WGU C843 Performance Assessment: Managing Information Security (KOP2) |
Latest 2026 Update with complete solutions.
Western Governors University
Managing Information Security - C843
Performance Assessment:Managing Information Security (KOP2)
, Part I: Incident Analysis and Response
A. Determination of Successful Attack and Specific
Vulnerabilities
The cyber-attack against Azumer Water succeeded due to a combination of systemic
organizational negligence and specific, unmitigated technical vulnerabilities. The
organization’s reactive security posture, lack of enforced policies, and reliance on
outdated technologies created a high-risk environment that a motivated threat actor easily
exploited. Two specific vulnerabilities were instrumental:
1. Lack of Security Awareness Training and Phishing Susceptibility: The primary
attack vector was a phishing email sent to the volunteer coordinator, John Smith.
The email leveraged urgency (“offer expires in two days”) and a slight misspelling
in the domain (watersupp1y.int instead of a legitimate .com or .org) to trick John.
The case study explicitly states he “carelessly clicked on the link” while distracted
(Azumer Water Case Study, 2023). This human vulnerability was enabled by the
absence of a formal, recurring security awareness program. Without training,
employees cannot be expected to recognize and report sophisticated social
engineering attempts.
2. Insecure Configuration and Lack of Network Segmentation: The technical
environment was fundamentally insecure. Pruhart Tech had deferred the
configuration of the enterprise firewall, and the main office used the critically
compromised Wired Equivalent Privacy (WEP) protocol for its wireless network
(Azumer Water Case Study, 2023). An unconfigured firewall provides no
substantive access control or threat inspection, while WEP is trivially broken,
potentially allowing an attacker to gain initial access to the internal network. Once
John’s click likely executed malware, the absence of network segmentation (e.g.,
isolating the database server from general user workstations) allowed the threat
actor to pivot and locate the critical volunteer database.=
B. Compromise of Operations and Data
The attack compromised Azumer Water’s operations and data across the foundational
security triad of confidentiality, integrity, and availability (CIA), with severe implications
for Personally Identifiable Information (PII).
• Confidentiality, Integrity, and Availability: The confidentiality of the entire
volunteer database was breached, as evidenced by its disappearance, which is
more indicative of ransomware encryption or theft than mere deletion. The
integrity of organizational communication was sabotaged; the attacker spoofed
John Smith’s identity to send fraudulent donation emails to volunteers, destroying
Latest 2026 Update with complete solutions.
Western Governors University
Managing Information Security - C843
Performance Assessment:Managing Information Security (KOP2)
, Part I: Incident Analysis and Response
A. Determination of Successful Attack and Specific
Vulnerabilities
The cyber-attack against Azumer Water succeeded due to a combination of systemic
organizational negligence and specific, unmitigated technical vulnerabilities. The
organization’s reactive security posture, lack of enforced policies, and reliance on
outdated technologies created a high-risk environment that a motivated threat actor easily
exploited. Two specific vulnerabilities were instrumental:
1. Lack of Security Awareness Training and Phishing Susceptibility: The primary
attack vector was a phishing email sent to the volunteer coordinator, John Smith.
The email leveraged urgency (“offer expires in two days”) and a slight misspelling
in the domain (watersupp1y.int instead of a legitimate .com or .org) to trick John.
The case study explicitly states he “carelessly clicked on the link” while distracted
(Azumer Water Case Study, 2023). This human vulnerability was enabled by the
absence of a formal, recurring security awareness program. Without training,
employees cannot be expected to recognize and report sophisticated social
engineering attempts.
2. Insecure Configuration and Lack of Network Segmentation: The technical
environment was fundamentally insecure. Pruhart Tech had deferred the
configuration of the enterprise firewall, and the main office used the critically
compromised Wired Equivalent Privacy (WEP) protocol for its wireless network
(Azumer Water Case Study, 2023). An unconfigured firewall provides no
substantive access control or threat inspection, while WEP is trivially broken,
potentially allowing an attacker to gain initial access to the internal network. Once
John’s click likely executed malware, the absence of network segmentation (e.g.,
isolating the database server from general user workstations) allowed the threat
actor to pivot and locate the critical volunteer database.=
B. Compromise of Operations and Data
The attack compromised Azumer Water’s operations and data across the foundational
security triad of confidentiality, integrity, and availability (CIA), with severe implications
for Personally Identifiable Information (PII).
• Confidentiality, Integrity, and Availability: The confidentiality of the entire
volunteer database was breached, as evidenced by its disappearance, which is
more indicative of ransomware encryption or theft than mere deletion. The
integrity of organizational communication was sabotaged; the attacker spoofed
John Smith’s identity to send fraudulent donation emails to volunteers, destroying
