Cyber security threats

(a) Blagging (pretexting) — a form of social engineering, using an invented scenario (1) (b) Weak and default passwords — the manufacturer's default was never changed (1) (c) Removable media (1) (d) Misconfigured access rights (1) (e) Pharming — the website's traffic has been redirected to a fake website (1)

(5)

(a) Social engineering is the art of manipulating people so they give up confidential information (1).

(b)

• Blagging (pretexting) — the act of creating and using an invented scenario to engage a targeted victim in a way that increases the chance they will divulge information or perform actions that would be unlikely in ordinary circumstances (1)
• Phishing — a technique of fraudulently obtaining private information, often using email or SMS, typically by directing the victim to a fake website (1)
• Shouldering (shoulder surfing) — observing a person's private information over their shoulder, for example a cashpoint machine PIN (1)

(c) Any one of: staff training and awareness so employees recognise the tactics (1); a policy that IT will never ask for a password, removing the credibility of the most common blagging story; verifying identity independently by calling the organisation back on a number looked up separately (1).

(6 max)

(a) Malware is an umbrella term used to refer to a variety of forms of hostile or intrusive software (1).

(b)

• Computer virus — attaches itself to a file or program and replicates, spreading when the infected file is opened, copied or shared, and can damage or delete data (1)
• Trojan — appears to be legitimate and useful software, so the user is deceived into installing it, but it performs harmful actions once run. Unlike a virus it does not replicate itself (1)
• Spyware — runs secretly, without the user's knowledge, and gathers information about them — such as keystrokes, which can capture passwords as they are typed — sending it to the attacker (1)

(c) Any two of:

• Antivirus / anti-malware software kept up to date, since out-of-date definitions cannot detect malware discovered since the last update (1)
• Automatic software updates, which close the vulnerabilities malware exploits to get in (1)
• Do not open unexpected attachments or click unknown links; only install software from trusted sources, which is the direct defence against a trojan; scan removable media before use; use a firewall; keep backups so recovery is possible (1)

(6 max)

(a) Pharming (1) — a cyber attack intended to redirect a website's traffic to a fake website, where the victim's login details are captured (1).

(b) Two differences from phishing:

• In phishing the victim must click a link in a fraudulent message (often email or SMS). In pharming the victim clicks nothing — they typed the correct address themselves (1)
• In phishing the address bar usually shows a wrong or suspicious address, whereas in pharming it may show the correct address, which is precisely what makes pharming so hard to detect (1)

(Also acceptable: phishing needs a message sent to each victim, whereas pharming redirects everyone whose address lookup has been altered.)

(c) Two protections:

• Check for HTTPS and a valid certificate before entering details — a fake site normally cannot present a valid certificate for the genuine bank's domain (1)
• Run up-to-date anti-malware and change the router's default password, since malware on the machine and a reconfigured home router are the two usual ways an attacker sets up the redirection (1)

(Also acceptable: two-factor authentication, so the captured password alone is not enough.)

(a) Weak and default passwords. Lists of manufacturers' default passwords are published openly, so an attacker who identifies the model of a router or camera can simply look the password up — no cracking is needed at all. Weak passwords are guessed or found by automated attack (1). Reduce it: change every default password as soon as a device is installed, enforce a minimum length, and limit login attempts so automated guessing fails (1).

(b) Misconfigured access rights. A user is given more access than their role requires — for example a leaver's account left active, or a part-time helper with administrator rights (1). This multiplies the damage of every other attack: if an attacker phishes an over-privileged account they gain the whole system, where a correctly configured account would have contained the damage (1). Reduce it: grant each user only the minimum access their role needs and review rights regularly, removing access when roles change (1).

(c) Removable media. A USB drive can carry malware onto the network, bypassing the firewall entirely because it never travels over the network, and can carry large amounts of confidential data out. Small drives are also very easily lost (1). Reduce it: disable or restrict USB ports, scan all media automatically before use, and encrypt any data permitted onto removable media (1).

(d) Unpatched and/or outdated software. The vulnerabilities are known and often published, and attackers actively scan the Internet for machines that have not been patched — while software no longer supported receives no patches at all (1). Reduce it: enable automatic software updates and replace software that is out of support (1).

(8)

(a) Penetration testing is the process of attempting to gain access to resources without knowledge of usernames, passwords and other normal means of access (1). It is carried out with the owner's permission, which is what distinguishes a penetration tester from an attacker (1).

