Incident Response and Disclosure at a Dental Clinic
BrightSmile Dental Clinic runs a small web application that stores appointments, treatment notes, and billing details for 3,500 patients. The application was built by a former employee. Passwords are stored as unsalted MD5 hashes, and login queries are built by joining strings such as SELECT * FROM users WHERE email = '' + input + '''. Nightly backups are written to an unencrypted USB drive kept in the reception drawer. Last week a receptionist clicked a link in an email and entered her password on a fake login page. Three days later, the clinic's database was offered for sale on a forum. The clinic director wants to restore the old backup, change the receptionist's password, and avoid informing patients because 'it would cause panic and bad publicity'. The clinic operates in a jurisdiction with a general data-protection law.
1. Recommend an incident-response sequence for the next 48 hours, distinguishing containment, eradication, and recovery. Justify the order.
Read the worked answer
First contain: isolate the web server and database from the internet, disable the compromised receptionist account, revoke active sessions and API keys, and block the attacker's indicators. Preserve evidence before rebuilding: disk images, web server and database logs, and the phishing email. Do not wipe the original.
Second eradicate: identify the entry path, which is likely the phished credentials plus SQL injection. Patch the injection, remove web shells or unauthorised accounts, reset all staff passwords, and enable multi-factor authentication. Third recover: rebuild from a known-clean image, restore data from a backup taken before the intrusion, verify integrity, and monitor closely.
Do not simply restore the old backup and change one password. The attacker may have persisted, the backup may be older than the breach, and the restored system would still contain the vulnerabilities. The order matters because eradication before containment lets the attacker keep access, and recovery before eradication reintroduces the compromise.
2. Explain why the password storage and query construction are unsafe, and propose concrete replacements.
Read the worked answer
Unsalted MD5 is unsuitable for passwords. MD5 is fast, so an attacker with the database can test billions of guesses per second, and identical passwords produce identical hashes. A single MD5 hash also enables rainbow tables. Use a slow, salted, memory-hard password hash such as Argon2id, scrypt, or bcrypt, with a unique salt per user and a tuned cost. Force a reset for all accounts now because the hashes are exposed. Add multi-factor authentication for staff.
String-concatenated SQL allows SQL injection: input such as ' OR '1'='1 changes the query. Use parameterised queries or prepared statements so input is treated as data, not code. Give the application a least-privilege database account, validate input, and add a web application firewall as defence in depth. Also encrypt backups and store the key separately; an unencrypted USB drive in a drawer is both a security failure and a data-protection failure.
3. Evaluate the director's proposal to avoid informing patients. Recommend a course of action, taking ethical and legal considerations into account.
Read the worked answer
The director's stance is understandable but wrong. The data may include treatment notes and billing details, so the breach can lead to fraud, identity theft, or embarrassment. Affected people need to know so they can watch accounts and take precautions. Ethically, the clinic has a duty of care, respect for patient autonomy, and an obligation to be transparent. Concealment compounds the harm and destroys trust when it emerges.
Practically, a general data-protection law is likely to require notification to a regulator and to affected individuals without undue delay. Concealment usually increases penalties and legal exposure. The exact thresholds and timelines depend on the jurisdiction, so take legal advice immediately.
Recommended action: contain and investigate, then notify the regulator and patients with clear facts, the data involved, what the clinic is doing, and what patients should do. Offer a contact point and, if appropriate, credit monitoring. Document decisions. Reputation is better protected by a competent, honest response than by silence.