External Threats Exam Questions

Award one mark for each correct way, up to a maximum of two marks from:

• Guessing a password/trying many combinations (brute force)
• Using a weak or default password
• Using stolen login details
• Finding login details that have been written down
• Exploiting a weakness in software that has not been updated
• Accessing an account that has been left logged in
• Connecting through an insecure remote connection

Do not accept: other external threats, such as phishing or shoulder surfing.

Accept any other appropriate response.

Award one mark for each correct detail, up to a maximum of two marks from:

• Username
• Password
• PIN
• Bank/card details
• Security code/one-time passcode
• Personal details (for example name, address, date of birth)
• Answers to security questions
• Account number

Do not accept: clicking a link/opening an attachment, as the question asks for details a phishing message might ask staff to provide

Accept any other appropriate response.

Award one mark for each correct sign, up to a maximum of two marks from:

• The sender's address is unusual/does not match the organisation it claims to be from
• Urgent or threatening language (for example the account will be closed/payment needed immediately)
• It asks for personal details/passwords/bank details
• A general greeting such as 'Dear customer'/'Dear user'
• A link that does not lead to the real website/an unusual web address
• An unexpected attachment
• Images or logos that do not look genuine/poor-quality logos

Do not accept: spelling mistakes – this is the example given

Accept any other appropriate response.

Award one mark for a correct way and one mark for an expansion of that way, up to a maximum of two marks.

• By changing the website's DNS records/DNS spoofing (1) so visitors to the website are redirected to a fake website (1)
• By infecting a visitor's device with malware (1) which sends them to the attacker's website when they type in the address (1)
• By setting up a fake website that copies the planetarium's (1) so customers enter their card details/passwords on the attacker's site (1)
• By taking over/hijacking the planetarium's domain name (1) so customers who type the correct address still reach the fraudulent site (1)

Do not accept: phishing on its own, as this needs the user to click a link in a message.

Allow mix and match if it makes sense

Accept any other appropriate wording/phrasing

Award one mark for a correct way and one mark for a justification of that way, up to a maximum of two marks.

• Users are redirected to a fake website (1) where they enter their login details, which the attacker can then use to access the school's systems (1)
• The fake website looks the same as the real one (1) so staff/customers do not realise and enter personal details into it (1)
• The school's web address/DNS has been changed/spoofed (1) so visitors are taken to a site controlled by the attacker (1)
• The attacker captures learners' personal details (1) as the fake site asks them to fill in a booking form (1)
• The attacker gets staff usernames and passwords (1) so they can log in and change/steal the school's booking data (1)
• Payment/card details are entered on the fake site (1) so this data is stolen/used fraudulently (1)

Do not accept: clicking a link in an email or text to reach a fake website, as this is phishing rather than pharming.

Allow mix and match if it makes sense

Accept any other appropriate wording/phrasing

Award one mark for a correct effect, one mark for a justification for that effect, and one mark for an expansion of the justification, up to a maximum of three marks.

• The website could become unavailable (1) because the server is overwhelmed with requests (1) so customers cannot book their tickets (1)
• The booking system could slow down (1) as the server is busy dealing with fake traffic (1) so genuine customers give up and book elsewhere (1)
• The cinema could lose sales (1) because customers cannot get onto the website (1) which means less income for the cinema (1)
• The cinema's reputation could be damaged (1) as customers cannot use the website (1) so they book with a rival cinema instead (1)

Do not allow mix and match

Do not accept: 'slow' on its own, with no effect on the cinema

Accept any other appropriate wording/phrasing

Award one mark for a correct way, one mark for a justification for that way, and one mark for an expansion of the justification, up to a maximum of three marks.

• Phone a member of staff pretending to be from IT support (1) because staff trust the IT team (1) and give their password when asked to fix a login problem (1)
• Send an email pretending to be the studio manager (1) asking for login details to open a shared file (1) so the staff member replies with their username and password (1)
• Pretend to be a supplier/contractor (1) because the staff member believes they are working with someone known to the company (1) and gives them access details for the booking system (1)
• Ask staff to complete a fake survey/competition (1) which looks official (1) so they enter their login details without checking who sent it (1)

Do not allow mix and match

Do not accept: installing malware/keylogging software or shoulder surfing on its own, as these do not involve deceiving a member of staff

Accept any other appropriate wording/phrasing

Award one mark for a correct way, one mark for a justification for that way, and one mark for an expansion of the justification, up to a maximum of three marks.

