Homework 3

1. Writing: Write an argumentative report discussing the information depicted in the pie
charts above. Use the suggested template below. Take note of the template and work within
the suggested subheadings for each Report entry. Fill in the gaps with:
- correlations between the evolution of technology and demographics, social
phenomena, political unrest etc;
-speculations about possible triggering factors;
- opinions based on your experience.

Writing a Report Title: Evolution of Global Cyber Security Attacks 2014-2019

From: Michael
To: Andrew
Date: 12th of October

Aim: The purpose of this report is to analyze the available data regarding security attacks …

Additionally, we aim at providing interpretation for the observed evolution and potentially
speculate on what measures should be taken to…..

Data Analysis
The pie charts illustrate the evolution of global cybersecurity attacks from 2014 to 2019, capturing
changes in the types and frequencies of cyberattacks over this period. From these charts, we observe
significant trends that align with the rapid technological evolution, demographic changes, and social
and political shifts occurring globally during these years. This report discusses the correlations
between these cyber-attack trends and various social phenomena, speculates on potential triggering
factors, and provides insights based on personal and professional experience.

Data Interpretation
The data highlights a notable shift in the types of cyberattacks over the five-year period. Early
in this period, traditional attacks like phishing, denial-of-service (DoS) attacks, and malware
dominated the landscape. However, by 2019, more sophisticated attacks, including
ransomware and advanced persistent threats (APTs), had surged, while older attack types,
such as basic phishing schemes, had declined in relative frequency.

Speculations about the Future

1
 The data also suggests that demographic and social changes may have influenced cybersecurity
threats. With the rapid increase in internet accessibility and the growth of online populations,
particularly in emerging markets, the pool of potential targets has expanded. For instance, phishing
attacks and malware propagation became highly effective as more people entered the digital world,
some with limited cybersecurity knowledge. This was especially evident in attacks targeting mobile
devices, which increased as smartphone use became nearly universal by 2019.

Suggestions/Recommendations
Multiple factors likely triggered the evolution in cyberattack types observed from 2014 to 2019. One
significant catalyst is the surge in geopolitical tensions, with nation-states increasingly investing in
cyber-espionage and cyber-warfare capabilities. During this period, several large-scale cyber
incidents were attributed to nation-states, including targeted APTs against critical infrastructure and
government systems. The growth of APTs observed in 2019 may reflect these developments, as
state-sponsored groups pursued more sophisticated attacks with specific political and economic
motives.

Conclusion(s)
The evolution of global cybersecurity attacks from 2014 to 2019 reflects the rapid changes in
technology, societal behaviors, and global political climates. As cyber threats have evolved in
complexity and scale, they expose critical vulnerabilities within both digital infrastructure and
human behavior. The increase in advanced attacks, particularly ransomware and APTs,
reveals a cybersecurity landscape where attackers continuously adapt to the latest
technologies and exploit emerging societal trends. Understanding these shifts and maintaining
vigilance against future developments in attack methods is essential for strengthening our
defenses against the ever-evolving landscape of cyber threats.

2. Reading and Speaking:

2
a. Read the following top 10 ranking of hacking typologies retrieved from
[Link]
b. Assign a different number to each item if you disagree with the ranking. Refer to how
frequent and how damaging each type is. Support your choice with arguments.
c. Compare and contrast 2 types of your choice.

Short Bytes: Using simple hacks, a hacker can know about your personal unauthorized
information which you might not want to reveal. Knowing about these common hacking
techniques like phishing, DDoS, clickjacking etc., could come handy for your personal safety.
Unethical hacking can be called an illegal activity to get unauthorized information by
modifying a system’s features and exploiting its loopholes. In this world where most of the
things happen online, hacking provides wider opportunities for the hackers to gain
unauthorized access to the unclassified information like credit card details, email account
details, and other personal information. So, it is also important to know some of the hacking
techniques that are commonly used to get your personal information in an unauthorized way.

