Finding weaknesses and improving system security Exam Questions

Award one mark for each correct characteristic of a grey hat hacker, up to a maximum of two marks from:

• Outsider/not employed by the company
• Does not exploit the weakness for personal gain
• May report the weakness to the organisation
• May release the exploit to the public
• Finds a vulnerability without permission from the company

Do not accept: paid/invited by the company – this describes a white hat hacker

Accept any other appropriate response.

Award one mark for each correct action, up to a maximum of two marks from:

• Gather information about the target/system/network
• Identify possible entry points/ways in
• Attempt to break in/gain access
• Look for/discover vulnerabilities/weaknesses
• Exploit weaknesses (without disruption)
• Document/report issues/findings found
• Recommend security improvements

Do not accept: fix/repair weaknesses or install security software – these are actions the company takes after the test, not during it

Accept any other appropriate response.

Award one mark for each correct example, up to a maximum of two marks from:

• Failed login attempts
• Login/logon times
• Files or areas accessed
• Websites visited/browsing history
• Emails sent and received
• Network traffic/data usage
• Unusual user activity/behaviour

Do not accept: installing a firewall/other security measures – these are not data that is analysed

Accept any other appropriate response.

Award one mark for a correct way and one mark for an expansion of that way, up to a maximum of two marks.

• By gathering information about the booking system/target (1) to identify possible entry points (1)
• By attempting to break into the system and exploiting any weaknesses found (1) to see how far into the system they can get/what damage could be done (1)
• By testing the company's firewalls/servers (1) to find out whether a hacker can get in through them (1)
• By checking for weak passwords/default login credentials (1) as these are easy for a hacker to guess (1)
• By writing a report of the findings (1) which lists the weaknesses that need fixing (1)

Do not accept: finding weaknesses/vulnerabilities on its own, as this is the purpose of the test rather than a way of carrying it out

Allow mix and match if it makes sense

Accept any other appropriate wording/phrasing

Award one mark for a correct reason and one mark for a justification for that reason, up to a maximum of two marks.

• The company has invited/paid them (1) so they have permission to test the system (1)
• They do not exploit any weakness for their own gain (1) so they will not steal the company's customer data (1)
• They do not cause permanent damage (1) so the company's systems keep working and no data is lost or changed (1)
• They report the weaknesses they find to the company (1) so the company can fix them rather than the details being released to criminals (1)
• They work within the law (1) so they will not do anything illegal such as deleting files (1)
• They only test the systems they have been asked to test/agree the scope in advance (1) so the rest of the network is not affected (1)

Allow mix and match if it makes sense

Accept any other appropriate wording/phrasing

Award one mark for a correct risk and one mark for a justification for that risk, up to a maximum of two marks.

• The grey hat hacker could release/publish the weakness to the public (1) so other hackers could use it to attack the website (1)
• The hacker was not invited/paid by the company (1) so the company had no control over what they did on the system/cannot be sure they did not damage anything while testing it (1)
• The company does not know who the hacker is (1) so it cannot be sure the weakness they describe is genuine/that they can be trusted (1)
• News that the website was not secure could damage the company's reputation (1) so customers may book their lessons with another riding school (1)

The first mark can be awarded for the risk on its own, e.g. they could release the weakness to the public (1)

Do not accept: the grey hat hacker stealing/selling the data, as a grey hat does not exploit a weakness for personal gain

Allow mix and match if it makes sense

Accept any other appropriate wording/phrasing

Award one mark for a correct weakness, one mark for a justification for that weakness and one mark for an expansion of the justification, up to a maximum of three marks.

• Unpatched/out-of-date software (1) because known security holes have not been fixed (1) so an attacker could use them to get into the system (1)
• Weak/default passwords (1) because they are easy to guess (1) so an attacker could log in as a member of staff (1)
• Poorly configured firewall (1) because it may allow traffic that should be blocked (1) so an attacker could reach the server (1)
• Unencrypted data/traffic (1) because anyone who intercepts it can read it (1) so customer details could be stolen (1)
• Insecure program code (1) because it may not check what users enter (1) so an attacker could access data they should not see (1)

Do not allow mix and match.

Do not accept: installing antivirus software or a firewall; these are prevention measures, not weaknesses found by a penetration test.

Accept any other appropriate wording/phrasing.

Award one mark for a correct identification, one mark for a justification for that identification and one mark for an expansion of the justification, up to a maximum of three marks.

• A hacker who is paid/invited (1) to test the security of a system (1) so that any weaknesses can be found/fixed (1)
• An expert who has permission (1) to try to break into the system (1) without causing damage/stealing data (1)
• Someone employed/hired by the company (1) to look for vulnerabilities (1) and report them to the organisation (1)
• A person who tests a system legally (1) by attempting to break in (1) to help improve the company's security (1)

Allow mix and match if the whole response makes sense.

