Skip to content

FRM Part II · FRM Exam Part II · Case Study: Cyberthreats and Information Security Risks

A bank learns that attackers compromised a software update from a trusted vendor, inserting malicious code that was then distributed to the bank and many of the vendor's other clients. Which threat category does this represent?

This is a supply chain attack. Attackers compromised a trusted vendor's software update so that malicious code reached the vendor's many clients, including the bank. It is not credential guessing, telephone manipulation or physical theft, and it illustrates third-party and concentration risk.

  1. ASupply chain attackCorrect
  2. BBrute-force password attack
  3. CSocial engineering by telephone
  4. DPhysical theft of equipment

Explanation

Compromising a trusted vendor's software to reach downstream customers is a supply chain attack. Brute force guesses credentials, telephone social engineering manipulates people, and physical theft involves hardware. It also highlights concentration and third-party risk.

Did you get it right without looking?

One question tells you little. A timed set on Case Study: Cyberthreats and Information Security Risks shows your real accuracy, how long you take and where you lose marks.

Practise Case Study: Cyberthreats and Information Security RisksFree diagnostic mock

More Case Study: Cyberthreats and Information Security Risks questions