Keylogger Phishing

Keylogger is a simple software that records Phishing is a hacking technique using which
the key sequence and strokes of your a hacker replicates the most-accessed sites
keyboard into a log file on your machine. and traps the victim by sending that spoofed
These log files might even contain your link. Combined with social engineering, it
personal email IDs and passwords. Also becomes one of the most commonly used and
known as keyboard capturing, it can be either deadliest attack vectors. Once the victim tries
software or hardware. While software-based to login or enters some data, the hacker gets
keyloggers target the programs installed on a that private information of the target victim
computer, hardware devices target keyboards, using the trojan running on the fake site.
electromagnetic emissions, smartphone Phishing via iCloud and Gmail account was
sensors, etc. Keylogger is one of the main the attack route taken by hackers who
reasons why online banking sites give you an targeted the “Fappening” leak, which
option to use their virtual keyboards. So, involved numerous Hollywood female
whenever you’re operating a computer in celebrities.
public setting, try to take extra caution.
Virus, Trojan etc.
Denial of Service (DoS\DDoS)
Virus or trojans are malicious software
A Denial of Service attack is a hacking programs which get installed into the
technique to take down a site or server by victim’s system and keeps sending the
flooding that site or server with a lot of traffic victims data to the hacker. They can also lock
that the server is unable to process all the your files, serve fraud advertisement, divert
requests in the real time and finally crashes traffic, sniff your data, or spread on all the
down. This popular technique, the attacker computer connected to your network.
floods the targeted machine with tons of

3
requests to overwhelm the resources, which, ClickJacking Attacks
in turn, restrict the actual requests from being
fulfilled. For DDoS attacks, hackers often ClickJacking is also known by a different
deploy botnets or zombie computers which name, UI Redress. In this attack, the hacker
have got the only work to flood your system hides the actual UI where the victim is
with request packets. With each passing year, supposed to click. This behaviour is very
as the malware and types of hackers keep common in app download, movie streaming,
getting advanced, the size of DDoS attacks and torrent websites. While they mostly
keeps increasing. employ this technique to earn advertising
dollars, others can use it to steal your
Waterhole attacks personal information. In another word, in this
type of hacking, the attacker hijacks the
If you are a big fan of Discovery or National clicks of the victim that aren’t meant for the
Geographic channels, you could relate easily exact page, but for a page where the hacker
with the waterhole attacks. To poison a place, wants you to be. It works by fooling an
in this case, the hacker hits the most internet user into performing an undesired
accessible physical point of the victim. For action by clicking on hidden link.
example, if the source of a river is poisoned,
it will hit the entire stretch of animals during Cookie theft
summer. In the same way, hackers target the
most accessed physical location to attack the The cookies of a browser keep our personal
victim. That point could be a coffee shop, a data such as browsing history, username, and
cafeteria, etc. Once hackers are aware of your passwords for different sites that we access.
timings, using this type of hacking, they Once the hacker gets the access to your
might create a fake Wi-Fi access point and cookie, he can even authenticate himself as
modify your most visited website to redirect you on a browser. A popular method to carry
them to you to get your personal information. out this attack is to encourage a user’s IP
As this attack collects information on a user packets to pass through attacker’s machine.
from a specific place, detecting the attacker is Also known as SideJacking or Session
even harder. One of the best ways to protect Hijacking, this attack is easy to carry out if
yourself again such types of hacking attacks the user is not using SSL (https) for the
is to follow basic security practices and keep complete session. On the websites where you
your software/OS updated. enter your password and banking details, it’s
of utmost importance for them to make their
Fake WAP connections encrypted.

Even just for fun, a hacker can use software Bait and switch
to fake a wireless access point. This WAP
connects to the official public place WAP. Using bait and switch hacking technique, an
Once you get connected the fake WAP, a attacker can buy advertising spaces on the
hacker can access your data, just like in the websites. Later, when a user clicks on the ad,
above case. It’s one of the easier hacks to he might get directed to a page that’s infected
accomplish and one just needs a simple with malware. This way, they can further
software and wireless network. Anyone can install malware or adware on your computer.
name their WAP as some legit name like The ads and download links shown in this

4
“Heathrow Airport WiFi” or “Starbucks technique are very attractive and users are
WiFi” and start spying on you. One of the expected to end up clicking on the same. The
best ways to protect yourself from such hacker can run a malicious program which
attacks is using a quality VPN service. the user believes to be authentic. This way,
after installing the malicious program on
Eavesdropping (Passive Attacks) your computer, the hacker gets unprivileged
access to your computer.
Unlike other attacks which are active in
nature, using a passive attack, a hacker just
monitors the computer systems and networks
to gain some unwanted information. The
motive behind eavesdropping is not to harm
the system but to get some information
without being identified. These types of
hackers can target email, instant messaging
services, phone calls, web browsing, and
other methods of communication. Those who
indulge in such activities are generally black
hat hackers, government agencies, etc.

