Question 1

Explain the pros and cons of static data masking.

Question 2

Specify at least four major security problems associated with the Cloud Infrastructure-as-a-Service.

Question 3

SQL injection is a common type of attacks to database servers. In 2014, a university in the United

States became a victim of such an SQL injection attack against one of its servers which stored

personal information about students and staff. The attack exploited a vulnerability in the outdated

database server software to steal personal details of about 900 students and staff. The attacker then

contacted the university officials, detailing the breach and making extortion threat. As the university

refused to hand over the credentials, the attacker posted the stolen information on a public website.

Which security goal (Availability/Integrity/Confidentiality) was compromised by this SQL injection

attack? Explain your reasoning.

Suggest three (3) necessary actions that should have been taken by the affected organisation to

prevent such an attack from happening and causing damage. For each action, briefly explain

how it helps.

Question 4

Ransomware attacks are a major data security concern nowadays. In 2016, a ransomware attack

known as Petya targeted at computers running certain vulnerable Windows operating systems. In

this attack, the victim received an email purporting a job application. It directed the victim to a zip

file containing a malicious program which appeared to the victim as a PDF document. Once the

victim allowed this malicious program to be executed at the administrator privilege, the ransomware

encrypted the master file table and this effectively removed all mappings to actual files on the hard

disk. The ransomware then demanded payment from the victim.

Which security goal (Availability/Integrity/Confidentiality) was compromised in this case? Explain

your reasoning.

Suggest three (3) necessary actions that should have been taken by the affected organisations

to address this security threat. For each action, briefly explain how it helps.