PART A (60%)
ANALYSE AN INTERESTING CYBERATTACK OF YOUR CHOOSING
Choose an interesting cyberattack incident that has taken place in the last three years. This
cyberattack could be one you have experienced yourself or one experienced by your
organisation or one you have heard about from other people or in the news or from other
sources.
Describe the chosen cyberattack incident in as much detail as possible:
• Who was the attacker? What was the motivation or goal of the attack?
• What was the breach? What were the losses/gains? Was damage done?
• Whose gain? Whose loss or damage? List all parties that had losses or gains.
• What technique or set of techniques was used at each step in the
breach/attack/damage?
• Where were the security vulnerabilities? Can you distinguish between technical
vulnerabilities and human/organisational vulnerabilities?
• Whose responsibility/fault was it? If the target of the attack was an organisation,
should anyone in the organisation be blamed for the attack?
• Note any relevant psychological aspects (e.g. human error, decision heuristics,
affective factors,…)
• Note any relevant organisational aspects if relevant (e.g. culture, management
style,…)
IMPORTANT: Your answers MUST include explicit pointers to:
− materials covered in the lecture slides and the supplementary materials available in
Moodle
− relevant articles, books and other sources cited in the lecture slides, demonstrating
that you have read and understood the sources
BONUS points if you cite references that go beyond those cited in the lecture slides,
demonstrating that you have read them and that they are relevant to the topic you are
discussing.
PART B (40%)
NEW PHISHING DETECTOR SCENARIO
Imagine that the 4 emails below are being processed by a novel phishing detection tool.
Two of the emails (Email 1 and Email 2) are phishing and the other two (Email 3 and Email 4)
are safe, that is, they are genuine, not phishing.
HOW THE PHISHING DETECTOR WORKS:
Let’s imagine that the way the tool alerts the user to the presence (or absence) of phishing
is the following:
− if the tool identifies Email X as being a phishing email, it will give the following
output: “Email X: phishing email”
− if the tool identifies Email Y as being a safe email, it will give the following output:
“Email Y: safe email