Compare and contrast 2 types of hacking attacks

3. Match the collocations extracted from the text:

1. to exploit a. out

2. to gain b. loopholes

3. strokes [Link] access point

4. to target [Link]’s data

5. to fake c. with traffic

6. to access d. botnets

7. unprivileged e. importance

8. to indulge f. means of communication

9. to deploy [Link]

5
 10. of utmost [Link] the keyboard

11. to flood g. in such activities

12. to carry h. access

4. Writing: Write an opinion essay discussing the key differences between intentionally
malicious hacking, on the one hand and harmless hacking, on the other. Refer to:

TYPES OF HACKERS AND WHAT THEY DO: WHITE-HAT, BLACK-HAT AND GREY-HAT
HACKERS

The Ethics and Implications of Hacking: Differentiating Malicious and Harmless Practices

In today’s digital age, hacking is a complex and multifaceted concept, often painted in stark
shades of good and evil. While hacking can evoke images of cybercriminals, this image is
incomplete. Not all hacking is harmful, and within the hacking community, intentions can vary
widely. The crucial difference between malicious and harmless hacking lies in intent and legality.
To understand this distinction, we must consider the three primary types of hackers—white-hat,
black-hat, and grey-hat hackers—each operating with different intentions and ethics.

White-Hat Hackers: Guardians of Cybersecurity

White-hat hackers, also known as "ethical hackers," represent the positive side of hacking. These
individuals possess advanced technical skills, but they use these skills to improve security and
protect systems rather than to exploit them. Their primary objective is to safeguard information
and prevent cyber-attacks by identifying and fixing vulnerabilities before they can be abused by
malicious actors. White-hats are frequently employed by companies or government agencies to
perform "penetration testing"—a simulated attack on a system to test its defenses. They receive
legal authorization to identify weak points in security, thereby preventing potential breaches.

6
The contributions of white-hat hackers are invaluable, particularly in a time when cyber threats
are rapidly evolving. For instance, in 2021, an ethical hacker discovered a significant
vulnerability in Apple’s iCloud platform that could have allowed hackers to access sensitive user
data. Instead of exploiting this weakness, the hacker reported it to Apple, which then rewarded
him financially and patched the vulnerability. This example illustrates how white-hats contribute
to a safer internet, reinforcing the notion that hacking, when done ethically and with permission,
can be a force for good.

Black-Hat Hackers: The Threats to Cybersecurity

Black-hat hackers, in stark contrast, operate outside the law and ethical boundaries, driven by
malicious or self-serving motives. Unlike white-hat hackers, black-hats actively seek to infiltrate
systems without permission, typically for financial gain, espionage, or simply to cause disruption.
Their methods range from phishing attacks and malware distribution to more sophisticated tactics
like ransomware, which has become alarmingly common in recent years.

A notorious example of black-hat hacking was the WannaCry ransomware attack in 2017. This
attack, attributed to black-hat hackers, affected over 200,000 computers in 150 countries,
targeting a vulnerability in Microsoft Windows. The attackers demanded ransom payments in
cryptocurrency, causing widespread damage to businesses, healthcare systems, and individuals
who were unable to access their data. Black-hat hacking is characterized by its destructive nature
and the lack of regard for legal or ethical norms, leading to potentially catastrophic consequences
for businesses, governments, and private individuals alike.

The ethics of black-hat hacking are universally condemned, and law enforcement agencies
worldwide have increased efforts to track and apprehend these cybercriminals. Unlike white-hats,
black-hats operate with the intent to exploit weaknesses for personal benefit or harm, with little to
no regard for the broader consequences.

