Impact of security breach Exam Questions

Award one mark for each correct way, up to a maximum of two marks from:

• Paying a ransom to the attackers
• Fines/penalties/being sued/legal costs
• Repairing or replacing systems/paying IT specialists to fix them
• Lost income from cancelled flights/fewer bookings/lost sales
• Refunds/compensation paid to customers
• Cost of improving security after the breach
• Cost of advertising to repair the company's reputation
• Paying staff while the systems cannot be used

Do not accept: other impacts such as downtime or damage to public image, or causes of a breach such as malware or hacking – these are not ways the company could lose money

Accept any other appropriate response.

Award one mark for each correct way, up to a maximum of two marks from:

• Customers post negative reviews/complaints online
• Customers share their bad experiences on social media
• Bad word of mouth/poor recommendations to other people
• News/media reports about the breach
• The company is seen as careless/unprofessional
• The company is seen as unreliable
• The company is seen as untrustworthy/customers lose trust in it

Do not accept: other impacts of the breach such as loss of customers or financial loss – these are impacts on the company, not ways its public image is damaged

Accept any other appropriate response.

Award one mark for each correct example of financial loss, up to a maximum of two marks from:

• Fines/penalties
• Compensation payments to affected people
• Cost of repairing/replacing computer systems/hiring security specialists/paying staff overtime to fix the breach
• Ransom payment
• Lost donations/income
• Legal fees/cost of legal action
• Money stolen from the rescue team's bank account/theft of funds

Do not accept: financial loss as it is the example given

Allow: a ransom payment as an example of financial loss

Allow: fines and legal fees as two separate examples

Accept any other appropriate response.

Award one mark for the correct way and one mark for a justification for that way, up to a maximum of two marks.

• Clients lose trust in the riding school (1) because their personal details were exposed, so they may stop booking lessons (1)
• The riding school gets a reputation for being careless with data (1) as parents may not want to send their children there (1)
• Negative comments about the riding school are posted on social media (1) which can be seen by people looking for a riding school to join (1)
• Existing clients tell others not to use the riding school (1) so fewer people recommend it (1)
• News of the breach is reported in the local paper/school newsletter (1) which makes the riding school look unreliable to new clients (1)

Allow: loss of trust/loss of reputation on its own, as these count as damage to public image, for the first mark only

Do not accept: financial loss as this is a different impact, not damage to public image

Accept any other appropriate wording/phrasing.

Award one mark for a correct way and one mark for an expansion of that way, up to a maximum of two marks.

• Staff cannot use the ordering system/is locked out (1) so orders cannot be processed until the system is back (1)
• Lost data has to be recovered/re-entered (1) which takes staff time away from taking orders (1)
• Staff have to spend time resetting/changing passwords (1) so they get less of their normal work done (1)
• Staff have to deal with customers asking about the breach (1) which stops them processing orders and stock records (1)
• Staff have to work with IT to investigate the breach (1) so they cannot carry out their usual tasks (1)
• Files/records are deleted (1) so staff have to recreate them before they can carry on (1)

Allow mix and match if it makes sense

Do not accept: answers about financial loss or damage to reputation, as these are different impacts.

Accept any other appropriate wording/phrasing.

Award one mark for a correct way and one mark for an expansion of that way, up to a maximum of two marks.

• Staff have to do tasks manually/by hand (1) which takes longer than using the computer system (1)
• Staff are locked out of their accounts/cannot log in (1) so cannot work on current tasks until access is restored (1)
• Time is spent recovering data/resetting passwords (1) instead of doing their normal work (1)
• Staff have to help fix/investigate the breach (1) so fewer staff are working on orders/production (1)
• Work that was lost has to be redone (1) which delays other jobs/tasks (1)

Allow mix and match if it makes sense

Do not accept: legal action/financial loss as these are other impacts, not a reduction in productivity

Accept any other appropriate wording/phrasing.

Award one mark for a correct way, one mark for a justification for that way and one mark for an expansion of the justification, up to a maximum of three marks.

