Two Clicks on a QR Code at a Tax Firm
Cornerstone Tax Partners is a 45-person accounting firm. Partners hold local administrator rights on their laptops and reuse the same password across the client portal, the VPN, and personal shopping sites. Last week a breach-notification service reported that one partner's email-and-password pair appeared in a public dump. On Monday, six employees received an email with a QR code claiming to be from IT and demanding mandatory MFA re-enrollment; two of them scanned it and entered their credentials on the linked page. The firm does not yet require MFA on the VPN. Client tax returns sit in a single shared folder where the security group Everyone has Full Control. Backups run to a USB drive that the office manager swaps every Friday and keeps in her desk drawer. The managing partner wants a prioritized list and insists the firm is too small to be a target.
1. Set out the first 72 hours in order of operations, and justify why that order and not another.
Read the worked answer
Contain, then investigate, then remediate, because every hour an attacker holds a live session is another hour of exfiltration.
Step 1, contain: treat the two who submitted credentials as compromised. From a known-good device, reset their passwords, revoke all active sessions and refresh tokens (a password reset alone leaves existing tokens alive), audit their MFA enrollment for methods the attacker added, and check mailbox rules for auto-forwarding, delegates, and hidden inbox rules, which are the standard exfiltration channel.
Step 2, scope: pull VPN and portal logs for the leaked partner credential and the two phished accounts, looking for impossible travel, off-hours logins, and new device registrations. Reset that partner's password and every account sharing the reused password, and check whether the same credential unlocks anything else.
Step 3, preserve and notify: export logs before retention rolls over. Because client tax data is involved, involve counsel immediately on notification duties, which may include state breach statutes, clients, and tax authorities. Do not make that call alone at the desk.
Step 4, block and warn: block the sender domain, submit the QR URL for takedown, and send staff a plain-language warning with the actual lure text.
2. The managing partner says the firm is too small to be a target. How would you justify MFA, and which factor would you deploy first?
Read the worked answer
Reframe the premise: most of these attacks are not targeted. Credential dumps are replayed automatically against VPNs and portals at scale, and a 45-person firm is caught by automation, not chosen. The leaked password proves the firm is already in the dataset.
On factor choice, prioritize phishing resistance over convenience. FIDO2 security keys or passkeys for partners, IT, and anyone who touches client returns; TOTP authenticator apps as the general fallback; SMS last, since it is vulnerable to SIM swap. If push notifications are used at all, require number matching and rate limiting, because the QR lure that just succeeded is a close cousin of MFA fatigue attacks that rely on a user approving a prompt to stop the noise.
Sequence by privilege, not by headcount: the six partners and the IT administrator first, because a partner account reaches every client return, then the rest of staff within 90 days. Pair MFA with removing local administrator rights and issuing separate admin accounts, since a phished standard user is far less useful to an attacker than a phished administrator. A short written rollout plan with dates is more persuasive to a skeptical partner than a general security argument.
3. Redesign the shared-folder permissions and the backup arrangement. State the failure each change addresses.
Read the worked answer
Permissions: Everyone with Full Control means any account, including a compromised or departing one, can read every client return and delete the lot. Replace it with role-based groups: partners get read/write across client folders, preparers get read/write on assigned clients only, seasonal staff get read-only, and only a dedicated admin group holds Full Control. Turn off inheritance at each client folder, enable access-based enumeration so staff cannot see folders they lack rights to, and review membership quarterly. This addresses both insider overreach and the blast radius of a phished account.
Backup: a single USB drive swapped on Fridays and stored in a desk drawer fails three ways. It sits on the same site as the originals, so fire or theft takes both; it is attached and writable during the week, so ransomware encrypts it; and a single rotating copy with no tested restore is a hope, not a backup. Move to 3-2-1: three copies, on two media, one offsite. Keep one copy offline or immutable with versioning and retention, run it automatically nightly rather than by hand, encrypt the removable media, and test a restore of a random client folder monthly, recording how long it took. Untested backups are the most common surprise in an incident.