(b) Two reasons:

• To find vulnerabilities before a real attacker does, so they can be fixed while there is still time (1)
• To test whether existing measures actually work as configured — a firewall with mistaken rules gives no protection, and only testing reveals that (1)

(Also acceptable: to assess how much damage a breach would cause; to test staff against social engineering; to provide evidence to customers or regulators; to prioritise security spending.)

(c) Type 1 — simulating a malicious insider. The tester has knowledge of the system and possibly basic credentials, simulating an attack from inside (1). It reveals misconfigured access rights — whether an ordinary user account can reach data it should not, and whether it can be escalated to administrator (1).

Type 2 — simulating an external attack. The tester has no knowledge of any credentials, starting exactly as a real outsider would (1). It reveals whether an outsider can get in at all, exposing unpatched software, default passwords still in place and weaknesses in the network boundary (1).

(8)

The named threats

1. Phishing — a social engineering technique that fraudulently obtains private information, often using email or SMS, here by linking to a fake login page (1)
2. Misconfigured access rights — the account held more access than the role required, and the rights were never withdrawn after the one-off task (1)
3. Spyware — a form of malware that secretly gathers information about the user, here by recording keystrokes and so capturing further passwords (1)
4. Unpatched and/or outdated software — the server carried known vulnerabilities that a patch had been available to fix for months (1)

How the stages combined

• Phishing alone would have been survivable. It gave the attacker one account — but because that account had administrator rights, a single stolen password became control of the whole system rather than access to one user's files (1)
• Those excessive rights are also what allowed the spyware to be installed. An ordinary user account would not normally have permission to install software, so the misconfiguration enabled stage 3 directly (1)
• The spyware then made the breach self-sustaining. By capturing everything staff typed it harvested further credentials, so disabling the original account would not have ended the attacker's access (1)
• The unpatched server removed the last obstacle. The vulnerability was known and a patch existed, so this was a failure of process rather than of technology — and it meant the attacker did not even need stolen credentials to reach the server (1)

(8)

What the manager gets right. A firewall, encryption and antivirus are all genuine and necessary measures — they protect against hostile network traffic, interception of data, and malware respectively (1).

Why the statement is nonetheless wrong. All three are technologies, and social engineering is the art of manipulating people so they give up confidential information — it attacks the person, not the system (1).

• A firewall monitors traffic against rules. A member of staff who visits a fake login page and types their password is generating ordinary, permitted web traffic, so there is nothing for the firewall to identify as suspicious (1)
• Encryption protects data from being read if intercepted — but the user has voluntarily handed the password over, so there was never anything to intercept (1)
• Antivirus scans for malicious software. Blagging is a phone call and shouldering is someone watching over a shoulder: no software is involved at all, so there is nothing to detect (1)

What the school should do.

• Staff and student training and awareness — the specification's own answer, and the only measure that addresses the actual attack. People who recognise the tactics — urgency, a plausible story, a request for a password — refuse them (1)
• Specific processes: a stated policy that IT will never ask for a password, which removes the credibility of the commonest blagging story, and a rule that identity is verified by calling the organisation back on a number looked up independently (1)
• A technical backstop: two-factor authentication, so that even a successfully phished password is not sufficient on its own; plus shielding keypads and awareness of surroundings to defeat shouldering (1)

(8)

The board is right to be reassured, up to a point. A penetration test in which the tester had no knowledge of any credentials and still could not get in shows that the network boundary held against a realistic external attack (1).

But that test answers only one question — whether an outsider can get in.

• It says nothing about a malicious insider. Hospital staff already have credentials, and an external test cannot reveal what a disgruntled employee could reach once logged in legitimately (1)
• It says nothing about a stolen ordinary account. If a single nurse's password were phished, the important question becomes how far that one account can reach — and the external test did not examine this at all (1)
• Misconfigured access rights are invisible from outside. Rights granted for a one-off task years ago, shared folders opened during a crisis, and leavers' accounts left active are exactly the weaknesses the internal test exists to find (1)
• The result is a snapshot, not a permanent state. New software is installed, staff change roles, and new vulnerabilities are discovered constantly — so a clean test today does not remain true (1)

Recommendation.

• Commission the second type of penetration test: the tester is given knowledge of the system and basic credentials, simulating an attack from inside the system (a malicious insider) (1). This is the test that reveals whether an ordinary account can reach patient records it has no business seeing, and whether it can be escalated to administrator (1)
• Repeat both types regularly, and after any significant change. For a hospital the stakes are unusually high: patient records are highly confidential and a breach could also affect availability of systems that clinical care depends on, so testing must be an ongoing process rather than a single event (1)

(8)