Grey-Hat Hackers: The Ambiguous Middle Ground

The realm of grey-hat hacking exists in a murky space between white-hat and black-hat practices.
Grey-hat hackers might discover and exploit security flaws in a system, often without permission,
but with no malicious intent. Instead, their aim is often to raise awareness of vulnerabilities or
demonstrate their technical skills. While they might notify a company about a flaw, they typically
act without permission, which technically classifies their actions as illegal. Grey-hats blur the

7
lines of ethical and legal boundaries, leading to controversy and divided opinions about the value
and legitimacy of their actions.

For instance, in 2013, a grey-hat hacker discovered a vulnerability in Facebook’s security

systems that allowed users to post on anyone’s timeline without permission. Despite his noble
intent, he failed to gain authorized access to Facebook’s systems, making his actions illegal.
Facebook initially disregarded his report, but when he demonstrated the flaw by posting on the
profile of Mark Zuckerberg himself, the vulnerability was taken seriously. However, the hacker
was ultimately banned from Facebook’s bug bounty program due to his unapproved approach.
Grey-hats, like this hacker, often expose weaknesses that might otherwise go unnoticed, but their
disregard for permission places them in ethically gray territory.

Differentiating Malicious and Harmless Hacking

The key differences between malicious and harmless hacking are rooted in both intention and
adherence to legal standards. White-hat hackers are considered harmless because they operate
with consent, focusing on prevention and security enhancement. Grey-hat hackers operate in a
middle ground, as their actions may benefit cybersecurity but typically lack proper authorization.
Black-hat hackers, conversely, are inherently malicious, often aiming to exploit, damage, or
profit illegally from security flaws.

The lines between these hacking types can blur. A grey-hat hacker may have benign intentions
but inadvertently cause harm, while a black-hat hacker may believe their actions are justified by
some higher moral code. Nonetheless, the impact on society, businesses, and individuals remains
the benchmark by which hacking is often judged. Hacking that seeks to protect systems,
performed with consent and accountability, is widely regarded as ethical, while hacking that
disregards consent or legalities is seen as a threat.

Conclusion
In summary, the ethical landscape of hacking is complex and diverse, shaped by the intentions,
actions, and consequences of different hacker types. White-hat hackers play an essential role in
strengthening cybersecurity, acting as guardians who help prevent harmful breaches. Grey-hat
hackers, though often well-meaning, straddle the line of legality, contributing to security at the
cost of ethical ambiguity. Black-hat hackers embody the dangers of hacking when wielded as a
weapon, disregarding ethics and legality in pursuit of personal gain or harm.

8
Ultimately, hacking cannot be judged in absolute terms. The difference between malicious and
harmless hacking lies in the intentions behind the act, the ethical principles upheld, and the
impacts on those affected. As technology advances, the need for ethical hacking becomes more
pressing, highlighting the role of hackers as either protectors or threats to society. By fostering a
culture of responsible hacking, we can better navigate the challenges of cybersecurity in a rapidly
evolving digital world.
Writing: Write an opinion essay based on your personal experience with computer security
entitled: Viral Protection Requires No Antibiotics.

Viral Protection Requires No Antibiotics: An Exploration of Modern Computer Security

The phrase "Viral Protection Requires No Antibiotics" might sound unusual at first. After all,
we tend to think of "viruses" as medical threats. Yet, in the digital realm, computer viruses—
malicious programs designed to infect, replicate, and spread—are a formidable threat
requiring protection strategies just as much as their biological counterparts. As someone who
has spent significant time managing computer security, I’ve seen firsthand that effective
protection against digital viruses doesn't involve pharmaceuticals but relies on robust,
proactive digital practices.

The Nature of Digital Viruses

Digital viruses share much with biological viruses in terms of behavior. Both are relentless in
seeking hosts, and both spread by taking advantage of vulnerabilities. A computer virus, like
a biological one, can hijack its host, often using it to replicate and spread to other systems,
causing damage to files, data, and even hardware in extreme cases. For those without a basic
understanding of computer security, digital viruses can be devastating. My first experience
with a virus came as a rude awakening when, years ago, I inadvertently downloaded a
malicious file that infected my entire system, corrupting precious files and compromising
sensitive data. It was an experience that not only made me wary but also highlighted the
critical need for a preventative approach to cybersecurity.