Do not accept: breaking into a system without permission/for personal gain, as this describes an unethical hacker.

Accept any other appropriate wording/phrasing.

Award one mark for a correct identification, one mark for a justification for that identification and one mark for an expansion of the justification, up to a maximum of three marks.

• A simulated/pretend attack (1) carried out with the company's permission/authorisation (1) to find weaknesses before a criminal hacker does (1)
• Ethical hackers test the security (1) by trying to gain access/break in (1) and then report the weaknesses found to the company (1)
• Testers look for vulnerabilities/weaknesses (1) such as weak passwords or unpatched software (1) so these can be fixed/patched (1)
• A test of all aspects of security (1) using the same tools/techniques as a hacker (1) so that improvements can be made (1)

Do not allow mix and match.

Allow: other appropriate examples of weaknesses, e.g. poorly configured firewalls.

For the second bullet, 'by trying to gain access' earns the justification; the expansion needs what happens next, e.g. the weaknesses are reported or fixed.

Do not accept: a criminal/illegal attack that steals, deletes or damages data.

Accept any other appropriate wording/phrasing.

A description of how penetration testing is carried out. To include three from

• The testers are given permission/authorisation to test the system (1)
• They use the same techniques/tools as hackers to simulate attacks (1)
• They attempt to break in/gain access to the network (1)
• They look for/identify vulnerabilities/weaknesses (1)
• They exploit the weaknesses found without disrupting/damaging the system (1)
• They document/report the issues found (1)
• They recommend improvements/fixes/patches to the security (1)

Do not accept: installing a firewall or antivirus software

Accept any other appropriate response

A description of how a grey hat hacker can become a white hat hacker. To include three from

• The grey hat hacker finds the weakness without being invited/paid/authorised (1)
• They report the weakness to the farm (1) without exploiting it for personal gain/causing damage (1)
• The farm invites/pays them to test the system (1) so they become a white hat hacker (1)
• The hacker now has permission/authorisation to test the security (1)

Do not accept: hacking to steal data or for financial gain, as this is unethical hacking.

Accept any other appropriate wording/phrasing

A description of ethical hacking, including white hat and grey hat hackers. To include three from

• Ethical hacking is testing/breaking into a system to find weaknesses/vulnerabilities (1)
• Without causing damage or loss to the system (1)
• White hat hackers are paid/invited/authorised by the organisation (1)
• Grey hat hackers are outsiders/not authorised by the organisation (1)
• Grey hat hackers find a vulnerability/weakness but do not exploit it for personal gain (1)
• Grey hat hackers may report the vulnerability to the organisation (1)
• Grey hat hackers may release the vulnerability to the public (1)

Do not accept: hacking for personal gain or to steal data (this is black hat/unethical hacking).

Accept any other appropriate wording/phrasing.

Award one mark for each correct benefit and one mark for a justification of each benefit, up to a maximum of four marks.

• Finds weaknesses/vulnerabilities in the system (1) so that the museum can fix/patch them before a criminal hacker finds them (1)
• Is invited/works with the museum's permission (1) so the museum knows what is being tested and that the testing is authorised (1)
• Tests the system using the same tools/techniques as criminal hackers (1) so the museum finds weaknesses its own staff would miss (1)
• Reports the findings (1) so the museum can improve staff practices/train its staff (1)
• No permanent damage or loss is caused (1) as the hacker only highlights the weaknesses without exploiting them for personal gain (1)
• Cheaper than recovering from a real attack (1) as the museum would not lose data or money (1)

Allow: a justification of 'finds weaknesses' that says 'so the museum can fix/patch them' without mentioning a criminal hacker (1)

Do not accept: 'cheaper' on its own; releasing a weakness to the public, as this is grey hat not white hat hacking

Accept any other appropriate wording/phrasing.

Award one mark for each correct way and one mark for a justification of each way, up to a maximum of four marks.

• Try weak/default passwords or login details (1) as staff may never have changed them/they are easy to guess (1)
• Exploit unpatched software or an operating system that has not been updated (1) as the known weaknesses have not been fixed (1)
• Access unencrypted data or network traffic (1) as it can be read without a decryption key (1)
• Attack a poorly configured firewall (1) as it may let through traffic that should be blocked (1)
• Get into the building and use a computer that has been left logged in (1) so they can reach the network/data without a password (1)
• Look for entry points/services that are visible on the public internet (1) to find a way into the network (1)

Allow mix and match if it makes sense

Do not accept: installing anti-virus software or updating the operating system, as these are ways of improving security, not testing it

Accept any other appropriate wording/phrasing

Award one mark for each correct way and one mark for a justification of each way, up to a maximum of four marks.