• Pretend to be from IT support/a manager/a supplier (1) and ask a member of staff for their username and password (1) so they can log in as that member of staff (1)
• Phone the museum pretending to be a known contact/supplier (1) to take advantage of the trust the staff member already has (1) so the staff member gives out information without checking (1)
• Send an email pretending to be from a manager (1) asking staff to reset their password using a link the attacker controls (1) so the attacker is given the new password (1)
• Pretend to be a customer on the phone (1) to get a member of staff to give out customer details (1) which the attacker then uses to access customer accounts (1)
• Claim to need a member of staff's login details to fix a problem with the booking system (1) because the staff member wants the system working again (1) so they hand over the details without checking who the caller is (1)

Do not allow mix and match

Do not accept: watching a member of staff type their password, as this is shoulder surfing

Accept any other appropriate wording/phrasing

A description of how social engineering is used to gain access to systems. To include three from

• The attacker deceives/tricks a member of staff (1)
• By pretending to be someone they are not / impersonating a person or organisation the staff member knows (1)
• To gain their trust / take advantage of an already established trust (1)
• To get the staff member to reveal sensitive information such as usernames/passwords/personal details (1)
• Done over email/text/phone call/direct messaging (1)
• The staff member does not realise they have given the information away (1)

Do not accept: technical attacks where no one is deceived, such as malware or a denial of service attack

Accept any other appropriate wording/phrasing.

A description of a man-in-the-middle attack. To include three from

• An attacker gets between two devices/the two parties communicating (1)
• The attacker intercepts/eavesdrops on the communication (1)
• So the attacker can read the data being sent (1)
• The attacker can also tamper with/change the data before passing it on (1)
• Without either party/device knowing (1)
• Encryption/a VPN reduces the risk as the attacker cannot read the data (1)

Do not accept: the attacker sending lots of requests to make a server unavailable, as this is a denial of service attack

Accept any other appropriate wording/phrasing.

Award one mark for each correct way and one mark for a justification of each way, up to a maximum of four marks.

• Fit a privacy screen/filter to the monitor (1) so the screen can only be read when viewed straight on and people standing nearby cannot see the data (1)
• Position/turn the monitor away from customers (1) so visitors at the desk cannot read the information on screen (1)
• Lock the computer/screen when leaving the desk (1) so nobody can see the booking/payment details while staff are away (1)
• Ask customers to stand back from the desk/behind a line (1) so they cannot see the screen (1)
• Shield the keypad when entering a password/PIN (1) so nearby people cannot see the keys being pressed (1)
• Train staff to check who can see the screen (1) so they cover the screen or wait until they are not overlooked before entering data (1)
• Use a screen lock/blank screen after a short period (1) so data is hidden if staff forget to lock it (1)

Allow mix and match if the response makes sense.

Do not accept: anti-virus software or a firewall as a way to reduce shoulder surfing, as these do not stop someone looking at a screen.

Accept any other appropriate wording/phrasing.

Award one mark for each correct way and one mark for a justification of each way, up to a maximum of four marks.

• An attacker pretends to be IT support (1) and asks a member of staff to give them their password/login details (1)
• An attacker phones pretending to be a customer (1) and persuades staff to confirm or change the booking details on their account (1)
• An attacker sends an email pretending to be a manager (1) asking staff to send customer records/booking details (1)
• An attacker pretends to be a new member of staff (1) so that other staff show them how to log in to the booking system (1)
• An attacker pretends to be a visitor/delivery driver (1) to get into the office and read information left on desks/computer screens (1)
• An attacker poses as a supplier (1) and asks staff to open an attachment/send details of the company's systems (1)

Allow mix and match if the response makes sense.

Accept any other appropriate wording/phrasing.

Award one mark for each correct way and one mark for a justification of each way, up to a maximum of four marks.

• Someone reads a password by looking over a staff member's shoulder (1) so they can log in to the company's systems (1)
• Someone watches a staff member's screen from a nearby table/seat (1) to read confidential customer details (1)
• Someone watches a staff member type their PIN on a company device (1) so they can unlock it and access company data (1)
• Someone uses a phone camera/binoculars to zoom in on a screen from a distance (1) so the details can be read/used later (1)
• Someone stands near a staff member and reads a document or email open on the screen (1) so company information is disclosed (1)

Allow mix and match if the response makes sense.

Do not accept: answers about other threats, such as phishing or malware (e.g. a keylogger), rather than someone looking at a screen or keypad.

Accept any other appropriate wording/phrasing.

Responses will be credited according to the learner's demonstration of knowledge and understanding of the material, using the indicative content and level descriptors below.

The indicative content that follows is not prescriptive. Responses may cover some or all indicative content, but learners should be rewarded for other responses.

