Skip to content

FRM Part II · FRM Exam Part II · Case Study: Cyberthreats and Information Security Risks

A post-incident review of a major retailer breach found that attackers entered through credentials stolen from an HVAC contractor that had network access. Which lesson is MOST relevant for the retailer's risk management?

Third-party access needs due diligence, tight restriction and ongoing monitoring. The attackers used a contractor's stolen credentials, showing that supplier connections extend the attack surface. Limiting vendors to necessary systems and monitoring their activity addresses the weakness, whereas employee-only training or broader access does not.

  1. AThird-party access must be subject to due diligence, restriction and monitoringCorrect
  2. BOnly employees need security awareness training
  3. CContractors should be given broader access to speed up maintenance
  4. DBreach exposure is eliminated by encrypting the retailer's website

Explanation

The attack path ran through a vendor's credentials, so third-party risk management is the relevant lesson: assess vendors' security, limit their access to what is needed and monitor it. Training only employees ignores vendors, and broader access increases exposure.

Did you get it right without looking?

One question tells you little. A timed set on Case Study: Cyberthreats and Information Security Risks shows your real accuracy, how long you take and where you lose marks.

Practise Case Study: Cyberthreats and Information Security RisksFree diagnostic mock

More Case Study: Cyberthreats and Information Security Risks questions