Worked example 1
A college stores sensitive student data, including addresses and grades, on its network. Identify two distinct types of security threat the college faces and, for each threat, describe a specific measure to help prevent it. [4 marks]
Show solution outline
A good answer will identify a threat and link it to a specific, appropriate countermeasure.
Threat 1: Phishing attack targeting staff members. [1] An attacker could send an email pretending to be from the IT department, asking staff to 'verify' their login details on a fake website, thereby stealing their credentials.
Prevention 1: Implement regular staff training. [1] Educate staff on how to identify phishing emails (e.g., checking sender addresses, looking for poor grammar, hovering over links before clicking) and establish a clear policy for reporting suspicious emails.
Threat 2: A student introducing a virus via a USB stick. [1] A student could unknowingly bring a virus-infected USB from home and plug it into a college computer, allowing the malware to spread across the network.
Prevention 2: Implement a device control policy and use anti-virus software. [1] Configure college computers to automatically scan any removable media for malware upon connection. Alternatively, disable USB ports on non-essential computers and provide a secure method for file transfer.