Internal Threats Exam Questions

Award one mark for each correct way, up to a maximum of two marks from:

• Sending/emailing data to the wrong recipient/person
• Leaving data on screen/leaving a device unattended and logged in
• Leaving printed documents on a desk/printer
• Shoulder surfing by another member of staff/letting another member of staff see their screen
• Accidentally revealing their password to another member of staff/writing it down where others can see it
• Losing a portable storage device/USB stick containing data
• Talking about customers' details where others can hear

Do not accept: selling or leaking information on purpose, or attacks by hackers/external threats, as these are not unintentional disclosure by staff

Accept any other appropriate response.

Award one mark for each correct way, up to a maximum of two marks from:

• Selling/sending data to a rival/competitor
• Posting/sharing data on social media
• Copying data onto a USB stick to take it out of the building
• Taking printed records/documents out of the office
• Taking photos of the screen/records with a personal phone
• Emailing records to someone outside the company, e.g. a friend

Do not accept: accidental/unintentional disclosure such as emailing the wrong person, or external threats such as hacking or phishing, as these are not intentional leaking by staff

Accept any other appropriate response.

Award one mark for each correct way, up to a maximum of two marks from:

• Logging in using another member of staff's login details or password/an administrator account
• Sharing a password/login details with another member of staff
• Removing the password protection from a device or file so anyone can open it
• Changing the access permissions on a file or folder so that more people can open it
• Using a USB device in a port that has been blocked/disabled
• Installing software that the organisation has banned/not approved
• Turning off/disabling the firewall
• Turning off the filtering/blocking of websites

Do not accept: turning off the antivirus software – this is the example given in the question

Do not accept: forgetting a password or not logging out of a system – these do not override a security control

Allow: giving a password to another member of staff, or using a password another member of staff has given them, as both get past the login control

Accept any other appropriate response.

Award one mark for a correct way and one mark for a justification for that way, up to a maximum of two marks.

• Sell/give the owner records to a rival stables (1) for financial gain/to gain business from the rival/to make money (1)
• Email/send confidential files to a personal email account (1) so the data can be taken to a new employer (1)
• Take screenshots/photos of the data on screen (1) so it can be shared with people outside the company/on social media (1)
• Copy files onto a memory stick before leaving (1) so they can set up in competition/take the owners with them (1)
• Print out the records and take them away (1) so they can be sold/given to a rival stables (1)
• Share the information with someone outside the company who should not see it (1) because they are a disgruntled employee/want revenge on the company (1)

Do not accept: other internal threats, e.g. a USB device bringing a virus into the network.

Allow mix and match if it makes sense

Accept any other appropriate wording/phrasing

Award one mark for a correct way and one mark for a justification for that way, up to a maximum of two marks.

• Share their login/password with another member of staff (1) so that person can see or change data they are not allowed to (1)
• Use a colleague's account that has been left logged in (1) to view information their own account does not allow (1)
• Turn off/disable the antivirus software or firewall (1) so that blocked programs/games can be downloaded or run (1)
• Get around the web filter/bypass the block on websites (1) so they can access social media/streaming sites at work (1)
• Change their own access permissions/settings (1) so they can open files that are meant to be restricted to managers (1)
• Use a colleague's password they have watched them type/found written down (1) so they can log in as that person (1)

Allow: sharing their own login details and using a colleague's password are separate ways

Allow mix and match if it makes sense

Do not accept: 'override the security controls' or 'break the rules' on their own, as these do not say how.

Accept any other appropriate wording/phrasing

Award one mark for a correct way and one mark for an expansion of that way, up to a maximum of two marks.

• Disable the USB ports on company laptops/computers/block USB access (1) so that a flash drive cannot be connected to them (1)
• Use antivirus/anti-malware software that scans USB/removable drives when they are connected (1) so any malware on a flash drive is found before the files are opened (1)
• Ban staff from using their own/personal flash drives at work (1) so an infected device is not plugged into the network (1)
• Only allow company-issued flash drives that have been checked/scanned (1) so the company knows the drives do not contain malware (1)
• Use encrypted company flash drives (1) so that if one is lost or stolen the data on it cannot be read (1)
• Email the service record to the customer/upload it to an online customer account instead (1) so no data needs to be carried on a flash drive (1)
• Stop engineers running files straight from a flash drive/copy the files across before opening them (1) so malware on the drive cannot run (1)

Allow 'install antivirus/anti-malware software' on its own as the way (1); the second mark needs how it deals with the threat from flash drives.

