Three simultaneous IT incidents in a live branch
A branch faces three incidents on Monday morning. First, an email from '[email protected]' with the subject 'Urgent IFSC data verification' and an attachment 'RBI_IFSC_Verification.html' has reached all six staff; two clicked the link, and one entered her user ID on the page but stopped before the password. Second, after a Windows update the core banking client on two teller machines shows 'cannot connect to port 443', and a staff member has brought a pen drive from home containing 'CBS_fix.exe' received on WhatsApp. Third, an officer has copied 240 scanned KYC files to his personal Google Drive to process at home and has shared the folder link with two colleagues on the branch's unofficial WhatsApp group. IT support sits at the district office, four hours away. Business hours have started and 40 customers are waiting.
1. Rank the three incidents by immediate risk and justify the ranking.
Read the worked answer
Rank: phishing first, KYC data exposure second, the pen drive third. Phishing ranks first because it is an active credential compromise with transaction capability. One user ID has already been submitted to an unknown page; if that ID belongs to a maker or supervisor with core banking rights, the attacker can attempt logins, and the user ID alone narrows the search for a password. The impact is direct and immediate, so containment is measured in minutes. The KYC exposure ranks second because it is irreversible. Once 240 files have been shared on a personal account and a group link, no branch action can recall them; the impact is a privacy breach with legal and reputational consequences, but it does not by itself move money. The pen drive ranks third only because it is the easiest to stop: it has not been installed. Note the condition - if someone plugs it in, it climbs to first, since a teller machine runs the core banking client and a keylogger or ransomware on it would affect every transaction that follows.
2. Set out the first hour for the phishing email: what to do, in what order, and what must not be done.
Read the worked answer
- Instruct all staff to stop clicking and forward nothing; keep the affected machine as it is.
- Capture evidence before deleting anything: full email headers, sender address, attachment hash where possible, and a list of who clicked and who entered data.
- Report to the bank's IT security team and the district office in writing, with the timeline, and let them raise it externally as per policy.
- Block the sender domain and subject pattern at the mail gateway so the message cannot be re-sent or forwarded further.
- Reset the affected user's credentials from a clean machine, force a fresh login, and check core banking logs for that user ID over the last 24 to 48 hours for logins, failed attempts, or new payee creation.
- Alert the branch in one message: no replies, no link entry, report any similar mail. Do not delete the mail or wipe the machine before the headers and logs are captured, do not run a password reset on the suspect machine itself, and do not wait for the district team before steps 1 to 3.
3. For the pen drive and the personal Google Drive folder, state what may and may not be done today, with a one-line reason for each.
Read the worked answer
Pen drive - may not be inserted into any branch machine, including a teller machine, because an unverified executable received over WhatsApp can be malware and the teller runs the core banking client. May: log the incident, quarantine the drive in a sealed envelope, and ask IT to supply a signed patch, with a scanned copy of a patch only on an isolated machine if IT directs it. A WhatsApp-delivered fix is never the approved patch channel. Google Drive - may: revoke the shared link immediately, delete the folder from the personal account, obtain written confirmation of deletion, ask the two colleagues to delete local copies, and notify the compliance or data protection officer with the file list, the number of files and the sharing timeline. Reason: the personal account is outside the bank's control, so the branch must assume exposure and treat it as a reportable data-handling incident. May not: leave the link active while 'checking', silently delete without a record, or handle it as an internal courtesy to the officer - the officer's intent does not change the exposure, and customer notification or disciplinary action is a call for compliance, not the branch.