Scenario1

Imagine you're part of the IT department at a university, tasked with securing sensitive biotechnology research. One day, a researcher receives an email from what appears to be the IT department, asking them to reset their password due to a new security policy. The researcher is busy, sees the university logo in the email, and clicks the link. What they don’t know is that the email was a phishing attempt designed to steal their login credentials.

The University Breach

Multiple Choice

What should the researcher have done?

• Click the link and reset the password as instructed.

• Ignore the email completely.

• Contact the IT department to confirm the email’s legitimacy.

• Forward the email to colleagues to warn them.

The researcher unknowingly provides their login credentials to the attacker. A few days later, sensitive data related to biotechnology research is accessed and leaked online. This leads to a media scandal, jeopardizing ongoing research and funding.

Multiple Choice

How could the attacker have gained access?

• By hacking the university’s servers directly.

• By exploiting weaknesses in the researcher’s personal email.

• By tricking the researcher through a social engineering attack.

• By sending malicious software.

After the breach, the university tightens its security, but six months later, another attack occurs. This time, the attacker poses as a vendor providing software updates. They convince an administrative assistant to download a program that contains malware, which gives the attacker control over a department’s computers.

Multiple Choice

What should have been done to prevent this?

• Always trust known vendors without verification.

• Ensure software updates only come through official channels.

• Allow only the IT department to handle installations.

• Download and scan the software after installation.

The attacker now has access to more critical data, including student records and sensitive biotechnology research. They sell this information to a foreign entity, causing an international scandal.

Multiple Choice

What could be the university’s last line of defense?

• Increase trust in external vendors.

• Develop stricter policies and ensure regular employee training on security awareness.

• Avoid dealing with international partners.

• Have IT personnel monitor all email communications.