Discussion may consider

Ways the data could be seen

• A customer at the reception desk can read the screen while staff check bookings – sees other customers' names and contact details
• Someone in the queue can watch staff type a username and password – can log in later as a member of staff
• A customer's card details or PIN can be seen by others nearby when they pay – money can be taken from their account
• A phone camera or binoculars can be used from across the waiting area – the screen can be read without being close

Consequences for the garage and its customers

• Unauthorised access – an attacker can log in as staff and view or change bookings and customer records
• Identity theft or scam calls – customers' details can be used fraudulently and the garage has to deal with complaints
• Financial loss – stolen card details can be used and the garage may have to pay to put things right
• Reputation damage – customers may stop using the garage if they think their details are not safe, so bookings fall

Levels

• Level 0 (0 marks): No rewardable content
• Level 1 (1–2 marks): Demonstrates isolated elements of knowledge and understanding; there will be major gaps or omissions; Few of the points made will be relevant to the context in the question; Limited discussion which contains generic assertions rather than considering different aspects and the relationship between them
• Level 2 (3–4 marks): Demonstrates some accurate knowledge and understanding; with only minor gaps or omissions; Some of the points made will be relevant to the context in the question, but the link will not always be clear; Displays a partially developed discussion which considers some different aspects and some consideration of how they interrelate, but not always in a sustained way
• Level 3 (5–6 marks): Demonstrates mostly accurate and thorough/detailed knowledge and understanding; Most of the points made will be relevant to the context in the question, and there will be clear links; Displays a well-developed and logical discussion which clearly considers a range of different aspects and considers how they interrelate, in a sustained way

Responses will be credited according to the learner's demonstration of knowledge and understanding of the material, using the indicative content and level descriptors below.

The indicative content that follows is not prescriptive. Responses may cover some or all indicative content, but learners should be rewarded for other responses.

Discussion may consider

How the attack could happen

• An attacker on the same café Wi-Fi intercepts the data sent between a rep's laptop and the brewery's order system
• The café Wi-Fi is not encrypted, so the attacker can read the rep's login details and the pub orders being sent
• The attacker changes the data before passing it on, such as swapping the brewery's bank details on an invoice for their own
• A fake hotspot set up with the café's name so that reps connect to the attacker's network instead
• The rep and the brewery do not know the data has been intercepted, so orders keep going through the attacker

Impact on the brewery

• The attacker logs in as the rep and views or changes pub orders and customer records
• Financial loss – a pub pays the attacker's bank account instead of the brewery for its delivery
• Pubs lose trust in the brewery and move to another supplier, damaging the brewery's reputation
• Reps cannot take orders while passwords are changed, so deliveries to pubs are late

Accept any other relevant response

Levels

• Level 0 (0 marks): No rewardable content
• Level 1 (1–2 marks): Demonstrates isolated elements of knowledge and understanding; there will be major gaps or omissions; Few of the points made will be relevant to the context in the question; Limited discussion which contains generic assertions rather than considering different aspects and the relationship between them
• Level 2 (3–4 marks): Demonstrates some accurate knowledge and understanding; with only minor gaps or omissions; Some of the points made will be relevant to the context in the question, but the link will not always be clear; Displays a partially developed discussion which considers some different aspects and some consideration of how they interrelate, but not always in a sustained way
• Level 3 (5–6 marks): Demonstrates mostly accurate and thorough/detailed knowledge and understanding; Most of the points made will be relevant to the context in the question, and there will be clear links; Displays a well-developed and logical discussion which clearly considers a range of different aspects and considers how they interrelate, in a sustained way

Responses will be credited according to the learner's demonstration of knowledge and understanding of the material, using the indicative content and level descriptors below.

The indicative content that follows is not prescriptive. Responses may cover some or all indicative content, but learners should be rewarded for other responses.

Evaluation may consider

Man-in-the-middle attacks

• Interception – an attacker on the marina's free Wi-Fi can intercept the communication between a device and the booking system, so payment and customer details can be read.
• Changed data – the attacker can tamper with the data before passing it on, for example changing a payment amount, without either side knowing.
• Narrow reach – the attacker must be on the same network or control part of the connection, so fewer people could carry out the attack.
• Encryption – an encrypted connection means intercepted data cannot be read, lowering the risk to the marina if it is used.

Phishing

• Sent from anywhere – a criminal does not need to be at the marina and can target many staff and berth holders at once.
• Impersonation – a message that appears to come from a known supplier or the marina's bank can trick staff into revealing login details.
• Wider access – one stolen staff password could give access to the booking system and customer records, not just a single session.
• Filters and training – spam filters and staff training reduce how often phishing succeeds, so the risk can be managed.

Accept any other appropriate wording/phrasing

Levels

• Level 0 (0 marks): No rewardable material
• Level 1 (1–2 marks): Demonstrates isolated elements of knowledge and understanding; there will be major gaps or omissions; Few of the points made will be relevant to the context in the question; Limited evaluation which contains generic assertions leading to a conclusion which is partially supported
• Level 2 (3–4 marks): Demonstrates some accurate knowledge and understanding; with only minor gaps or omissions; Some of the points made will be relevant to the context in the question, but the link will not always be clear; Displays a partially developed evaluation which considers some different competing points, although not always in detail, leading to a conclusion which is partially supported
• Level 3 (5–6 marks): Demonstrates mostly accurate and thorough/detailed knowledge and understanding; Most of the points made will be relevant to the context in the question, and there will be clear links; Displays a well-developed and logical evaluation which clearly considers a range of different aspects and competing points, leading to a conclusion that is fully supported