Thanks to visit codestin.com
Credit goes to www.scribd.com

Scribd
Upload
15 views2 pages

Assignment 1

MIS 300

Uploaded by

Faheem Paracha
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as DOCX, PDF, TXT or read online on Scribd
15 views2 pages

Assignment 1

MIS 300

Uploaded by

Faheem Paracha
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as DOCX, PDF, TXT or read online on Scribd
You are on page 1/ 2

Insider Attack Scenario

Insider Threat via Student Worker


 Attack Description:
A student worker at Rocky Summit University (RSU) exploits their system access to manipulate
grades and tuition records.
 Attack Steps:
1. Gaining Access: The student worker is granted limited administrative privileges as part
of their job.
2. Privilege Escalation: Exploits misconfigured access controls to increase privileges.
3. Data Manipulation: Alters grades and adjusts tuition records for personal benefit.
4. Covering Tracks: Deletes log files and creates fake accounts for future access.
 Assumptions:
o Access controls are misconfigured, allowing privilege escalation.
o Logging mechanisms are inadequate for detecting unauthorized changes.
External Attack Scenario:
Phishing and VPN Exploitation
 Attack Description:
A remote attacker targets RSU employees and students through phishing emails to steal
credentials and access the internal network via the VPN.
 Attack Steps:
1. Reconnaissance: Attacker collects email addresses from public sources.
2. Phishing Attack: Sends emails impersonating RSU’s IT department to trick users into
providing credentials.
3. VPN Exploitation: Uses stolen credentials to access RSU’s internal network.
4. Privilege Escalation & Data Exfiltration: Exploits system vulnerabilities to obtain
administrative rights and extract sensitive student and faculty data.
5. Covering Tracks: Deletes logs to avoid detection.
 Assumptions:
o VPN access is based solely on username and password without Multi-Factor
Authentication (MFA).
o Users are not adequately trained to recognize phishing attempts.
Combined Countermeasures:
1. Security Policy:
o Mandatory Multi-Factor Authentication (MFA): Enforce MFA for all remote access to
prevent unauthorized logins.
2. Management Action:
o Security Awareness Training: Conduct regular training sessions to help students and
staff recognize phishing attempts and understand insider threats.
3. Technical Options:
o Role-Based Access Control (RBAC): Limit access permissions based on job roles,
minimizing privilege misuse.
o Intrusion Detection Systems (IDS): Monitor network traffic for unusual activity to detect
unauthorized access and data exfiltration attempts.
o Audit Logging and Monitoring: Implement comprehensive logging and monitoring to
detect suspicious activities, including privilege escalation and data manipulation.
Rationale:
 MFA prevents unauthorized VPN access even if credentials are compromised.
 Security Awareness Training reduces the likelihood of successful phishing attacks.
 RBAC and IDS limit access and detect abnormal behavior, reducing the risk of both insider and
external threats.
 Audit Logging enhances traceability and accountability, allowing quick response to suspicious
activities.

You might also like