• Review access logs (1) to spot unusual activity such as staff logging in at unusual times or opening files they do not need to see (1)
• Monitor network traffic (1) to find a large amount of data being sent to an unknown address / a lot of traffic at unusual times (1)
• Analyse failed login attempts (1) as repeated failures could be someone trying to guess a password (1)
• Compare current behaviour with normal patterns of use (1) so anything unusual stands out as a possible risk (1)
• Check which files have been accessed/downloaded (1) to spot data being taken by a member of staff (1)
• Check the times staff are logged in (1) as activity outside working hours could be a risk (1)

Allow a justification for access logs only where it relates to spotting unusual activity or unnecessary access; do not credit 'to see when staff log in' on its own

Do not accept: ways of protecting the system such as installing a firewall or anti-virus software, as these do not analyse system data

Accept any other appropriate wording/phrasing

Responses will be credited according to the learner's demonstration of knowledge and understanding of the material, using the indicative content and level descriptors below.

The indicative content that follows is not prescriptive. Responses may cover some or all indicative content, but learners should be rewarded for other responses.

Discussion may consider

• Failed logins – repeated attempts at unusual times could show someone is guessing a password, so the account can be locked before the water quality records are reached
• Login times and locations – a user signing in outside their shift or from an unknown place could mean their login details have been stolen
• Unusual file access – an engineer opening or copying far more supply records than normal could be a sign of data theft, so access can be stopped and checked
• Network traffic – a sudden spike or a link to an unknown address could show malware, so that part of the network can be isolated before the treatment process is affected
• System performance – devices running slowly or crashing more often could be caused by malware, so they can be scanned before supply is disrupted
• Changes in user behaviour – an account that is normally quiet suddenly reaching many areas of the system could show it has been compromised, so it can be disabled
• Patterns over time – comparing new activity with normal daily use helps tell a real risk from a one-off mistake, so alerts are more accurate
• Automated alerts – analysis software can flag unusual behaviour straight away, so staff can respond before the risk grows

Levels

• Level 0 (0 marks): No rewardable content
• Level 1 (1–2 marks): Demonstrates isolated elements of knowledge and understanding; there will be major gaps or omissions; Few of the points made will be relevant to the context in the question; Limited discussion which contains generic assertions rather than considering different aspects and the relationship between them
• Level 2 (3–4 marks): Demonstrates some accurate knowledge and understanding; with only minor gaps or omissions; Some of the points made will be relevant to the context in the question, but the link will not always be clear; Displays a partially developed discussion which considers some different aspects and some consideration of how they interrelate, but not always in a sustained way
• Level 3 (5–6 marks): Demonstrates mostly accurate and thorough/detailed knowledge and understanding; Most of the points made will be relevant to the context in the question, and there will be clear links; Displays a well-developed and logical discussion which clearly considers a range of different aspects and considers how they interrelate, in a sustained way

Responses will be credited according to the learner's demonstration of knowledge and understanding of the material, using the indicative content and level descriptors below.

The indicative content that follows is not prescriptive. Responses may cover some or all indicative content, but learners should be rewarded for other responses.

Discussion may consider

White hat hackers

• Invited or paid by Aldergate – they have permission to test the system, so the company is not breaking the law and can set clear rules for what they access
• Find weaknesses such as weak passwords or unpatched software – they report these before criminals find them, so customer financial records are better protected
• Test how far an attacker could get – this shows Aldergate where its network is exposed and which areas need stronger controls
• Provide a report of findings and recommendations – staff can fix the faults and improve security training and policies

Grey hat hackers

• Find a vulnerability without being invited – if they report it privately, Aldergate gets a warning about a risk it did not know about
• Do not exploit the weakness for personal gain – the customer data may not be stolen, and the company can fix the fault before it is used
• May release the exploit to the public if ignored – this could let criminals attack the same weakness, so Aldergate must act quickly and may face reputation damage
• Are outside the company's control – a grey hat may access more data than needed or disrupt systems, creating legal and security risks for Aldergate

Levels

• Level 0 (0 marks): No rewardable content
• Level 1 (1–2 marks): Demonstrates isolated elements of knowledge and understanding; there will be major gaps or omissions; Few of the points made will be relevant to the context in the question; Limited discussion which contains generic assertions rather than considering different aspects and the relationship between them
• Level 2 (3–4 marks): Demonstrates some accurate knowledge and understanding; with only minor gaps or omissions; Some of the points made will be relevant to the context in the question, but the link will not always be clear; Displays a partially developed discussion which considers some different aspects and some consideration of how they interrelate, but not always in a sustained way
• Level 3 (5–6 marks): Demonstrates mostly accurate and thorough/detailed knowledge and understanding; Most of the points made will be relevant to the context in the question, and there will be clear links; Displays a well-developed and logical discussion which clearly considers a range of different aspects and considers how they interrelate, in a sustained way