Computer Log Review After a Failed Login Pattern
A clerk at a border outpost uses a shared desktop computer running a standard operating system. The system log shows 14 failed login attempts for the account 'clerk01' between 22:10 and 22:40, followed by one successful login at 22:41 from the same machine. No one was on duty at that desk after 22:00. The clerk's password is a common word followed by the year. The outpost has no separate network administrator, and the clerk is unsure whether to delete the log, change the password, or report the incident. The computer also holds a spreadsheet of patrol schedules.
1. Explain what the log pattern most likely indicates and why each of the clerk's three options is right or wrong.
Read the worked answer
Fourteen failures followed by a success in the same minute is the classic signature of repeated password guessing that eventually worked, or of someone who knew the pattern and mistyped before succeeding. Deleting the log is wrong: it destroys evidence and may itself be a disciplinary offence. Changing the password is necessary but not sufficient, because the intruder may already have copied the patrol spreadsheet or installed a way back in. Reporting is the correct first action, followed by a password change and a request for a technical check. The weak password (common word plus year) explains why guessing succeeded and should be replaced with a longer passphrase that is not a dictionary word.
2. Recommend a sequence of actions for the clerk, and explain how the patrol spreadsheet changes the priority.
Read the worked answer
Sequence: (1) do not delete anything; (2) report immediately to the officer in charge and to the sector IT contact; (3) change the password from a different, trusted device if possible, and log out all sessions; (4) have the machine checked before further use; (5) review who had physical access after 22:00. The patrol spreadsheet raises the priority because it is operationally sensitive: an intruder with the schedule knows when and where patrols go, which is a security risk, not just a data breach. The officer in charge should consider whether patrol timings need to be changed until the incident is resolved.