Skip to content

FRM Part II · FRM Exam Part II · Case Study: Cyberthreats and Information Security Risks

A bank's threat intelligence unit reports that a criminal group compromised a small software vendor and pushed a malicious update that was then installed by dozens of financial institutions, including the bank. Which attack vector does this describe?

This is a supply chain compromise. The attacker exploited a trusted third-party vendor and used its legitimate update mechanism to reach many institutions at once, which differs from credential stuffing, denial-of-service traffic floods, or email impersonation fraud.

  1. ACredential stuffing against customer accounts
  2. BDistributed denial-of-service attack
  3. CSupply chain compromiseCorrect
  4. DBusiness email compromise

Explanation

Compromising a trusted vendor and distributing malicious code through its legitimate update channel is a supply chain attack. Credential stuffing reuses leaked passwords, DDoS overwhelms availability with traffic, and business email compromise relies on impersonation to induce payments. None involves a trusted software update.

Did you get it right without looking?

One question tells you little. A timed set on Case Study: Cyberthreats and Information Security Risks shows your real accuracy, how long you take and where you lose marks.

Practise Case Study: Cyberthreats and Information Security RisksFree diagnostic mock

More Case Study: Cyberthreats and Information Security Risks questions