Overview
Group Project Instructions:
Group Project Deliverable #3 - 150 points due by Sunday 11:59 pm group-1.svg
The following scenario was adopted from a CISA (2023) tabletop event. It requires each group to research and identify the actions needed to respond to an incident as well as develop recommendations for how to respond during an incident's aftermath. This project is comprehensive and requires demonstrating the group's understanding of many of the topics covered this term.
Scenario:
On the morning of the outbreak, an employee of Chemicoryx connects his / her laptop to a wireless network hotspot at a local coffee shop. The employee frequently connects to this hotspot to check his / her personal email and social media accounts prior to work.
The malware (from an infected host connected to the wireless network) scans the local coffee shop subnet for vulnerable systems, propagating itself onto the employee’s laptop in a matter of seconds.
Later that morning, the employee briefly connects the laptop to the LAN at Chemicoryx to download data for work-related purposes.
Within minutes, several systems are infected on Chemicoryx's network. The laptop is disconnected and unused for the remainder of the day, but the malware is already attempting to spread to other local subnets. Eventually, the primary control network is scanned, and vulnerable systems are exploited.
At some point, infected systems begin to propagate the malware outside of Chemicoryx by scanning thousands of random IP addresses across the Internet, increasing overall network traffic severalfold. As a result of these activities, network system performance degrades significantly in the control system environment.
The mid-shift operator notices some apparent system slowness in reporting system health, device status, etc. The operator logs onto the system and begins performing manual checks. During this process, the operator notices that the screen flickers several times, but there is no other evidence of a problem. He continues to perform manual checks of the devices and equipment, confirming that everything seems to be running normally.
A technician at the internet service provider (ISP) for Chemicoryx is aware of outbreaks of this particular malware and begins to check traffic logs for possible signs of contamination. ISP sends out an email alert to customers that appear to be infected before complaints are generated by other network providers. Chemicoryx received one of those emails but it does not get routed to the appropriate cybersecurity personnel until mid-afternoon.
A worker, who is verifying that all valves are in the “off” position, notices Valve #1 is “open”. According to company protocols, he reports the incident.
Half (50%) of the failsafe systems are triggered and begin to shut down various processes. These shutdowns are accompanied by several effluent and/or gas releases that mandate reporting to the Environmental Protection Agency (EPA), state environmental officials, and local first responders. A hazardous materials emergency is declared, and the local media outlets begin to call asking for a statement.
Once the attack is realized, control system administrators need to contain and recover the environment at Chemicoryx. They determine that the outbreak is isolated to the control networks. During the process, control data is lost, aspects of the Supervisory Control and Data Acquisition (SCADA) operation are forced to manual overrides, and there is general loss of functionality in key services across the entire facility.
[7:25 PM, 8/3/2026] sumaja@room VA: For this Project:
Members of your team will create a video presentation using PowerPoint slides. The presentation and the group's slides should correctly address the following questions:
What are Chemicoryx's information sharing responsibilities during their response to the incident?
What resources should be used to disseminate information?
Discuss the notification capabilities that Chemicoryx should use to share information and communicate protective measures implementation. Identify who the organization should contact internally or externally about the incident. What internal and external messages should be developed? How are the messages distributed?
Describe the technological barriers, legal considerations, or institutional sensitivities that might af…
[7:27 PM, 8/3/2026] sumaja@room VA: Submission requirements:
Design a PowerPoint presentation and video recording that communicates your team's response to the questions presented for this Group Project Deliverable #3.
Your presentation should include the appropriate APA in-text citations and references.
This presentation will be your group’s chance to demonstrate your knowledge to a stakeholder audience and also for your real-world instructor.
Be creative and imaginative on this presentation.
[7:28 PM, 8/3/2026] sumaja@room VA: My point is:
What protective security measures will be employed at your organization following these cyber-attacks?
Needed in:
2 slides and 3 references