Skip to content

FRM Part II · FRM Exam Part II · Case Study: Cyberthreats and Information Security Risks

A risk manager reviews incident data showing that attackers increasingly compromise a bank's software vendor and use the vendor's trusted update channel to reach many client banks at once. Which implication is most appropriate for the bank's threat assessment?

Third-party and supply-chain dependencies enlarge the attack surface, so they must be included in threat assessment and concentration analysis. A compromised vendor update bypasses perimeter defences and staff training, because the bank trusts the channel by design.

  1. AThe threat is mainly an internal control failure and vendor oversight is not relevant
  2. BOnly perimeter firewall rules need strengthening since the update is encrypted
  3. CThird-party and supply-chain dependencies expand the attack surface and must be included in threat and concentration assessmentCorrect
  4. DThe risk is negligible if the bank's own staff are trained in phishing awareness

Explanation

Supply-chain attacks exploit trust in vendors, so the attack surface extends beyond the bank's own perimeter. Assessment should cover vendor dependencies and concentration. Phishing training and firewalls alone do not address a compromised trusted update.

Did you get it right without looking?

One question tells you little. A timed set on Case Study: Cyberthreats and Information Security Risks shows your real accuracy, how long you take and where you lose marks.

Practise Case Study: Cyberthreats and Information Security RisksFree diagnostic mock

More Case Study: Cyberthreats and Information Security Risks questions