Privileged Account Phishing and the 72-Hour Clock
Harbor Health runs a patient portal and claims-processing platform. The security team detects an overseas login to an administrative console using a privileged service account. The account had MFA disabled because a legacy backup integration could not support it. Initial triage suggests 2,300 patient records may have been accessed. The incident response playbook says to isolate the host, reset credentials, and preserve logs. However, the service account runs the nightly backup, and disabling it will breach the backup SLA and risk data loss. Legal says the GDPR 72-hour notification clock started at detection; public relations wants to wait for forensic confirmation before notifying regulators. The account is also used by a third-party billing vendor. The CISO asks for a decision within the next hour.
1. What sequence of containment, evidence preservation, and service continuity actions would you authorize?
Read the worked answer
Contain first, but preserve evidence before destructive remediation. Revoke active sessions and tokens for the compromised account, disable interactive login, and rotate the credential. Before wiping or rebuilding the host, capture volatile memory, relevant logs, network flow data, and a disk image using a documented chain-of-custody process. Isolating the host may be unnecessary if the compromise is credential-based, but it should be considered if there is lateral movement.
For service continuity, do not simply leave the privileged account enabled. Create a temporary backup account with MFA, least privilege, restricted source addresses, and enhanced monitoring, or run the backup under a monitored break-glass procedure. Notify the backup owner and the third-party billing vendor so they can rotate their integration secrets. Accept a short backup delay only with a named risk owner and a defined catch-up plan.
The sequence should be: preserve evidence, contain the credential and session, establish a safe continuity path, then remediate. Disabling the account without a continuity plan creates an avoidable outage; keeping it enabled creates avoidable risk.
2. How would you decide on regulatory notification before full forensics are complete?
Read the worked answer
Do not wait for perfect forensics before making a notification assessment. The 72-hour clock requires a decision based on the information reasonably available, not proof beyond doubt. Assess the nature of the data, the number of records, the likelihood of unauthorised access, and the risk to data subjects. Initial evidence of 2,300 potentially accessed patient records is enough to trigger a serious assessment.
Document the decision and its basis at the time. If the risk is likely, notify the regulator within 72 hours with initial information and state that the investigation is continuing. If the provider decides not to notify, record why, what evidence was considered, and when the decision will be reviewed. Public relations cannot override the legal assessment; their concern about reputation should influence messaging, not the notification decision.
A defensible process is timely, documented, and updated as facts change. Waiting for full confirmation can breach the deadline and increase regulatory exposure.
3. What control and vendor changes should follow?
Read the worked answer
The MFA exception is the central control failure. Replace the legacy integration or place it behind a broker that supports MFA and strong authentication. Remove standing privileged access where possible, enforce just-in-time elevation, and monitor privileged sessions. Review all service accounts for interactive login capability and unnecessary permissions.
Formalise exceptions: every MFA exception should have a risk owner, compensating controls, an expiry date, and a review. Add the third-party billing vendor to the vendor risk process, confirm their access scope, require notification obligations, and test their incident response. Update the playbook to cover evidence preservation before remediation and to include a continuity path for backup accounts.
Measure progress through exception closure, privileged account inventory completeness, MFA coverage, and time to contain. Report these to the CISO and the service review.