Ransomware at a Village Office
A village office with 12 desktop computers and three staff uses one shared login, “villageoffice”, for all machines. A staff member opens an email attachment named “beneficiary_update.exe”; soon files on two computers are renamed with a .locked extension and a ransom note appears. The office stores Aadhaar enrolment forms, land-tax records, and scanned certificates. An external hard disk is always connected to the main computer; the online backup was last verified 45 days ago and covers only the accounts folder. The panchayat’s IT support is available by phone, and the office has no separate network segment. It is 11:20 a.m.; the office must reopen at 2 p.m. for certificate issuance. The secretary must decide the first hour’s actions, whether to pay the ransom, how to restore services, and what low-cost changes to make within a ₹40,000 budget.
1. Set out the first 60 minutes in order. What should not be done?
Read the worked answer
First 60 minutes: (1) stop the spread-unplug network cables and Wi-Fi and disconnect the always-on external disk; do not use the shared login on other PCs. (2) Preserve evidence-photograph the ransom screen, note time, machine names and file extensions; if forensic help is coming, leave infected machines powered but isolated; otherwise shut down only after documenting. (3) Notify the panchayat secretary, district IT or cyber cell and data-protection officer; do not pay the ransom. (4) From a clean phone or PC, change the shared password and email credentials. (5) Identify the last known good backup and whether it is offline. Do not reconnect infected PCs, restore over the network, delete files, run untrusted 'decryptors', or hide the incident. The 2 p.m. deadline does not justify unsafe reconnection.
2. How can the office restore certificate services by 2 p.m. without worsening the breach?
Read the worked answer
Use a clean, isolated workstation and paper or manual certificates for urgent cases; do not connect it to the infected LAN. Verify the 45-day-old backup on a separate test machine, scan it, and confirm the accounts folder is complete. If it is clean, restore only the needed records, reset all credentials, patch the operating system and disable macro or executable email attachments. Rebuild infected machines from known media rather than trusting the encrypted files. Bring machines back one at a time after scanning. If the backup is incomplete, continue manual service and tell the public the expected delay. Restoring speed is secondary to not re-infecting the network.
3. Allocate ₹40,000 across low-cost controls and justify the order.
Read the worked answer
Spend on the highest-likelihood, highest-harm gaps: (1) ₹8,000–10,000 for an offline backup disk plus a second rotating disk, stored disconnected; (2) ₹8,000–10,000 for unique accounts, a password manager and email MFA; (3) ₹6,000–8,000 for a UPS or surge protection to prevent corruption; (4) ₹5,000 for staff awareness and a no-executable-attachment rule; (5) ₹5,000 reserve for incident response and cyber-police coordination. The exact split can vary, but the principle is: protect backups and credentials first, then availability, then training. Do not spend the whole budget on antivirus alone; the shared login and always-connected backup were the critical failures.