One Login, 380 Students
At Hope Bay Secondary, 380 students in six forms share a single computer-lab login: username studentlab, password LAB2024, printed on a card taped beside the whiteboard. The lab has 22 machines, a technician who is on campus three days a week, and a timetable that books the room almost every period. Last term three incidents landed on the new IT teacher's desk: a Form 4 student's coursework folder was deleted two days before the internal deadline; a rude email was traced to the shared account on a machine that four students had used that afternoon; and a Form 2 student showed a parent how to log in from home through a remote-desktop shortcut someone had installed. The principal wants the shared password changed monthly instead of issuing individual accounts, arguing that creating and resetting 380 logins is impossible before next term. The school has an acceptable-use policy that nobody has signed.
1. Explain which of the three incidents the shared login caused or made worse, and whether changing the password monthly would prevent them.
Read the worked answer
The deleted folder is an integrity problem, but the bigger loss is accountability: every action in the lab is recorded against 'studentlab', so the log cannot show who deleted the file or who sent the email. Four students used that machine in one afternoon, and any of them - or anyone they told the password to - could have done it. The rude email is the same problem: the account identifies the room, not the person, so the school cannot sanction the right student or clear the wrong one. The remote-desktop shortcut shows the credential has already travelled outside the building; that is a confidentiality breach no internal rule can undo. Changing the password monthly addresses only that last point, and only until someone writes the new one on the same card. It does nothing for accountability, adds hundreds of reset requests a year, and encourages exactly the password-on-a-sticky-note behaviour that caused the leak.
2. Recommend a rollout plan that fits the technician's three days and the timetable, with at least three concrete steps and a way to handle forgotten passwords without slowing lessons.
Read the worked answer
Phase by cohort, not by student. Week 1: create accounts for Forms 4–6 only (about 190 students), since they hold coursework; import a CSV into whichever platform the school already uses (Google Workspace for Education or Microsoft 365) rather than typing names. Use a predictable but private first password - student ID plus a fixed suffix - and force a change at first login. Week 2: Forms 1–3, created during their scheduled lab periods so the technician needs no extra days. Handle resets with a form-teacher window: give each form teacher reset permission so they can restore a password at registration in under a minute, and publish a one-page reset process instead of the wall card. Keep a single 'visitor' account for open days, restricted to guest Wi-Fi and with no access to the file server. Disable the old shared account on a set date rather than gradually, and review the logs for the remote-desktop shortcut before doing so.
3. In two short paragraphs for the principal, explain the difference between confidentiality and accountability here, and why the acceptable-use policy needs signatures.
Read the worked answer
Confidentiality is about who can see something; accountability is about who did something. A shared password can be kept roughly secret, but it cannot tell you which of four students deleted a folder or sent an email, because the system only knows the account, not the person. When one login represents 380 people, every log entry is worthless as evidence and every student can plausibly deny responsibility - including the one who is guilty.
The acceptable-use policy matters because the school cannot discipline a student for a rule it never asked them to accept. Signed policies give the school a documented standard, let it apply sanctions consistently, and show parents and the examination board that access is managed. Without signatures, the policy is a poster on a wall, not a rule the school can enforce.