FRM Part II · FRM Exam Part II · Case Study: Cyberthreats and Information Security Risks
A bank's security team discovers that a critical vulnerability patch was released by the software vendor four months ago but was never applied to an internet-facing server, which attackers then used to gain entry. Which control failure does this MOST directly illustrate?
This is a failure of vulnerability and patch management. The vendor had already released a fix, yet the bank did not apply it to an exposed server, leaving a known weakness open for attackers. The other controls listed would not have closed that specific gap.
- AWeak vulnerability and patch managementCorrect
- BInadequate encryption of data at rest
- CInsufficient physical access controls
- DLack of a business continuity site
Explanation
A known fix existed but was not deployed, so the weakness lay in the patch and vulnerability management process. Encryption, physical access and continuity sites would not address an unpatched, exposed server.
Did you get it right without looking?
One question tells you little. A timed set on Case Study: Cyberthreats and Information Security Risks shows your real accuracy, how long you take and where you lose marks.
More Case Study: Cyberthreats and Information Security Risks questions
- After a major breach, a post-incident review finds that security alerts had fired for weeks but were not escalated because the monitoring te…
- A bank's risk team estimates that a ransomware event occurs on average 0.4 times per year (Poisson frequency). Each event causes an expected…
- After a penetration test reveals that privileged accounts at a bank are shared among administrators with no individual accountability, which…
- A bank allocates its cyber risk governance responsibilities under a three lines model. Which arrangement is most consistent with that model?
- A mid-sized bank's security team observes a well-funded group that maintains undetected access to its payment-messaging network for many mon…
- A bank has three cyber risk treatment options for a scenario with inherent expected annual loss of USD 3.0 million. Option A: a control cost…