Worked Examples

Learn to analyse security scenarios and recommend appropriate prevention methods

Securing a Small Business Network

Scenario

A small accounting firm with 15 employees handles sensitive financial data for their clients. They have a basic network setup with a router, Wi-Fi access, and file servers. Currently, they have no dedicated security measures beyond the router's built-in firewall. What security measures should they implement?

🔍 Step 1: Identify the Threats

⚠️ Malware: Employees may accidentally download viruses from emails or websites
⚠️ Data theft: Client financial data is valuable to criminals
⚠️ Unauthorised access: Anyone could potentially access the Wi-Fi network
⚠️ Physical theft: Laptops containing data could be stolen
⚠️ Ransomware: Financial firms are often targeted

✅ Step 2: Match Prevention Methods to Threats

Prevention Method	What It Addresses	Priority
Anti-malware software	Protects against viruses, trojans, and ransomware	High
Encryption	Protects data if devices are stolen or communications intercepted	High
Strong password policy	Prevents unauthorised account access	High
User access levels	Limits damage from compromised accounts; not all staff need all data	Medium
Dedicated firewall	Better protection than router firewall; blocks suspicious connections	Medium
Physical security	Secure server room, cable locks for laptops	Medium

📋 Step 3: Recommended Implementation

✓ Install business-grade anti-malware on all computers
✓ Enable full-disk encryption on all laptops and workstations
✓ Use encrypted connections (VPN) for remote access
✓ Implement password policy: minimum 12 characters, complexity requirements
✓ Create user groups: accountants access client files, admin staff don't
✓ Secure the server with a locked cabinet in a restricted area

Key Insight: The firm handles sensitive financial data, so encryption and access controls are particularly important. A breach could result in regulatory penalties and loss of client trust.

Analysing a Security Incident

Scenario

A company discovered that customer data was stolen. Investigation revealed: (1) An employee clicked a phishing link and entered their password on a fake login page. (2) The attacker used these credentials to access the company database remotely. (3) The employee had full administrator access to the database. (4) No encryption was used on the database. What prevention methods failed or were missing?

🔍 Step 1: Trace the Attack Path

Stage	What Happened	What Could Have Prevented It
1. Initial Access	Employee fell for phishing email	User training - recognise phishing attacks
2. Credential Theft	Password entered on fake site	Multi-factor authentication (MFA) - password alone wouldn't be enough
3. Remote Access	Attacker logged in from outside	Firewall rules - restrict database access to internal network or VPN only
4. Data Access	Employee had admin access to database	User access levels - principle of least privilege
5. Data Theft	Data was readable in plain text	Encryption - stolen data would be unreadable

✅ Step 2: Identify Missing Defences

❌ No security awareness training: Employee didn't recognise phishing
❌ No multi-factor authentication: Single password was enough for access
❌ Excessive permissions: Regular employee had database admin access
❌ No network segmentation: Database accessible from internet
❌ No encryption: Data stored in plaintext

📋 Step 3: Remediation Recommendations

✓ Implement mandatory security awareness training for all staff
✓ Enable multi-factor authentication for all accounts
✓ Review and restrict user access levels - minimum necessary permissions
✓ Configure firewall to block external database access
✓ Encrypt sensitive data in the database
✓ Conduct penetration testing to find other vulnerabilities

Key Insight: This breach succeeded because multiple defences were missing. Any single measure (MFA, access controls, encryption, or training) might have prevented the attack or limited its impact. This demonstrates the importance of defence in depth.

Evaluating Prevention Method Effectiveness

Scenario

A school IT manager needs to justify security spending to the headteacher. They want to implement: (A) New anti-malware software, (B) A penetration test, (C) Physical security for the server room. The budget only allows for two of these. Which two should be prioritised?

🔍 Step 1: Evaluate Each Option

Option	What It Protects Against	Limitations
A: Anti-malware	Viruses, trojans, ransomware, spyware - constant, ongoing protection	May not catch brand-new (zero-day) threats
B: Penetration test	Identifies unknown vulnerabilities; one-time assessment	Doesn't provide ongoing protection; needs follow-up to fix issues
C: Physical security	Theft, sabotage, unauthorised physical access to servers	Doesn't protect against remote/network attacks

✅ Step 2: Consider the Context

For a school environment:

📊 High malware risk: Students may visit risky websites, click suspicious links
📊 Moderate physical risk: School is public building with many people
📊 Lower sophisticated attack risk: Schools less likely to be targeted by advanced attacks

📋 Step 3: Recommendation

Prioritise: A (Anti-malware) and C (Physical security)

✓ Anti-malware: Provides constant protection against the most likely threat (accidental malware infection). Schools face daily malware risks from student activity.
✓ Physical security: Many people access the school; servers need protection from theft and tampering. Foundation for all other security.

