Data Security, Integrity and Ethics: Question 4

Worked solution

Part (a): Naming the attack and reducing the risk

This is an example of phishing: a deceptive email, disguised as coming from a trusted organisation (the bank), tries to trick the recipient into clicking a link to a fake website and entering their genuine login details there.

It is phishing rather than pharming, because the attack depends on the user being fooled into clicking a link in the email; pharming instead redirects a user to a fake site automatically (for example, by corrupting DNS records), with no link-click needed.

To reduce the risk, TaxWise could train staff to recognise phishing attempts, checking the sender’s actual email address and the website’s URL/security certificate before entering any details, and never following a link in an unexpected email to a login page. (Other acceptable measures: spam/phishing email filters, or two-factor authentication so a stolen password alone cannot be used to log in.)

[2 marks]: [1] for correctly naming phishing, [1] for a valid, relevant countermeasure that addresses this specific attack.

Part (b): Encryption at rest vs encryption in transit

Encryption at rest applies to data while it is stored, for example, on a hard disk or server. It scrambles the stored data so that if someone gains unauthorised physical or network access to the storage device, they cannot read its contents without the correct decryption key.

Encryption in transit applies to data while it is being transmitted from one place to another across a network. It scrambles the data for the duration of the transfer, so that if it is intercepted while travelling (for example, over the internet), it cannot be read without the decryption key.

Applying this to TaxWise’s situation:

• (i) The financial records stored on the office server are not moving anywhere, they need encryption at rest to protect them while stored.
• (ii) A document being emailed to a client is being transmitted across the internet. It needs encryption in transit to protect it during that transfer.

[3 marks]: [1] for a correct definition of encryption at rest, [1] for a correct definition of encryption in transit, [1] for correctly matching (i) to at-rest and (ii) to in-transit.

Part (c): Restricting access once inside the network

A method other than encryption is access rights (permissions). TaxWise can create separate user accounts for members of staff and assign each account a specific level of access to files on the server. Only accounts belonging to authorised staff (for example, the partners) would be given permission to open the financial records; other staff accounts would have that permission denied, even though they are legitimately connected to the same network.

This works alongside authentication: a member of staff must log in with a username and password (or other credential) so the system knows which account is being used, and can then apply that account’s specific access rights to decide whether the financial records can be opened.

[2 marks]: [1] for naming access rights/permissions as a distinct method from encryption, [1] for explaining how restricting which accounts may open the specific files prevents an unauthorised network user from reading them.

Final answers

• (a) Phishing; countermeasure, staff training to check senders/URLs before entering login details (or phishing filters / two-factor authentication).
• (b) At rest = encryption of stored data (protects the server’s records); in transit = encryption of data being transmitted (protects the emailed document).
• (c) Access rights/permissions, restricting which authenticated user accounts are allowed to open the financial records.