The Importance of Prevention

After that initial encounter, I realized that one of the most important principles in computer
security is prevention. Unlike biological viruses, which might be fought off by the immune
system or treated with antibiotics, digital viruses cannot be "cured" without directly
addressing the underlying vulnerability in the system. A reliable antivirus program is
foundational. Just as we might use hand sanitizer to prevent the spread of germs, antivirus
software serves as a constant line of defense, scanning for and blocking harmful programs
before they can infect a system. From my experience, using trusted, regularly updated
antivirus software can stop the vast majority of digital viruses from causing harm.

9
Yet, antivirus software is only the beginning. Just as doctors recommend regular
handwashing and vaccination to prevent illness, good cyber hygiene is essential. Over the
years, I've developed several habits, such as avoiding untrustworthy sites, verifying the
authenticity of emails, and not downloading unverified attachments, all of which have saved
me from countless cyber threats. These habits are akin to wearing a mask in a crowded area
or avoiding contact with sick individuals—simple preventive measures that are remarkably
effective.

The Role of Updates and Patches

One of the biggest security lapses I see repeatedly is a failure to update software. Many
people, myself included at times, postpone updates, seeing them as a nuisance. Yet, software
updates are often released to patch vulnerabilities that could otherwise be exploited by
hackers. Ignoring these patches is like skipping a vaccine shot; it leaves your system open to
infection.

In my experience, updating an operating system or an application often feels inconvenient.

However, once I recognized the importance of updates in maintaining security, I changed my
habits. I began to prioritize updates as part of my routine, even setting reminders to check for
new patches or updates regularly. The effort is minor but goes a long way in protecting
against digital threats. Over the years, I have avoided potentially serious attacks by keeping
my systems up-to-date, reinforcing my belief in the power of preventive maintenance.

Educating and Empowering Users

I once worked with a friend who had little experience with computer security and had fallen
victim to a phishing scam that infected his system with malware. We spent hours recovering
his data and fortifying his security, and it underscored to me just how crucial user education is
in computer security. Many users unknowingly expose themselves to risk simply because
they do not understand the dangers of clicking on an unknown link or downloading an
unfamiliar file.

From that experience, I became more proactive about sharing what I knew about security. I
started advising friends and family about recognizing phishing emails, avoiding dubious
downloads, and maintaining strong, unique passwords. Much like teaching basic hygiene to
avoid illness, these security fundamentals can significantly reduce one’s exposure to digital
viruses. Each time I see someone embrace these habits, it reinforces the idea that
empowerment through knowledge is one of the most effective tools against cyber threats.

Backups: Preparing for the Worst

Another essential component of digital virus protection is creating regular backups. Unlike
biological infections, which can sometimes leave permanent damage, digital viruses can be

10
 thwarted with the right preparations. By maintaining regular backups of important data, I’ve
found peace of mind knowing that even in a worst-case scenario, I would not lose everything.

I learned this lesson after a family member’s computer was hit with ransomware, a type of
malicious software that encrypts data and demands payment to unlock it. Unfortunately, they
had no backups, and while we managed to remove the malware, the files were lost. Since
then, I’ve kept backups of all important files, a simple practice that provides a safeguard
against the unpredictability of cyber threats. In a way, having a backup is like having
insurance—something you hope to never need, but are grateful for when disaster strikes.

A Personal Commitment to Security

My journey with computer security has taught me that effective protection against digital
viruses isn’t about complex interventions but rather a consistent commitment to preventive
measures. By combining antivirus software, system updates, safe browsing habits, user
education, and regular backups, I've been able to significantly reduce my risk of falling victim
to cyber-attacks.

In conclusion, "viral protection requires no antibiotics" perfectly captures the idea that
defending against digital viruses is not about a one-time fix, but about cultivating habits that
safeguard us from harm. Just as we protect our health through everyday precautions, our
digital security relies on routines that keep systems clean, safe, and resilient against emerging
threats. As technology continues to evolve, this proactive approach will remain crucial,
reminding us that prevention—whether in health or cybersecurity—is the best protection we
have.
Part 2- Prosecuting Cyber Crime
5. Read the article below from [Link]
scheme-a-6724 and summarize by providing appropriate (informative) headings to
paragraphs. Also provide a meaningful title to the article:

Eight defendants in Florida have been charged for their alleged role in an identity theft fraud
scheme involving the theft of personal information from a call center for use in unauthorized wire
transfers and to obtain credit and debit cards. The scheme involves exfiltrating data from a call
center that handles direct sales and customer inquiries for AT&T and then using it for fraudulent
purposes. All of the defendants were charged with one count of conspiracy, and several were
charged individually with access device fraud and aggravated identity theft. The defendants face
decades in prison if convicted. Two of the defendants remain at large.

