Ransomware During Peak Enrollment at a Regional College
A community college with 9,000 students is hit by ransomware three days before fall registration closes. The infection started on a print server and spread to two file shares holding enrollment records. Backups exist: nightly fulls to on-premises tape, with the newest tape stored in the same data center room as the servers. The ERP vendor's cloud environment is unaffected. Enrollment staff are manually processing paper forms, and the registrar is asking whether to pay a 40 BTC demand (about $2.6M) to recover the shares. The CIO wants to restore from tape immediately. The CISO notes the last successful restore test was 14 months ago and the tape library's catalog is encrypted. The college carries a $5M cyber policy with a $250K retention. State regulators require breach notification within 72 hours if student PII was exfiltrated; no exfiltration evidence exists yet.
1. Evaluate the CIO's proposal to restore from tape immediately. What should happen first, and what is the defensible recovery sequence?
Read the worked answer
Immediate restore is attractive but premature. The tape catalog is encrypted, so the restore path is unverified, and the last restore test was 14 months ago. Restoring over live systems before containment could reintroduce the ransomware or destroy forensic evidence needed for the 72-hour notification decision.
Sequence: (1) Confirm containment - isolate affected segments, disable the compromised service account, and preserve volatile evidence. (2) Determine whether the catalog can be rebuilt from an offline copy or vendor support; if not, the tape path is not a recovery option today. (3) Validate integrity of the ERP cloud environment and re-establish enrollment processing there as the primary continuity lever. (4) Restore to an isolated clean-room network, scan, and only then reconnect. (5) Document each step with timestamps to support regulatory and insurer obligations.
The judgment point: recovery capability must be proven, not assumed. A 14-month-old test with an encrypted catalog means the tape plan is a hypothesis, and the college should treat the cloud ERP as its actual recovery asset while rebuilding tape capability.
2. The board asks whether to pay the ransom. Frame the decision using the constraints given, without recommending payment or refusal outright.
Read the worked answer
Payment should be framed as a business and legal decision informed by technical facts, not a technical fix.
Factors favoring non-payment: the ERP cloud is intact, so core enrollment can continue; paying does not guarantee decryption keys work on corrupted shares; payment funds criminal operations and may raise sanctions and insurer issues; the $250K retention means the college absorbs costs up to that amount regardless.
Factors creating pressure: registration closes in three days; manual paper processing has finite capacity; if the shares contain irreplaceable records, recovery time matters more than cost.
A defensible framing: quantify the cost of three days of manual processing and potential enrollment loss versus $2.6M plus recovery uncertainty. Require legal review of sanctions exposure and insurer notification before any payment discussion. Simultaneously pursue the clean-room restore and cloud ERP workaround, because those reduce the value of the ransom. The board should decide on evidence, with a documented rationale, not under time pressure alone.
3. What should the CISO do about the 72-hour notification clock given no confirmed exfiltration?
Read the worked answer
The clock is a legal trigger, not a technical certainty. The CISO should start an internal timer now and document the basis for the notification decision.
Steps: preserve logs and network telemetry to determine whether data left the environment; engage counsel to interpret the 72-hour rule for this jurisdiction; prepare a draft notification that can be issued or withheld based on findings. If evidence is inconclusive at the deadline, many regimes require notification of a suspected breach, so the default should lean toward notifying regulators with the facts known.
The judgment point is that waiting for certainty can itself be a violation. The CISO should establish a decision record: what was known, when, and why notification was or was not made. That record protects the college and gives regulators a credible account.