Credential Theft and a Nurse's Spreadsheet at a Regional Health Network
Meridian Health has 1,200 staff, 400 of them clinicians, and 300 contractors who use personally owned laptops. Harmony Endpoint is installed on 1,050 of 1,200 corporate devices and data loss prevention is enabled on 640 of those. Two incidents landed in the same week: a credential phishing campaign harvested 22 Microsoft 365 passwords, one of which was used to send 400 internal phishing messages, and a nurse emailed a spreadsheet containing 180 patient records to her personal Gmail account from a home computer. Clinical staff work entirely in a browser-based electronic medical record and complain that endpoint scanning slows image review. Contractors connect over VPN with a shared agency account and cannot install agents. Compliance requires evidence of access control and data-loss prevention, and leadership wants the problem closed before the next audit in ten weeks.
1. You have ten weeks. Rank the remediation work and justify the order using what these two incidents actually demonstrate.
Read the worked answer
Rank by demonstrated harm and by time-to-effect, not by how satisfying the fix feels.
The phishing incident proves that a stolen password was sufficient to act as an employee for long enough to send 400 internal messages. That is an identity failure, and identity changes take days, not quarters:
- Enforce MFA for all accounts, phishing-resistant authenticators for administrators and finance; block legacy authentication protocols that bypass MFA; revoke all active sessions for the 22 compromised accounts and force reset.
- Apply conditional access so that sign-ins from unmanaged devices or unusual locations cannot reach mail and file stores with full download rights. Include impossible-travel and mass-mailing detections with automatic account suspension.
- Publish and enforce DMARC, and tune inbound and outbound mail filtering so an internal compromised account cannot spray 400 messages.
The nurse incident proves that endpoint DLP cannot see a personal Gmail session on a home computer. Gap-closing order: get the remaining 150 endpoints under management, then enable DLP on the 410 devices where it is off, but do not present endpoint DLP as the answer to webmail exfiltration.
That gap is closed at the network or browser layer: proxy the traffic, restrict upload to personal webmail for clinical job roles, or isolate the browser session so data never lands on the endpoint. Expect clinical complaints and plan an exception route, or clinicians will find a workaround that generates no logs.
2. Contractors use personal laptops and a shared agency VPN account. What access model do you propose, and what do you give up by choosing it?
Read the worked answer
The shared account is the defect, not the contractors. It makes attribution impossible, so no incident involving those sessions can be investigated and every DLP alert names an agency instead of a person.
Proposed model:
- One identity per contractor, federated from the agency where possible, with MFA and a defined end date. Offboarding becomes a directory action rather than a VPN credential conversation.
- Replace full-tunnel VPN with application-level access: contractors reach the scheduling and records systems they need, nothing else. Network-level access from an unmanaged device gives them a path to everything the VPN subnet can see.
- For the browser-based EMR, use remote browser isolation so patient data is rendered but not downloaded, cached, or screenshotted into the local filesystem. This is the only control that survives a device you do not own.
- Posture check at session start: patched OS, disk encryption, screen lock. Not a full agent.
What you give up: isolation adds latency and breaks printing, clipboard, and some file workflows that clinicians rely on. Plan a supported path (secure print, controlled download to a managed device) or the workaround will be a personal email again. Also accept that you cannot inspect the endpoint; your evidence is session-level, so log session recording for the roles that touch the most sensitive records.
3. How do you stop the spreadsheet case specifically, and how do you show the auditor that it is under control rather than just configured?
Read the worked answer
Layer the control so it does not depend on the nurse's goodwill or on one channel.
Detection and blocking:
- Content-based rules that recognise patient identifiers, not just file type: medical record number patterns, date-of-birth plus name combinations, and a data fingerprint built from a sample of the record format. File-type rules alone miss a CSV renamed to .txt.
- Apply at three chokepoints: outbound mail, the web proxy or cloud access security broker for personal webmail and file-sharing sites, and the endpoint for removable media and local sync clients. Each catches what the others miss.
- On a match, encrypt or quarantine with a justification workflow rather than silent block, so legitimate referrals to external clinicians still move.
Reducing the 400-alert noise problem: new rules run in detect-only for two weeks, you measure false positives per rule, and you tune before enforcing. A rule the clinicians disable is worse than no rule.
Evidence for the auditor:
- A scheduled test every quarter: send a synthetic file containing fake identifiers through each channel and record whether it was blocked.
- Trend of incidents by channel and by rule, plus the false-positive rate, which demonstrates tuning rather than neglect.
- Documented exceptions with approver and expiry.
Be explicit about residual risk: photography of a screen and verbal disclosure are out of scope for these controls and are handled by policy and training.