Penetration testing can be deferred because: The school is less likely to be targeted by sophisticated attackers specifically looking for vulnerabilities. The other two measures address more probable daily threats.

Key Insight: Security decisions should consider the specific context and threat landscape. What's most important for a bank (penetration testing) may be less critical for a school, where everyday malware protection matters more.

Designing Access Control for a Hospital

Scenario

A hospital needs to set up user access levels for their patient records system. Staff roles include: Doctors, Nurses, Receptionists, IT Administrators, and Billing Staff. Design appropriate access levels following the principle of least privilege.

🔍 Step 1: Identify What Each Role Needs

Role	Job Requirements	Data Needed
Doctors	Diagnose, treat, prescribe	Full medical records, test results, treatment history
Nurses	Administer care, record observations	Medical records, medication schedules, observations
Receptionists	Schedule appointments, check in patients	Contact details, appointment schedules only
IT Administrators	Maintain systems, manage accounts	System settings, user accounts (NOT patient data)
Billing Staff	Process payments, insurance claims	Billing codes, insurance details, payment records

✅ Step 2: Design Access Levels

Role	Medical Records	Appointments	Billing	System Admin
Doctors	Read/Write	Read	None	None
Nurses	Read/Limited Write	Read	None	None
Receptionists	None	Read/Write	None	None
IT Admins	None	None	None	Full
Billing	None	Read	Read/Write	None

📋 Step 3: Security Benefits

✓ Patient privacy: Receptionists can't see medical details - only what they need
✓ Limited breach impact: If a receptionist's account is compromised, no medical data exposed
✓ IT separation: IT can maintain systems without accessing sensitive patient data
✓ Compliance: Meets healthcare data protection regulations

Key Insight: The principle of least privilege means each user should have only the minimum access required for their job. This limits damage from both accidental errors and malicious attacks - a compromised account can only access what that role permits.

Practice Problems

Now try analysing these scenarios yourself:

Problem 1: E-commerce Website

An online shop stores customer credit card details and has experienced several data breaches at competitors. What three prevention methods should be their highest priority, and why?

Top 3 priorities:

Encryption: Credit card data must be encrypted both in storage (at rest) and during transmission (in transit). Even if stolen, encrypted data is useless to attackers.
Penetration testing: E-commerce sites are prime targets for SQL injection and other attacks. Regular pen testing finds vulnerabilities before attackers do.
Firewall (application-level): A Web Application Firewall (WAF) can block common attack patterns targeting web applications.

Supporting measures: Strong passwords, user access levels, regular security updates.

Problem 2: Ransomware Protection

A company is particularly worried about ransomware after hearing about attacks on similar businesses. Which prevention methods specifically help against ransomware, and how?

Ransomware-specific protection:

Anti-malware software: Can detect and block known ransomware variants before execution
User access levels: Limits what files ransomware can encrypt (only those the infected user can access)
User training: Most ransomware arrives via phishing - trained users don't click suspicious attachments
Regular backups (offline): Even if encrypted, files can be restored from backups
Firewalls: Can block ransomware's communication with command servers

Note: No single measure stops all ransomware - defence in depth is essential.

Problem 3: Security Audit Findings

A security audit found: (1) 40% of employees use passwords under 8 characters, (2) The server room door is propped open during business hours, (3) Anti-malware definitions are 6 months out of date. Prioritise these issues and explain why.

Priority order:

Update anti-malware (URGENT): Six-month-old definitions miss all recent malware. This is an immediate vulnerability that could result in infection at any moment.
Physical security (HIGH): An open server room allows anyone to access, steal, or damage critical equipment. Easy fix with significant risk reduction.
Password policy (MEDIUM): Weak passwords are a vulnerability, but exploiting them typically requires additional attack steps. Implement policy and give users time to change passwords.

Reasoning: Outdated anti-malware is an active, exploitable vulnerability right now. Physical security is a quick fix. Passwords are important but require user behaviour change.