• Pay a ransom (1) because the attackers could lock the company's files (1) so the company cannot get its bookings back until it pays (1)
• Pay IT specialists to repair systems or recover data (1) because the breach may have damaged files or software (1) so less money is available to run the workshop (1)
• Lose income from bookings (1) because customers may cancel or go to another workshop after the breach (1) so the company earns less than it expected (1)
• Pay compensation or refunds to customers (1) because their payment details were accessed (1) which costs the company money (1)
• Pay staff overtime to fix the breach or recover data (1) because normal repairs are delayed (1) which adds to wage costs (1)

Allow: any appropriate expansion of the justification, such as lost business or having to spend money on repairs

Do not allow mix and match

Do not accept: 'loss of money' on its own; damage to public image or loss of data, as these are other impacts, not financial loss

Accept any other appropriate wording/phrasing

Award one mark for a correct way, one mark for a justification for that way and one mark for an expansion of the justification, up to a maximum of three marks.

• Staff cannot access files or the computer system (1) while the breach is investigated and fixed (1) so no designs or orders can be worked on (1)
• Staff have to reset their passwords (1) because the breach may have exposed them (1) which takes time away from their normal work (1)
• Data has to be recovered from backups (1) so staff have to re-enter the orders that were lost (1) which delays the windows being finished (1)
• Staff are asked to help investigate the breach (1) because they know how the system is normally used (1) which means they are not making any windows (1)
• Staff cannot use email or the shared network (1) so they cannot share designs with colleagues (1) which means each job takes longer to complete (1)

The expansion must add to the justification, e.g. saying how work is delayed, not just repeat it

Allow mix and match if the whole response makes sense

Do not accept ‘the company will lose money’/any reference to financial loss

Accept any other appropriate wording/phrasing

Award one mark for a correct way, one mark for a justification for that way and one mark for an expansion of the justification, up to a maximum of three marks.

• The server is taken offline (1) so the breach can be investigated (1) which means no tickets can be bought on the website (1)
• Data is restored from backups (1) because files may have been changed by the breach (1) so online booking stops while this is done (1)
• Malware is removed from the ticket system (1) so the system has to be shut down (1) and staff cannot check customers' bookings when they arrive (1)
• Passwords/security settings are changed (1) after the breach (1) so staff cannot use the system until this is complete (1)

Award the justification mark only where it explains why the breach makes the server/system unavailable (to investigate, repair or restore), not just that it is being fixed.

Allow mix and match if it makes sense.

Do not accept: other impacts such as loss of customers/financial loss, as they do not explain how downtime is caused.

Accept any other appropriate wording/phrasing.

A description of how downtime could affect the company. To include three from

• The centre has to shut down/take its systems offline (1) while the breach is investigated/fixed (1)
• Staff cannot use the booking system (1) so no new bookings/races can be taken (1)
• Customers are turned away/book with another track (1) so the centre loses income/sales (1)
• Staff have no work to do while the systems are down (1) so productivity falls (1)

Do not accept: other impacts of a security breach, such as damage to public image or legal action, that are not caused by the downtime

Accept any other appropriate wording/phrasing

A description of how a security breach could lead to legal action. To include three from

• The company has not kept customers' personal data secure (1) which breaks data protection law (GDPR/DPA) (1) so it can be taken to court (1)
• A customer whose data was leaked can sue the company (1) and claim compensation (1)
• The ICO can investigate the breach (1) and fine the company/take it to court (1)

Do not accept: how the breach happened, e.g. a hacker or a phishing email, as this is not legal action

Accept any other appropriate wording/phrasing

A description of how data loss could affect the company. To include three from

• Customer booking/personal details are lost/deleted (1) so the company cannot access them when it needs them (1)
• Staff have to re-enter/recreate the lost records (1) which takes time/reduces productivity (1)
• The company cannot contact customers about their bookings (1) so it loses bookings/income (1)
• Customers may lose trust in the company (1) which damages its public image/loses future bookings (1)

Do not accept: other impacts of a security breach that are not caused by the data loss, such as downtime

Accept any other appropriate wording/phrasing.

Award one mark for each correct way and one mark for a justification of each way, up to a maximum of four marks.

