Security Self-Test: Questions and Scenarios

Security Self-Test: Questions and Scenarios

Scenario #1:

Your supervisor is very busy and asks you to log into the HR Server using her UCMNetId and password to retrieve some reports. What should you do?

  1. It's your boss, so it's okay to do this.
  2. Ignore the request and hope she forgets.
  3. Decline the request and remind your supervisor that it is against UC policy.

Answer #1:

C - Decline the request and remind your supervisor that it is against UC policy.
Passwords must not be shared. If pressured further, report the situation to HR. If you have questions, contact infosecurity@ucmerced.edu.

Scenario #2:

You receive an e-mail with an attachment from "I.T. Security." The e-mail says that your computer has been infected with a virus and you need to open the attachment and follow the directions to get rid of the virus. What should you do? (Select all that apply)

  1. Follow the instructions ASAP to avoid the virus.
  2. Open the e-mail attachment to see what it says.
  3. Reply to the sender and say "take me off this list".
  4. Delete the message from the unknown source.
  5. Contact the IT Help Desk and ask about the email.

Answer #2:

D or E
Attachments can contain viruses and other malicious programs that can infect your computer, so opening or clicking on an unexpected or unknown attachment is very risky.
If you can tell that this is spam, delete the E-mail message. If you are unsure about whether you should open the attachment, contact the IT Help Desk (228-HELP) for further instructions. As a general rule, don't open, reply to, or forward suspicious e-mails or attachments.

Scenario #3:

Your sister sends you an e-mail at work with a screen saver she says you would love. What should you do? (Select all that apply)

  1. Download it onto your computer, since it's from a trusted source.
  2. Forward the message to other friends to share it.
  3. Call IT and ask them to help install it for you.
  4. Delete the message.

 

Answer #3:

D - Delete the message
This one has four big risks:

  1. Some screen savers contain viruses or other malicious programs, so just in general, it's risky to put unknown or unsolicited programs or software on your computer.
  2. Also, in some cases just clicking on a malicious link can infect a computer, so unless you are sure a link is safe, don't click on it.
  3. Email addresses can be faked, so just because the email says it is from someone you know, you can't be certain of this without checking.
  4. Finally, some websites and links look legitimate, but they're really hoaxes designed to steal your information.

Scenario #4:

Which workstation security safeguards are YOU responsible for following and/or protecting? (Select all that apply)

  1. User I.D.
  2. Password
  3. Log-off programs
  4. Lock-up office or work area (doors, windows)
  5. All of the above

Answer #4:

E - All of the above.

Scenario #5:

Real-life Scenario:
One of the staff members in IT subscribes to a number of free magazines. Among the questions she was asked in order to activate her subscriptions, one magazine asked for her month of birth, a second asked for her year of birth, and a third asked for her mother's maiden name.
Question: What do you think might be going on here?

Answer #5:

Possible answer:
All three newsletters probably have the same parent company or are distributed through the same service. The parent company or service can combine individual pieces of seemingly-harmless information and use or sell it for identity theft. It is even possible that there is a fourth newsletter that asks for day of birth as one of the activation questions.
Note: Often questions about personal information are optional. In addition to being suspicious about situations like the one described here, never provide personal information when it is not legitimately necessary.

Scenario #6:

Real-life Scenario:
We saw a case a while back where someone used their yahoo account at a lab on campus. She made sure her yahoo account was no longer open in the browser window before leaving the lab. Someone came in behind her and used the same browser to re-access her account. They started sending emails from it and caused all sorts of mayhem.
Question: What do you think might be going on here?

Answer #6:

Possible answers:
The first person probably didn't log out of her account, so the new person could just go through the browser history and access her account.
Another possibility is that she did log out, but didn't clear her web cache. (This is done through the browser menu to clear pages that the browser has saved for future use.)

Scenario #7:

Two different offices on campus are working to straighten out an error in an employee's bank account due to a direct deposit mistake. Office #1 emails the correct account and deposit information to office #2, which promptly fixes the problem. The employee confirms with the bank that everything has, indeed, been straightened out.
Question: What's wrong here?

Answer #7:

Account and deposit information is sensitive data that could be used for identity theft. Sending this or any kind of sensitive information by email is very risky because email is typically not private or secure. Anyone who knows how can access it anywhere along its route.
As an alternative, the two offices could have called each other or worked with their computing people to send the information a more secure way.

Scenario #8:

Real-life Scenario:
In our computing labs and departments, print billing is often tied to the user's login. People login, they print, they (or their department) get a bill. Sometimes people call to complain about bills for printing they never did only to find out that the bills are, indeed, correct.
Question: What do you think might be going on here?

Answer #8:

Possible answer:
Sometimes they realize they loaned their account to a friend who couldn't remember his/her password, and the other person printed. Thus the charges. It's also possible that somebody came in behind them and used their account.
This is an issue with shared or public computers in general. If you don't log out of the computer properly when you leave, someone else can come in behind you and retrieve what you were doing, use your accounts, etc. Always log out of all accounts, quit programs, close browser windows before you walk away.

Scenario #9:

The mouse on your computer screen starts to move around on its own and click on things on your desktop. What do you do? (Select all that apply)

  1. Call your co-workers over so they can see.
  2. Disconnect your computer from the network.
  3. Unplug your mouse.
  4. Tell your supervisor.
  5. Turn your computer off.
  6. Run anti-virus.
  7. All of the above.

Answer #9:

B & D.
This is definitely suspicious. Immediately report the problem to your supervisor and the IT Help Desk.
Also, since it seems possible that someone is controlling the computer remotely, it is best if you can disconnect the computer from the network (and turn off wireless if you have it) until help arrives. If possible, do not turn off the computer.

Scenario #10:

You receive an email from your bank telling you there is a problem with your account. The email provides instructions and a link so you can log in to your account and fix the problem. What should you do?

Answer #10

Any unsolicited email or phone call asking you to disclose your password, financial account information, social security number, or other personal or private information is suspicious – even if it appears to be from a company you are familiar with. Always contact the sender using a method you know is legitimate to verify that the message is from them.

Scenario #11

A while back, the IT folks got a number of complaints that one of our campus computers was sending out Spam. They checked it out, and the reports were true: a hacker had installed a program on the computer that made it automatically send out tons of spam email without the computer owner's knowledge.
Q: How do you think the hacker got into the computer to set this up?

Answer #11

This was actually the result of a hacked password. Using cryptic passwords that cannot be easily guessed, and protecting your passwords by not sharing them or writing them down can help to prevent this. Passwords should be at least 8 characters in length and use a mixture of upper and lower case letters, numbers, and symbols.
Even though in this case it was a hacked password, other things that could possibly lead to this are:

  • Out of date patches
  • No anti-virus software or out of date anti-virus software
  • Clicking an unknown link or attachment
  • Downloading unknown or unsolicited programs on to your computer

Return to Security Awareness Training website

Looking for help?

We offer a number of tutorials and FAQs available in the Guides & FAQs section.
If you have any questions, problems, or comments, please contact the IT Help Desk via email at helpdesk@ucmerced.edu, via phone at 209.228.HELP (4357), or visit them in the Classroom and Office Building room 132A.