Interactive Activity: Analyse a Security Incident and Propose Response Actions

This activity draws together the learning from this week and the three preceding weeks. You are presented with a security incident scenario and asked to analyse it systematically and propose a structured response. This is the kind of thinking that managers are expected to contribute during and after a real incident, and practising it in a learning context builds the readiness and judgement that a real incident demands.

The Scenario

It is a Tuesday morning. Priya is a mid-level manager at a mid-sized professional services firm based in India with clients across South-East Asia and the Middle East. Her team of fifteen staff provides financial analysis and advisory services. The team uses a cloud-hosted client relationship management (CRM) platform, a shared document storage service and email.

At 09:15, Priya receives a message from a colleague in the IT team asking whether anyone in her team has been accessing the CRM system from unusual locations overnight. Priya checks with her team and confirms that no one has been working overnight. The IT team then informs her of the following:

• Login records show that two user accounts belonging to members of Priya’s team were accessed from an IP address associated with a country where the organisation has no operations, between 02:00 and 04:30 local time.
• During that period, the accounts accessed and downloaded a significant volume of client records from the CRM, including contact details, contract summaries and financial information for approximately 340 clients.
• One of the two affected accounts belongs to a team member who left the organisation six weeks ago. The account had not been disabled following her departure.
• The other affected account belongs to a current team member, Rohan, who is in the office this morning and has confirmed that he did not log in overnight. He recalls receiving an email last week that asked him to verify his login credentials for a system update, which he completed on his personal smartphone.
• The IT team has disabled both affected accounts and is conducting a preliminary investigation. They have asked Priya not to discuss the incident with the wider team until they have a clearer picture of what has occurred.

Part One: Incident Analysis

Working through the following questions, produce a structured analysis of the incident as it currently stands:

• Attack vector identification: based on the information available, what do you believe was the most likely method by which the attacker gained access to the accounts? What evidence supports your assessment? Identify the specific vulnerability or vulnerabilities that appear to have been exploited.
• CIA Triad assessment: which of the three CIA principles (confidentiality, integrity, availability) has been most directly compromised by this incident? Are there implications for the other two principles? Explain your reasoning.
• Scope and severity assessment: how would you characterise the severity of this incident? Consider the volume and sensitivity of the data that appears to have been accessed, the potential regulatory implications (given that the data involves clients across multiple jurisdictions), and the reputational risk to the firm.
• Control failures: identify at least three specific security control failures that appear to have contributed to this incident. For each one, identify whether it is primarily a technical, people, process or organisational control failure.
• Immediate concerns: what immediate concerns would you raise with the IT team or with your line manager, beyond those already being addressed by the IT investigation? Are there actions you believe need to be taken in the next few hours that are not already underway?

Part Two: Proposed Response Actions

Drawing on the incident response framework from Week 3 and the practical guidance from this week, propose a structured set of response actions across the following dimensions:

• Immediate containment actions: what steps should be taken in the next few hours to limit the potential harm from this incident? Consider both technical and operational actions. Be specific about who you would involve and what you would ask them to do.
• Communication planning: who needs to be informed about this incident, at what level of detail, and in what timeframe? Consider internal stakeholders (your team, your line manager, the board), external stakeholders (affected clients) and regulatory obligations (given the data involved includes client personal information). What would you say, and what would you advise against saying at this stage?
• Evidence preservation: what steps should be taken to preserve evidence relevant to the investigation? Are there any actions that should be avoided to prevent contamination or loss of forensic evidence?
• Regulatory notification: given that personal data of clients across multiple jurisdictions appears to have been accessed, what regulatory notification obligations might apply? What information would you need to assess these obligations, and who would you involve in making that assessment?
• Post-incident improvements: based on what you know of this incident, identify at least three specific improvements to security controls or processes that you would recommend as a result of this incident, and explain the rationale for each.

Part Three: Reflection and Discussion

Having completed your analysis and proposed response actions, share your work in the course discussion forum. Specifically:

• Which control failure do you consider the most significant and why? Compare your view with those of other learners from different countries and professional contexts.
• How does your proposed communication plan reflect the regulatory context in your own country or region? Learners from different jurisdictions are likely to face different notification timelines and requirements.
• What does this incident tell you about the security posture of an organisation similar to yours? Are there analogous vulnerabilities in your own environment?