Examkin

Question

Difficulty: EasyThreat Actors, Attributes, and Attack Vectors

An IT administrator at a manufacturing company discovers that an employee installed an unauthorized third-party cloud storage application on a corporate desktop to transfer large file packages, bypassing corporate security policy. Which threat vector or security risk category best describes this situation?

  1. Shadow ITAnswer
  2. B
    Nation-state threat actor
  3. C
    Hacktivist collective
  4. D
    Supply chain attack vector

Answer

Shadow IT
Shadow IT encompasses any IT resources, cloud applications, or hardware introduced into an enterprise infrastructure without official security authorization. The employee's installation of unvetted cloud software to circumvent file transfer restrictions is a classic example of Shadow IT.

Step-by-Step Solution

1
Analyze the activity described in the scenario.
An internal employee installed unvetted third-party cloud software on a corporate workstation to work around storage limitations.
Understanding who performed the action and whether it was authorized helps categorize the threat vector.
2
Map the observed behavior to standard threat actor and vector definitions.
The unauthorized adoption of technology services by internal personnel is defined as Shadow IT.
Shadow IT creates unmonitored security risks and data exposure vectors because the applications lack security team oversight and compliance checks.

Key Concept

Shadow IT as an Internal Threat Vector
Rate this question

Topics

Threat Actors, Attributes, and Attack Vectors

More questions from this topic