Stretch tasks Cyber Security

Round 1: Quiz Blitz

1. Blagging Blagging invents a scenario to persuade someone to hand over information.
2. Redirecting users to a fake site even when they type the correct address It works by altering DNS or the host file.
3. shouldering Covering the keypad defeats it.
4. A worm A virus needs a file to be opened. A worm spreads by itself.
5. Encrypts the victim's files and demands payment for the key A recent backup is the best defence.
6. False It stops stolen data being read.
7. True The same actions without permission are a crime under the Computer Misuse Act.
8. Phishing; Blagging Social engineering manipulates people rather than technology.
9. It never travels over the network, so the firewall never sees it Removable media goes straight into the computer.
10. Tell a human apart from an automated script It blocks bulk automated attacks.
11. Fixed months earlier in an update never installed Automatic updates close known weaknesses promptly.
12. trojan Named after the wooden horse of the Greek legend.

Round 2: Quick Fire

1. • It targets people rather than technology
   • Once someone hands over a password, firewalls and encryption are bypassed
   Model answer

   Social engineering targets people rather than the technology, persuading staff to give away a password. Firewalls and encryption only stop an attacker who does not have the password, so once it is handed over they are bypassed.

2. • The data is scrambled
   • It cannot be understood without the key
   Model answer

   Encryption scrambles the data on the laptop, so although the thief has the machine, the customer data cannot be read without the key, which makes it useless to them.

3. • A virus attaches to a file and spreads when that file is opened or shared
   • A worm spreads by itself across a network, with no user action
   Model answer

   A virus attaches itself to a file and spreads only when that file is opened or shared. A worm spreads by itself across a network, without needing a user to do anything.

4. • It is authorised by the owner
   • The law only makes unauthorised access an offence, and the aim is to fix weaknesses
   Model answer

   Penetration testing is authorised: the owner gives permission and hires the tester to find weaknesses so they can be fixed. The Computer Misuse Act makes unauthorised access an offence, so the same actions without permission would be a crime.

Round 3: Big Think

1. • The fake emails are phishing
   • A member of staff could reveal a login or click a malicious link
   • Train staff to recognise phishing
   • A password system with two-factor authentication or limited attempts
   • The USB stick could carry malware past the firewall
   • Anti-malware should scan removable media, or USB ports be disabled
   • User access levels limit what one compromised account can reach
   • Automatic updates, and several measures because no single one is enough
   Model answer

   The fake emails are phishing: a member of staff who enters their details or clicks the link could hand an attacker a working login. The company should train staff to recognise phishing, and use a password system with two-factor authentication so a stolen password alone is not enough. The USB stick could carry malware such as ransomware straight past the firewall, because it never crosses the network. Anti-malware software should scan all removable media, and USB ports could be disabled. User access levels should limit what any one compromised account can reach, and automatic updates should close known weaknesses. No single measure is enough, so the company needs several.

2. • A firewall inspects traffic and blocks anything not permitted
   • But a firewall cannot stop a user installing a trojan or using a USB stick
   • Anti-malware scans files against known threats and removes them
   • But a brand new threat may get through
   • Encryption makes stolen data unreadable without the key
   • But encryption does not stop theft or a phished password
   • Each covers a different route in
   • No single measure is enough: defence in depth
   Model answer

   A firewall inspects traffic entering and leaving the network and blocks anything not permitted, but it cannot stop a user who installs a trojan or plugs in an infected USB stick. Anti-malware software scans files against known threats and removes them, but a brand new threat may get through, and it does nothing if a laptop is stolen. Encryption makes stolen data unreadable without the key, but it does not stop the theft, and it does not help if an attacker phishes a password. Each measure covers a different route in, so no single measure is enough: this is defence in depth.

This or That

1. Phishing Phishing sends the fake message. Pharming redirects you even when you type the right address.
2. Pharming Pharming tampers with DNS or the host file, so even a correct address leads to the fake site.
3. A trojan A worm spreads by itself. A trojan relies on the user installing it.
4. User access levels Giving each user only the permissions their role needs limits what one stolen login exposes.
5. Automatic software updates Updates fix known weaknesses promptly. Penetration testing looks for ones nobody has found yet.
6. No: brand new threats can get through It detects known threats, and it does nothing against phishing or a stolen laptop.
7. A biometric measure It uses a physical characteristic, which cannot be guessed or easily shared.
8. No, not without the key Encryption does not stop the theft, but it makes the stolen data useless.

Memory Match

• A 4 Blagging: Inventing a scenario to get information
• B 5 Phishing: Fake messages that trick people into revealing details
• C 6 Pharming: Redirecting a correct address to a fake site
• D 3 Shouldering: Watching someone enter a PIN or password
• E 2 Ransomware: Encrypts files and demands payment for the key
• F 1 Penetration testing: Authorised simulated attacks to find weaknesses

Sort It

1. Defence An authorised simulated attack to find weaknesses That is penetration testing.
2. Malware Spreads across a network with no user action That is a worm.
3. Defence Blocks traffic that is not permitted That is a firewall.
4. Malware Encrypts your files and demands payment That is ransomware.
5. Social engineering A caller pretends to be from IT and asks for a password Blagging: an invented scenario persuades someone to hand over information.
6. Social engineering Your correct web address is redirected to a fake site Pharming: AQA lists it with the social engineering threats.
7. Malware Records your keystrokes and sends them to an attacker That is spyware.
8. Defence Tells a human apart from an automated script That is a CAPTCHA.
9. Social engineering A fake email asks you to confirm your bank details Phishing tricks the person, not the technology.
10. Social engineering Someone watches you type your PIN on a train Shouldering steals the PIN by watching.
11. Defence Uses a fingerprint, which cannot be guessed That is a biometric measure.
12. Malware Looks like a useful free game but hides malicious code That is a trojan: the user installs it willingly.