Allow 'turn off/disable the USB ports', 'block USB access' and 'stop USB drives working' as the same way.

Do not accept: answers about external threats, e.g. installing a firewall to keep hackers out, as these do not reduce the threat caused by USB flash drives.

Allow mix and match if it makes sense

Accept any other appropriate wording/phrasing

Award one mark for a correct way of overriding security controls, one mark for a justification for that way and one mark for an expansion of the justification, up to a maximum of three marks.

• Turning off the antivirus software (1) even though staff are not allowed to change these settings (1) which means malware is not stopped from infecting the booking system (1)
• Giving themselves higher permissions (1) so they can open files they are not allowed to see (1) which could mean customer details are leaked (1)
• Disabling automatic updates (1) so security patches are not installed (1) which leaves the system open to attack (1)
• Turning off the firewall (1) so that blocked programs can run (1) which allows unauthorised connections to reach the booking system (1)

Do not allow mix and match

Allow: a justification that explains how the staff member got around the control, such as being able to change the security settings

Allow: a general consequence, such as data being lost, leaked or the system being infected

Do not accept: staff not logging out of the system

Accept any other appropriate wording/phrasing

Award one mark for a correct way, one mark for a justification for that way and one mark for an expansion of the justification, up to a maximum of three marks.

• The device could be lost or stolen (1) because they are small and easy to misplace (1) which means the orders stored on it could be read by someone else (1)
• The device could be infected with malware (1) which spreads to a bakery laptop when it is plugged in (1) so the recipe and order files are corrupted/damaged/lost (1)
• The device could stop working (1) because it has a short life span (1) so the only copy of the recipe data is lost (1)
• Staff could copy order files onto the device (1) and take it out of the bakery/leave the premises (1) so customer details could be given to a competitor (1)

Allow the device being plugged in/having its files transferred as the justification, with the effect on the files as the expansion

Allow mix and match if it makes sense

Do not accept: answers about other internal threats such as accidental damage to a laptop; hackers outside the bakery

Accept any other appropriate wording/phrasing

Award one mark for a correct way, one mark for a justification for that way and one mark for an expansion of the justification, up to a maximum of three marks.

• Staff could download a file that contains malware (1) which installs itself on the computer when the file is opened (1) which could give an attacker access to the customers' medical forms (1)
• Staff could download ransomware (1) which encrypts the files on the computer (1) so the course bookings cannot be used until a payment is made (1)
• Staff could download a program/app that comes with spyware (1) which records the passwords staff type in (1) which lets someone else log in to the centre's system (1)
• A downloaded file could already be infected (1) which then spreads to the other computers on the centre's network (1) so all the office computers are affected (1)

Allow mix and match if the whole response makes sense

Downloading a program/app from a website is accepted as the way, whether or not the website is described as untrustworthy

Do not accept: answers about portable storage devices (e.g. a USB stick), as these are not downloaded from the internet

Accept any other appropriate wording/phrasing

A description of how downloads from the internet could be an internal threat. To include three from

• Staff download files/programs from the internet
• From an untrustworthy/file-sharing website
• The file may contain malware/a virus/spyware
• The malware is installed on the company's computer/network
• Which can give access to the company's/customers' data
• Data can be stolen/corrupted/deleted (by the malware)

Do not accept: downloads only making the computer or network slower (a performance issue).

Accept any other appropriate wording/phrasing

A description of an untrustworthy website security issue. To include three from

• The website may contain malware/a virus/spyware
• Which is downloaded onto the tablet/the company's system
• The website may be a fake/phishing site that looks genuine
• Staff may be tricked into entering their login details/username and password
• The attacker can then use them to log in to/access the company's systems
• Customer/payment data can be stolen/changed/deleted

Allow mix and match if it makes sense

Do not accept: ways of recognising an untrustworthy website (such as a missing padlock or poor spelling), as this does not describe a risk to the company's data.

