A multinational financial services firm discovers an unauthorized third-party file synchronization application installed across several workstations in the accounting department. The application was introduced by employees seeking to bypass internal network latency when sharing large spreadsheets with external auditors. While analyzing the traffic, security operations identifies that the external cloud server receiving the synchronized financial data was compromised three days prior by a ransomware syndicate, exposing corporate credentials and confidential records. Which of the following best categorizes the primary attack vector utilized and the threat actor attribute responsible for the initial vulnerability?
- The primary attack vector is Shadow IT, created by internal staff acting without malicious intent but lacking authorization.Answer
- BThe primary attack vector is a malicious insider threat operating with sophisticated nation-state financial backing.
- CThe primary attack vector is a hardware supply chain interdiction implemented via network perimeter firewall failure.
- DThe primary attack vector is a direct wireless access intrusion targeting local endpoint cryptographic controls.
Answer
The initial vulnerability was created through Shadow IT, where internal employees deployed unsanctioned third-party software to circumvent operational inefficiency without malicious intent.
The scenario describes employees installing unauthorized third-party software to solve a practical business challenge (network latency). This unsanctioned use of technology outside formal IT management and oversight defines Shadow IT, which introduced an unveted attack vector that external threat actors exploited.
Step-by-Step Solution
Key Concept
Threat Actors, Attributes, and Attack Vectors