The case highlights once again the security issues involved at call centers and the gaps in
authentication measures used by financial institutions. Payments fraud expert Tom
Wills says insider fraud at call centers is an increasingly common problem. “I have worked with
numerous call centers, and every one of them had internal fraud activity to deal with,” says Wills,
11
director of Ontrack Advisory, a consulting firm focused on payments innovation. “Out of 100
employees, you could usually count on one, two or more being ‘bad eggs.’” Al Pascual, a lead
fraud analyst at consultancy Javelin Strategy & Research, says the case illustrates one of the
biggest problems with how financial institutions authenticate customers through the use of
identifiers. “Among those banks examined by Javelin, 80 percent still authenticate customers
using Social Security Numbers,” Pascual says. “For all of the improvements that have been made
to securing online accounts, it is mind boggling that a criminal can rely on a static nine-digit
number to effectively take over an account.” Pascual says that, historically, nearly half of all
account takeover victims had their Social Security number compromised. “There are practical
alternatives available for authenticating customers through the call center, which is where the
SSN-authentication practice is most prevalent,” he says.

Fraud analyst Shirley Inscoe of Aite Group says this prosecution is encouraging. “These
criminals operate with impunity, thinking they will not get caught,” she says. “Sending a message
that prosecutions will take place, even if the losses are relatively low, is crucial in fighting
account takeover fraud.” The indictment alleges that Chouman Emily Syrilien, of Lauderdale
Lakes, Fla., was employed by Interactive Response Technologies, Inc., located in Margate, Fla., a
company that provides staffing for call centers to handle direct sales and customer inquiries for
AT&T. Employees of IRT have access to personal information for customers of AT&T,
including names, addresses, e-mail addresses, telephone numbers, Social Security numbers, dates
of birth, credit and debit card numbers, credit card verification numbers, personal identity
numbers and passwords, according to a copy of the indictment obtained by Information Security
Media Group. Syrilien, along with another defendant, allegedly provided co-conspirators with the
personal identifying information from multiple AT&T customer files.

Three other defendants – Carlos Antonio Alexander of Orlando, Fla., Shantegra La’Shae Godfrey
of Deerfield Beach, Fla., and Monique Smith of Pompano Beach, Fla. – in exchange for money,
goods or other items of value, or the promise of money, allegedly allowed for their names to be
added as “authorized users” on the credit or debit card accounts or bank accounts of the victims
who had their personal information stolen, authorities say. Once a co-conspirator’s name was
added as an authorized user, the bank or credit card company was directed to mail additional
debit or credit cards bearing the names of these newly-added users to their addresses or addresses
under their control, without the true account holder’s knowledge or consent, authorities allege.
The defendants used these credit and debit cards to make purchases or obtain money. Alexander,
Smith and Godfrey each made retail purchases as well as cash advances in excess of $24,000,
$12,000 and $8,200, respectively, authorities say.

If convicted, the defendants face a maximum penalty of 30 years in prison for the conspiracy
charge; a maximum of 10 years in prison for the access device fraud charge; and a mandatory
term of two years in prison for each aggravated identity theft charge, at least one of which must
be served consecutive to any other term in prison.

For organizations employing call centers, Javelin’s Pascual recommends dynamic knowledge-
based authentication, voice biometrics and phone printing as three “far superior” alternatives for
authenticating customers. “Until this status quo changes, I expect this type of information to be
targeted and misused unabatedly,” he says. Payments fraud expert John Buzzard, who oversees
FICO’s Card Alert Service, recommends that companies that deal with PII consider limiting

12
personal devices, like employee cellphones, from being used at individual workstations.
“Corporate e-mail should have an enterprise fraud solution component that detects PII from being
passed outside of the organization,” Buzzard says. “And something as simple as a paperless
environment can eliminate small amounts of PII from being jotted down and used later for
fraudulent purposes.” Buzzard says organizations should also have an audit trail established so
frequent or unusual access to information from an employer can be quickly questioned and
investigated. Organizations should install data leakage monitoring software to ensure insiders are
not misusing sensitive customer information, including personal and financial data.