Accept any other appropriate wording/phrasing

A description of an unintentional disclosure of data at the company. To include three from

• Sending an email/file containing customer data to the wrong recipient/customer
• Attaching the wrong file/photograph to an email by mistake
• Leaving a device/printout where customers/visitors can see it
• Letting another member of staff see the screen (shoulder surfing)
• Leaving a computer logged in/unlocked so others can access the files
• Uploading/posting customer photographs to a public/social media site by mistake

Do not accept: someone outside the company hacking into the system to steal the data, as this is an external threat.

Accept any other appropriate wording/phrasing

Award one mark for each correct way and one mark for a justification of each way, up to a maximum of four marks.

• Block/disable the USB ports on the computers (1) so staff cannot connect a memory stick and copy files onto it (1)
• Only allow portable storage devices that have been issued by the school (1) so the school knows what is being connected/can check the device first (1)
• Scan/check any device before it is used or set up anti-virus software to scan removable devices automatically (1) so any malware on the device is found before it spreads to the network (1)
• Provide encrypted portable storage devices (1) so the data cannot be read if the device is lost or stolen (1)
• Have a policy that bans personal/unauthorised portable storage devices (1) so staff only use devices the school has checked (1)
• Train staff about the risks (1) so they do not connect devices they have found or been given (1)
• Restrict what staff are allowed to copy onto portable storage devices (1) so customer data cannot be taken off the school's network (1)

Allow mix and match if the response makes sense

Do not accept: answers about the risks rather than reducing them, e.g. a memory stick can be lost or stolen

Accept any other appropriate wording/phrasing

Award one mark for each correct way and one mark for a justification of each way, up to a maximum of four marks.

• A fake login page on the website tricks staff into entering their password (1) so a criminal can use it to open the centre’s booking system and steal customer records (1)
• The website downloads spyware/a keylogger onto the computer (1) which records the passwords staff type and sends them to a criminal (1)
• Staff download a file/program from the website that contains malware (1) which lets a criminal access the centre’s computers and copy its data (1)
• A pop-up on the website offers a fake security update (1) so staff install a program that lets a criminal steal files from the computer (1)
• The website contains malicious scripts (1) which exploit an out-of-date browser to let a criminal into the centre’s system (1)
• Staff enter the centre’s supplier account details on the website (1) so a criminal can use them to see the centre’s order details/data (1)

Do not accept: benefits of using the internet, such as finding cheaper supplies.

Allow mix and match if it makes sense.

Accept any other appropriate wording/phrasing.

Responses will be credited according to the learner's demonstration of knowledge and understanding of the material, using the indicative content and level descriptors below.

The indicative content that follows is not prescriptive. Responses may cover some or all indicative content, but learners should be rewarded for other responses.

Evaluation may consider

Staff training

Benefits

• Staff learn to check email recipients before sending – so member details are less likely to go to the wrong person.
• Staff learn to lock screens and hide records – so other people cannot see medical details.

Drawbacks

• Training takes staff away from work and costs money – so the club may train staff less often.
• Staff may forget or ignore the training – so accidental disclosure can still happen.

Restricting access to member records

Benefits

• Only staff who need the records can open them – so fewer people can disclose data by mistake.
• Access can be removed when staff leave – so former staff cannot see or share records.

Drawbacks

• Staff may not be able to do their jobs without the records they need – so there may be delays in helping members.
• The club must set and update permissions – which takes time and can cause delays when records are needed urgently.

Accept any other appropriate wording/phrasing

Levels

• Level 0 (0 marks): No rewardable material
• Level 1 (1–2 marks): Demonstrates isolated elements of knowledge and understanding; there will be major gaps or omissions; Few of the points made will be relevant to the context in the question; Limited evaluation which contains generic assertions leading to a conclusion which is partially supported
• Level 2 (3–4 marks): Demonstrates some accurate knowledge and understanding; with only minor gaps or omissions; Some of the points made will be relevant to the context in the question, but the link will not always be clear; Displays a partially developed evaluation which considers some different competing points, although not always in detail, leading to a conclusion which is partially supported
• Level 3 (5–6 marks): Demonstrates mostly accurate and thorough/detailed knowledge and understanding; Most of the points made will be relevant to the context in the question, and there will be clear links; Displays a well-developed and logical evaluation which clearly considers a range of different aspects and competing points, leading to a conclusion that is fully supported