🔒AP Cybersecurity
1. You are a security analyst investigating a physical security breach in a shared school lab (Room 402). The lab contains a high-end workstation used for sensitive data analysis. Review the provided sources detailing the room layout, access policies, event logs, and incident observations to analyze the vulnerabilities, the attack progression, and the necessary mitigations. All sources are simulated for this practice question.
Supplied evidence:
</>TEXTSource 1: Room Layout & Asset Inventory Room 402 is a shared school lab with a single entry door equipped with an RFID badge reader. A security camera is mounted inside, pointing directly at the entry door. The camera's field of view covers the entrance but leaves a blind spot in the back left corner of the room. In this blind spot sits Workstation WS-Alpha, a high-end desktop computer used for data analysis. WS-Alpha is placed on top of a standard desk. It has four exposed USB ports on the front panel. An external 2TB backup hard drive is connected to the back of the workstation and rests on the desk. Neither the workstation nor the external drive is secured to the desk with physical cables. Source 2: Access Policy & Schedule 1. Authorized Access Hours: Monday through Friday, 08:00 to 18:00. 2. Badge Policy: All individuals must swipe their own authorized RFID badge to enter Room 402. Tailgating or holding the door for others is strictly prohibited. 3. Workstation Policy: Users must lock the workstation screen when leaving it unattended. 4. Clean Desk Policy: All sensitive materials and removable storage media must be secured in locked drawers when not in active use. Source 3: Badge & Door Event Logs (Thursday, October 12) 17:40:00 - Badge Swipe: Alice (Authorized Student) 17:40:02 - Door Sensor: Opened 17:40:08 - Door Sensor: Closed 17:50:15 - Badge Swipe: Dr. Smith (Authorized Faculty) 17:50:17 - Door Sensor: Opened 17:52:10 - Door Sensor: Closed 18:15:00 - Motion Sensor: Movement detected in Room 402 18:30:45 - Door Sensor: Opened (Manual exit from inside) 18:30:50 - Door Sensor: Closed Source 4: Incident Observations (Friday, October 13) At 08:15 on Friday, the lab manager discovered that the 2TB external backup hard drive was missing from WS-Alpha's desk. Additionally, an unknown USB flash drive was found plugged into one of WS-Alpha's front USB ports. A review of the security camera footage from Thursday at 17:50 shows Dr. Smith entering the room while carrying a large, heavy box with both hands. An unidentified individual wearing a hoodie is seen walking through the door immediately behind Dr. Smith without swiping a badge. Because WS-Alpha is in the camera's blind spot, there is no video footage of the workstation itself during the incident.
Based on Source 1, identify one physical vulnerability of Workstation WS-Alpha.
Describe how an adversary could exploit the vulnerability identified in A(i) to compromise the workstation's data confidentiality or integrity.
Explain why the risk level of WS-Alpha's physical placement is increased by the camera's positioning.
Based on the Incident Observations, identify the specific physical attack technique used by the unidentified individual to enter Room 402.
Describe one plausible way Dr. Smith’s situation (carrying a large box) could have made the observed tailgating easier. Do not assume the footage proves the unidentified individual’s intentions.
Cite specific evidence from the Badge & Door Event Logs that corroborates the attack described in B(i).
Identify the first log entry that indicates possible activity outside the authorized access hours.
Explain why the badge swipe log alone cannot definitively prove the identity of the person operating WS-Alpha at 18:15.
Explain why the motion-sensor entry, considered with the access schedule, warrants investigation. State one limitation of this evidence.
Recommend a specific physical security control that could be installed at the entrance of Room 402 to prevent the entry attack identified in Part B.
Recommend a specific physical security control that should be applied directly to WS-Alpha or its peripherals to prevent the theft of the external backup drive.
Identify one specific violation of the Access Policy & Schedule that contributed to the incident.
Recommend a managerial control (e.g., training or procedure) to address the human element of the vulnerability exploited at 17:50.
Explain how securing the backup drive in a locked drawer when it was not in active use could have reduced the risk of its theft.
00:00