• Staff are locked out of their accounts (1) so they cannot open their design files / carry on with their work until access is restored (1)
• Staff have to restore data that was lost (1) so time is spent recovering files instead of designing new panels (1)
• Design files are damaged and have to be made again (1) which takes time they would have spent on new orders (1)
• New security measures, such as a second login step, are added (1) so everyday tasks take longer to complete (1)
• Staff have to change their passwords and have their devices checked (1) so they are away from their design work while this is done (1)
• Staff have to be retrained on security (1) so they cannot work while they attend the training (1)

Allow justifications that only imply time being lost, e.g. 'so the files have to be made again' or 'so work stops until access is restored', as long as the link to reduced productivity is clear

Do not accept impacts that are not a reduction in productivity, such as financial loss or legal action, even if they are justified

Allow mix and match if the response makes sense

Accept any other appropriate wording/phrasing

Award one mark for each correct way and one mark for a justification of each way, up to a maximum of four marks.

• Milk orders cannot be processed (1) so deliveries to shops are missed/late (1)
• The farm cannot take new orders from shops (1) so those shops may buy from another dairy/go to a competitor (1)
• Staff cannot check which cows have been milked (1) so they have to keep paper records and update the system later (1)
• Staff cannot check the treatments given to cows (1) so it takes longer to work out which milk can be sold (1)
• The farm cannot send invoices to the shops it supplies (1) so it is paid late/cash flow suffers (1)
• Staff cannot do their usual jobs (1) so the work has to be done later and they fall behind (1)

Allow 'lose money/lose income/lose sales' as a justification of not being able to process milk orders or take new orders

Do not accept other impacts of a security breach, such as data loss or damage to public image, as these do not explain how downtime affects the farm

Allow mix and match if the response makes sense

Accept any other appropriate wording/phrasing

Award one mark for each correct reason and one mark for a justification of each reason, up to a maximum of four marks.

• The venue did not keep the couples' personal data secure (1) so the couples could take the venue to court/sue the venue (1)
• The venue did not comply with the GDPR/Data Protection Act (1) so the Information Commissioner's Office (ICO) could fine the venue (1)
• The breach caused the couples stress/worry (1) so they could take the venue to court/claim compensation (1)
• The couples lost money because of the breach (1) so they could sue the venue to get their money back (1)
• The venue did not follow its own security policy, e.g. staff shared passwords (1) so the venue could be held responsible and sued (1)

Do not accept other impacts of a breach, such as damage to public image or loss of bookings, as these are not legal action

Allow 'fined' or 'sued' on its own only where the response also gives a reason for it

Allow mix and match if the response makes sense

Accept any other appropriate wording/phrasing

Responses will be credited according to the learner's demonstration of knowledge and understanding of the material, using the indicative content and level descriptors below.

The indicative content that follows is not prescriptive. Responses may cover some or all indicative content, but learners should be rewarded for other responses.

Discussion may consider

Company impacts

• Lost contact records – staff cannot send invoices or renewals to berth holders
• Lost payment records – the marina cannot prove who has paid, so mooring fees are lost
• Reduced productivity – staff rebuild records from paper files instead of doing their normal work
• Damage to public image – boat owners hear the records were lost and take their moorings elsewhere

Berth holder impacts

• Stress – berth holders worry their payment details could be misused by someone else
• Time and effort – berth holders have to give their contact and insurance details to the marina again
• Missed notices – berth holders get no invoices or safety information if their details are gone
• Loss of trust – berth holders move their boats to another marina

Accept any other relevant response

Levels

• Level 0 (0 marks): No rewardable content
• Level 1 (1–2 marks): Demonstrates isolated elements of knowledge and understanding; there will be major gaps or omissions; Few of the points made will be relevant to the context in the question; Limited discussion which contains generic assertions rather than considering different aspects and the relationship between them
• Level 2 (3–4 marks): Demonstrates some accurate knowledge and understanding; with only minor gaps or omissions; Some of the points made will be relevant to the context in the question, but the link will not always be clear; Displays a partially developed discussion which considers some different aspects and some consideration of how they interrelate, but not always in a sustained way
• Level 3 (5–6 marks): Demonstrates mostly accurate and thorough/detailed knowledge and understanding; Most of the points made will be relevant to the context in the question, and there will be clear links; Displays a well-developed and logical discussion which clearly considers a range of different aspects and considers how they interrelate, in a sustained way