Responding to Data Loss and Ransomware at a Secondary School
St. Augustine's College, Buea, has 1,200 students and 60 staff. Student records - grades, disciplinary notes and medical information - are kept in one Microsoft Access file on the bursar's office PC. The bursar makes a copy on a USB flash drive every Friday and keeps it in a desk drawer. Last week the office laptop was stolen from a locked cabinet; it contained an unencrypted copy of the records. In the same week, a teacher's USB drive infected a shared folder with ransomware, and the Friday backup was also on the network share, so it was encrypted too. Staff share login passwords, and the school has no written ICT policy. The principal has 900,000 FCFA for immediate improvements and can apply for a larger grant next year. The school's priorities are to keep records confidential, to restore quickly after an incident, and to avoid disrupting teachers who are not confident with computers. Advise the principal.
1. Identify the main vulnerabilities in the school's current arrangements and classify the student data by sensitivity. Explain which risks should be addressed first and why.
Read the worked answer
Vulnerabilities: a single copy on one PC; unencrypted data; a backup on a USB in a desk drawer and on the same network share; shared passwords; unrestricted USB use; no antivirus or patching policy; no written ICT policy; no incident response; physical theft.
Classification: medical and disciplinary records are highly sensitive personal data, restricted to the principal, nurse and counsellor; grades and examination records are confidential, available to teachers and the exams officer; contact details are internal; routine notices are public.
Priority risks:
- Loss of all records or ransomware - high impact and already realised. Fix backups first: offline, versioned and tested.
- Theft of an unencrypted laptop - high impact and likely. Encrypt laptops and restrict what is stored on them.
- Shared passwords and USB malware - high likelihood and medium-to-high impact. Fix accounts, antivirus and USB policy.
Why this order: risk is likelihood multiplied by impact. A second incident could destroy the school's ability to produce results, and confidentiality breaches harm students. Cheap controls that address both should come first. Buying new computers is not the priority.
2. Recommend a cost-effective set of technical and administrative controls for the 900,000 FCFA budget. Justify each control by the risk it reduces.
Read the worked answer
- Backup: one external hard disk kept off-site plus an encrypted cloud backup account, roughly 150,000–250,000 FCFA a year. Test a restore. Addresses ransomware and theft.
- Encryption: enable BitLocker or VeraCrypt on laptops and the backup drive at no licence cost; store recovery keys in a sealed envelope in the safe. Addresses stolen devices.
- Access control: unique accounts, strong passwords, a free password manager, multi-factor authentication on the cloud backup and email administration, and removal of shared logins. Addresses unauthorised access.
- Endpoint protection: antivirus, patching, and either restrict USB ports or scan USB drives at one dedicated station. Addresses malware.
- Physical measures: lockable cabinet and a UPS for the records PC, roughly 200,000 FCFA. Addresses theft and power corruption.
- Administrative measures: a one-page ICT acceptable-use and data-protection policy, a staff briefing, and a named data custodian. Addresses shared passwords and unclear responsibility.
Judgement: do not spend the whole 900,000 FCFA on a server. Offline backup, encryption and access control reduce the two realised risks most. Apply for the grant for a small server and staff training next year.
3. Outline the school's response to the ransomware incident and describe a backup scheme that would allow recovery from a similar attack.
Read the worked answer
Immediate response:
- Disconnect the infected PC from the network; do not keep using it.
- Tell the principal and the data custodian; do not pay the ransom.
- Identify the scope: which shared folders and backups are encrypted; preserve logs and the USB as evidence.
- Restore from the last clean offline backup; scan the restored data before reconnecting.
- Change passwords for affected accounts, rebuild the infected machine, patch it and update antivirus.
- Review how the USB was introduced, brief staff, and report the incident to the relevant authority if personal data was breached, in line with the school's legal obligations.
Backup scheme: 3-2-1 - three copies, two media, one off-site; keep at least one offline or immutable; nightly automated backup plus a weekly rotated external drive taken off-site; versioned so an encrypted file does not overwrite a good one; test a restore every term and record the result. Why: the previous backup failed because it was on the same network share. Offline, versioned backup turns a ransomware incident into an inconvenience rather than a disaster.