Unit of competency details
ICTCYS407 - Gather, analyse and interpret threat data (Release 1)
Summary
Usage recommendation:
Current
Releases:
| 1 1 (this release) |
21/Jul/2020 |
Companion volumes:
Unit of competency
Assessment requirements
Training packages that include this unit
Qualifications that include this unit
Skill sets that include this unit
Classifications
Classification history
| ASCED Module/Unit of Competency Field of Education Identifier | 029901 | Security Science | 18/Sep/2020 | |
The content being displayed has been produced by a third party, while all attempts have been made to make this content as accessible as possible it cannot be guaranteed. If you are encountering issues following the content on this page please consider downloading the content in its original form
Unit of competency
Modification History
|
Release
|
Comments
|
|
Release 1
|
This version first released with ICT Information and Communications Technology Training Package Version 6.0.
|
Application
This unit describes the skills and knowledge required to gather data from various sources, analyse, and interpret information for threats, inconsistencies and discrepancies.
It applies to individuals who work in information technology security, including network and security specialists, and gather logs from devices, check abnormalities and respond accordingly. These individuals are responsible for supporting and preventing cyber threats attacking data in all business functions and in any industry context.
No licensing, legislative or certification requirements apply to this unit at the time of publication.
Unit Sector
Cyber security
Elements and Performance Criteria
|
ELEMENT
|
PERFORMANCE CRITERIA
|
|
Elements describe the essential outcomes.
|
Performance criteria describe the performance needed to demonstrate achievement of the element.
|
|
1. Gather threat data
|
1.1 Identify legislative requirements and organisational policies and procedures to gather, analyse and interpret threat data
1.2 Identify security equipment on network and data sources
1.3 Discuss and confirm data log requirements and strategy to process data with required personnel
1.4 Collect information from alerts, logs and reported events and create a dataset according to organisational policies and procedures
|
|
2. Analyse threat data
|
2.1 Ingest data logs into analytic platform according to user instructions
2.2 Obtain and analyse results for reliability and consistency
2.3 Check for false positives and false negative results
2.4 Detect and describe discrepancies and inconsistencies in data
|
|
3. Interpret and finalise threat data
|
3.1 Discuss and review threat data and results with required personnel
3.2 Discuss and assess identified threats, risks and their likelihood of occurrence and impacts of risks,
3.3 Suggest and confirm lessons learnt, action steps, recommendations and mitigation strategies with required personnel
3.4 Document results, findings and recommendations into report according to organisational procedures
3.5 Distribute documentation to required personnel and store according to organisational policies and procedures
|
Foundation Skills
This section describes those language, literacy, numeracy and employment skills that are essential to performance but not explicit in the performance criteria.
|
SKILL
|
DESCRIPTION
|
|
Learning
|
- Identifies and gathers information applicable to organisational procedures and threat data
|
|
Numeracy
|
- Uses tools when measuring and recording data, and interprets results through mathematical data
|
|
Reading
|
- Interprets information from different sources in a range of formats when identifying threat data
|
|
Writing
|
- Prepares complex workplace documentation detailing research findings and recommendations using required structure, layout and technical language
|
|
Planning and organising
|
- Uses problem solving skills when interpreting the nature and impact of threat data
|
|
Technology
|
- Uses required technological tools and software in gathering, analysing and interpreting threat data
|
Unit Mapping Information
No equivalent unit. New unit.
Links
Companion Volume Implementation Guide is found on VETNet - https://vetnet.gov.au/Pages/TrainingDocs.aspx?q=a53af4e4-b400-484e-b778-71c9e9d6aff2
Assessment requirements
Modification History
|
Release
|
Comments
|
|
Release 1
|
This version first released with ICT Information and Communications Technology Training Package Version 6.0.
|
Performance Evidence
The candidate must demonstrate the ability to complete the tasks outlined in the elements, performance criteria and foundation skills of this unit, including evidence of the ability to:
- gather, log and create dataset from a single security device or whole organisation device, including:
- basic router info
- firewall info
- systems
- identify and describe at least three different inconsistencies or discrepancies within data
- document finding, recommendations and outcomes.
In the course of the above, the candidate must:
- interpret meaning from dataset and suggest action items.
Knowledge Evidence
The candidate must be able to demonstrate knowledge to complete the tasks outlined in the elements, performance criteria and foundation skills of this unit, including knowledge of:
- data recognition software tools
- data sources, including:
- firewalls
- intrusion detection systems (IDS)
- access control systems
- security and event management systems (SIEM)
- basic troubleshooting processes related to cyber security threats
- network and cyber security features and principals
- types of attacks, including:
- denial-of-service attack (DDOS)
- SQL injection (SQLi)
- cross-site scripting (XSS) attacks
- scripted attacks
- hardware attacks
- attacks against Wi Fi
- legislative requirements applicable to gathering, analysing and interpreting threat data
- common cyber security threats and their impacts on business functions
- organisational policies and procedures applicable to gathering, analysing and interpreting threat data, including:
- documentation established requirements, findings and recommendations
- establishing security equipment and data sources
- information collection processes
- processes in obtaining and analysing results.
Assessment Conditions
Skills in this unit must be demonstrated in a workplace or simulated environment where the conditions are typical of those in a working environment in this industry.
This includes access to:
- required hardware, software and digital devices
- required analytic platform and applicable user instructions
- data recognition software
- single security device and whole organisation device
- legislative requirements and organisational policies and procedures applicable to gathering, analysing and interpreting threat data.
Assessors of this unit must satisfy the requirements for assessors in applicable vocational education and training legislation, frameworks and/or standards.
Links
Companion Volume Implementation Guide is found on VETNet - https://vetnet.gov.au/Pages/TrainingDocs.aspx?q=a53af4e4-b400-484e-b778-71c9e9d6aff2
