Skip to content

FRM Part II · FRM Exam Part II · Case Study: Cyberthreats and Information Security Risks

After a ransomware incident, a bank finds that attackers first sent employees emails mimicking an internal HR notice, harvested credentials, and then moved laterally to encrypt servers. Which element represents the initial attack vector?

The initial attack vector was the phishing emails that harvested employee credentials. This is how attackers first gained access. Lateral movement, server encryption and the ransom demand occurred afterwards in the attack chain, so they are subsequent stages rather than the entry point.

  1. APhishing emails used to obtain credentialsCorrect
  2. BLateral movement across the network
  3. CEncryption of servers
  4. DRansom demand payment

Explanation

The initial vector is how the attacker first gains access, here phishing that harvested credentials. Lateral movement and encryption are later stages, and ransom payment is a post-impact event. Mitigating the vector implies awareness training and multifactor authentication.

Did you get it right without looking?

One question tells you little. A timed set on Case Study: Cyberthreats and Information Security Risks shows your real accuracy, how long you take and where you lose marks.

Practise Case Study: Cyberthreats and Information Security RisksFree diagnostic mock

More Case Study: Cyberthreats and Information Security Risks questions