Wills says criminal background checks should be run on candidates for call center work,
regardless of whether their positions are permanent or temporary, internally hired or outsourced.
“This is especially important if they will be exposed to sensitive customer data in the course of
their work, as was the case at AT&T,” he says. Further, Wills recommends organizations keep to
a minimum the call center staff’s exposure to sensitive customer data, employing the principle of
least privilege. “In other words, each user of the call center system should be able to access only
the applications, application functions, file directories and data needed to perform the work,” he
says. “In context of this particular case, adding an authorized user to an account is definitely a
high-risk activity and should come under all of the security controls that I’ve mentioned,” Wills
says. Access to applications, functions, file directories, data and physical spaces where sensitive
data is should be monitored using a combination of video surveillance, system logging, regular
audits and fraud detection software, Wills adds. “[And] payment transactions conducted on
accounts where sensitive customer information has recently been charged, and on brand new
accounts, should be monitored closely,” he says.

6. Vocabulary: Study the underlined legal terms extracted from the text, provide a definition of
what they refer to and provide an equivalent in your mother tongue. Beware of false cognates
(words that appear similar to a term in another language, but refer to something different- e.g.
criminal):

Term Define/explain

Exfiltration In cybersecurity and intelligence,

exfiltration refers to the unauthorized
transfer of data from a computer or
network to an external location. This can
include copying, transferring, or retrieving
sensitive information, often for malicious
purposes such as espionage or theft.

Defendant In legal proceedings, the defendant is the

individual, company, or entity being
accused or sued in a court case. The
defendant is responsible for responding to
the claims made by the opposing party,
known as the prosecution or plaintiff.

13
Prosecution The prosecution represents the government
or plaintiff in a criminal or civil case and is
responsible for presenting evidence to
prove that the defendant committed the
offense. In criminal cases, the prosecution
seeks to establish the defendant's guilt
beyond a reasonable doubt.

Theft Theft is the unlawful act of taking someone

else’s property without permission,
intending to permanently deprive the owner
of it. Theft can apply to physical items,
intellectual property, or even digital assets
such as data.

Unauthorized wire These are transfers of funds that occur

transfers without the permission of the account
holder. In cases of fraud, unauthorized wire
transfers often involve stolen financial
information used to move money
electronically from a victim's account to
another account controlled by the
perpetrator.

Fraudulent Fraudulent refers to actions done with the

intent to deceive or cheat for personal or
financial gain. Fraudulent activities can
include misrepresentation, manipulation, or
concealment of the truth to obtain money,
property, or other benefits illicitly.

Charged with To be "charged with" an offense means that

formal accusations have been brought
against a person by law enforcement or a
prosecutor, alleging they have committed a
crime. This charge initiates the legal
process and means the individual will face
court proceedings regarding the specific
crime.

One count of In legal terms, a "count" refers to a specific

charge or accusation within a criminal case.
If someone is facing "one count of" a
crime, it means they are accused of
committing that specific offense one time.
Multiple counts would mean they are

14
 accused of committing the offense multiple
times.

(To be) at large When someone is "at large," it means they

are not in custody and are currently
evading law enforcement, often after being
charged with or convicted of a crime. The
term implies the person is wanted by
authorities.

Convicted To be "convicted" means that an individual

has been found guilty of a crime in a court
of law. A conviction follows a trial or a
plea of guilty, and it results in a criminal
record and often leads to sentencing.

Insider fraud Insider fraud involves dishonest or illegal

actions carried out by an employee or
someone within an organization to exploit
their position for personal or financial gain.
This might include embezzlement,
unauthorized access to sensitive data, or
collusion to commit fraud.

Criminal A "criminal" is a person who has been

convicted of a crime. More generally, it can
refer to any action, behavior, or person
involved in activities that are against the
law.

Allegedly

Indictment

15
16