017 + + + diff --git a/Fall-2024/CS-3113/Group-Project/3-Audit-Checklist/assets/globe.svg b/Fall-2024/CS-3113/Group-Project/3-Audit-Checklist/assets/globe.svg new file mode 100644 index 0000000..20d6819 --- /dev/null +++ b/Fall-2024/CS-3113/Group-Project/3-Audit-Checklist/assets/globe.svg @@ -0,0 +1,241 @@ + + + + +Created by potrace 1.15, written by Peter Selinger 2001-2017 + + + + + diff --git a/Fall-2024/CS-3113/Group-Project/3-Audit-Checklist/assets/shieldnet-logo-1.svg b/Fall-2024/CS-3113/Group-Project/3-Audit-Checklist/assets/shieldnet-logo-1.svg new file mode 100644 index 0000000..fb582d3 --- /dev/null +++ b/Fall-2024/CS-3113/Group-Project/3-Audit-Checklist/assets/shieldnet-logo-1.svg @@ -0,0 +1,23 @@ + + + + + + + + + \ No newline at end of file diff --git a/Fall-2024/CS-3113/Group-Project/3-Audit-Checklist/assets/shieldnet-logo-2.svg b/Fall-2024/CS-3113/Group-Project/3-Audit-Checklist/assets/shieldnet-logo-2.svg new file mode 100644 index 0000000..76a5f89 --- /dev/null +++ b/Fall-2024/CS-3113/Group-Project/3-Audit-Checklist/assets/shieldnet-logo-2.svg @@ -0,0 +1,23 @@ + + + + + + + + + \ No newline at end of file diff --git a/Fall-2024/CS-3113/Group-Project/3-Audit-Checklist/assets/shieldnet-logo-3.svg b/Fall-2024/CS-3113/Group-Project/3-Audit-Checklist/assets/shieldnet-logo-3.svg new file mode 100644 index 0000000..a88d9df --- /dev/null +++ b/Fall-2024/CS-3113/Group-Project/3-Audit-Checklist/assets/shieldnet-logo-3.svg @@ -0,0 +1,24 @@ + + + + + + + + + \ No newline at end of file diff --git a/Fall-2024/CS-3113/Group-Project/3-Audit-Checklist/assets/shieldnet-logo-4.svg b/Fall-2024/CS-3113/Group-Project/3-Audit-Checklist/assets/shieldnet-logo-4.svg new file mode 100644 index 0000000..51fd923 --- /dev/null +++ b/Fall-2024/CS-3113/Group-Project/3-Audit-Checklist/assets/shieldnet-logo-4.svg @@ -0,0 +1,23 @@ + + + + + + + + + \ No newline at end of file diff --git a/Fall-2024/CS-3113/Group-Project/3-Audit-Checklist/assets/shieldnet-logo-5.svg b/Fall-2024/CS-3113/Group-Project/3-Audit-Checklist/assets/shieldnet-logo-5.svg new file mode 100644 index 0000000..b59ce8e --- /dev/null +++ b/Fall-2024/CS-3113/Group-Project/3-Audit-Checklist/assets/shieldnet-logo-5.svg @@ -0,0 +1,24 @@ + + + + + + + + + \ No newline at end of file diff --git a/Fall-2024/CS-3113/Group-Project/3-Audit-Checklist/assets/shieldnet-logo-6.svg b/Fall-2024/CS-3113/Group-Project/3-Audit-Checklist/assets/shieldnet-logo-6.svg new file mode 100644 index 0000000..97c9873 --- /dev/null +++ b/Fall-2024/CS-3113/Group-Project/3-Audit-Checklist/assets/shieldnet-logo-6.svg @@ -0,0 +1,21 @@ + + + + + + + + + \ No newline at end of file diff --git a/Fall-2024/CS-3113/Group-Project/3-Audit-Checklist/assets/shieldnet-logo-7.svg b/Fall-2024/CS-3113/Group-Project/3-Audit-Checklist/assets/shieldnet-logo-7.svg new file mode 100644 index 0000000..e8f0f69 --- /dev/null +++ b/Fall-2024/CS-3113/Group-Project/3-Audit-Checklist/assets/shieldnet-logo-7.svg @@ -0,0 +1,62 @@ + + + + + + + + + + diff --git a/Fall-2024/CS-3113/Group-Project/3-Audit-Checklist/assets/shieldnet-logo.svg b/Fall-2024/CS-3113/Group-Project/3-Audit-Checklist/assets/shieldnet-logo.svg new file mode 100644 index 0000000..40a545c --- /dev/null +++ b/Fall-2024/CS-3113/Group-Project/3-Audit-Checklist/assets/shieldnet-logo.svg @@ -0,0 +1,23 @@ + + + + + + + + +