ITPEC FE Subject B April 2025 Question 17

The attack has two distinct phases:

Phase 1 — Social engineering:
The attacker called a receptionist and manipulated them into revealing personal information about an IT staff member (Mr. Z). This is a classic social engineering attack targeting human vulnerabilities, not technical ones.

• •Countermeasure: education for the employees against social engineering — train staff to recognize and resist manipulation tactics.

Phase 2 — Brute-force / dictionary attack:
The attacker gathered information from social media and other sources, then created a password list and used it along with the server's IP address to remotely attack the server. This describes a password-based attack (dictionary or brute-force).

• •Countermeasure: implement account lock for consecutive incorrect password attempts — this directly prevents automated password guessing by locking accounts after repeated failures.

Why not others:
- (a/b/c) "Abolition of company-wide telephone use" is disproportionate and does not address the root cause — the problem is untrained employees, not the existence of telephones
- (d) HTTPS encrypts data in transit but does not prevent password brute-forcing on a login form
- (f) Prohibiting social networking does not stop attackers from finding information through other public sources
- (g/h/i) IP-based block lists address network access control, not the social engineering or password attack vectors described

Key rule: match each countermeasure to the specific attack vector — human manipulation needs awareness training; password attacks need login attempt throttling.

AI-generated — may contain errors