Cite examples of cyber threats and of risks to information security, then summarise how cyber risk is best managed and which frameworks guide that work.
The idea
Cyber risk is the risk of loss from attacks on, or failures of, information systems. It is organised around three properties: confidentiality, integrity and availability. Typical threats include phishing and business email compromise, ransomware, malware, denial-of-service floods, insider misuse and supply chain compromise. Slow, well-resourced campaigns are called advanced persistent threats. Good management treats cyber risk as an enterprise risk owned by the board, not only an IT issue. It layers prevention (patching, least privilege, segmentation, encryption, multi-factor authentication) with detection, response and recovery, and assumes a breach will eventually happen. Insurance transfers some financial loss but does not reduce the likelihood of attack. Frameworks guiding the work include the NIST Cybersecurity Framework, ISO/IEC 27001 and COBIT. The NIST framework has the functions identify, protect, detect, respond and recover, with a govern function added in version 2.0. The exam favours layered, tested, board-owned answers over single technology fixes.
A practice question
In the confidentiality, integrity and availability model of information security, a distributed denial-of-service attack that floods a bank's online portal with traffic primarily threatens which property?
- Confidentiality, because the flood of requests discloses customer data to the attackerWhy not: Treats loss of access as if it were disclosure of data; a flood does not by itself expose information.
- Availability, because legitimate users and systems lose timely access to the service - correct
- Integrity, because the traffic changes stored account balances without authorisationWhy not: Confuses loss of service with unauthorised modification of data, which is an integrity failure.
- Authentication, because the portal can no longer verify who each user isWhy not: Mixes up an access-control mechanism with the CIA properties; the attack aims to exhaust capacity, not to defeat identity checks.
A denial-of-service attack exhausts bandwidth or processing capacity so authorised users cannot reach the service. That is an attack on availability. Confidentiality concerns disclosure and integrity concerns unauthorised change, neither of which a traffic flood is designed to achieve.
A harder one
Several finance staff receive an email that appears to come from the chief executive asking for an urgent wire to a new supplier. The sender domain differs from the real one by a single character, and no malicious attachment is included. Which cyber threat is this best classified as?
- Ransomware, because it demands that money be sent to an outside partyWhy not: Ransomware encrypts or locks systems and demands payment for release; nothing here is encrypted or locked.
- SQL injection, because the attacker has manipulated the bank's internal recordsWhy not: SQL injection abuses unsanitised database queries in a web application; this attack uses a spoofed email and no code.
- Distributed denial-of-service, because many employees are being targeted at onceWhy not: Counts the number of recipients rather than the method; a DDoS floods a service with traffic and does not request a payment.
- Business email compromise, a social engineering attack that exploits trust - correct
The attacker impersonates a trusted executive using a look-alike domain to induce a payment. That is business email compromise, a social engineering and phishing variant. Defences are procedural, such as call-back verification and dual approval, rather than purely technical.
The hardest tier
A bank discovers that an attacker, who first entered through a software update pushed by a trusted vendor, spent many months moving laterally and quietly copying data before being noticed. Which description fits best?
- A short, opportunistic malware outbreak from a mass spam campaign that spread because users clicked linksWhy not: Describes noisy, short-lived commodity malware; months of quiet lateral movement through a vendor channel is not opportunistic spam.
- An insider threat in which a disgruntled employee abused legitimate access to take the dataWhy not: The entry point was a vendor update, not an employee; this misattributes an external, persistent intrusion to an internal actor.
- An advanced persistent threat entering via supply chain compromise - correct
- A zero-day denial-of-service campaign designed to disrupt vendor-supplied services for the bankWhy not: Describes disruption of availability; here the actor was stealing data and deliberately avoiding detection.
Entry through a trusted third party is supply chain compromise; patient lateral movement and exfiltration over months is the signature of an advanced persistent threat. Commodity malware is noisy and short-lived, and an insider needs no vendor channel.
In the app: 6 practice questions on this outcome, spaced review that brings it back before you forget it.
Start free →