The Stationery Shop That Shared One Password
A stationery shop in Chennai with three staff and 1,200 customer accounts starts selling online before the school reopening season. The owner subscribes to a cloud spreadsheet service and stores customer names, phone numbers and Aadhaar numbers in one shared folder. All three staff use the same login, password 'shop2025', and no second factor. The shop's website collects payment details on a page that loads over http:// and posts to a third-party form. On 3 February an employee receives an email that appears to come from the cloud provider, asking to 're-verify' the shared folder; the link goes to a look-alike domain and asks for the password. The owner also wants to add an IoT-based door sensor and an AI chatbot, and asks whether customer Aadhaar data can be used to train the chatbot. The shop has no backup and no written privacy notice.
1. Identify at least four phishing or account-security weaknesses in the scenario and recommend specific controls, explaining which risk each control reduces.
Read the worked answer
Phishing indicators: the message asks for 're-verification' of a shared folder (a credential request), uses urgency before the season, and links to a look-alike domain rather than the provider's known domain. The employee should not click; verify by typing the provider's address or contacting the owner. Account weaknesses: one shared login for three staff destroys accountability, because logs cannot show who copied Aadhaar data; the password 'shop2025' is short, predictable and reused; and there is no second factor. Controls: unique named accounts with least privilege; MFA, preferably an authenticator app rather than SMS; a password manager with long unique passphrases; restrict the shared folder to staff who need it; enable login alerts; train staff to report suspicious mail. MFA reduces the value of a stolen password, least privilege limits the blast radius, and named accounts make audit possible. None of these alone fixes the Aadhaar exposure; data minimisation is also needed.
2. Advise the owner on the cloud service model, protecting customer data, and whether Aadhaar numbers can be used to train the chatbot. Give reasons.
Read the worked answer
The shared spreadsheet is SaaS: the provider manages infrastructure and the shop configures users and sharing. That is acceptable for low-sensitivity data if access control, encryption at rest, audit logs and backups are enabled, but Aadhaar numbers should not be collected or stored unless there is a clear legal basis and necessity; the shop should minimise, mask (for example, last four digits), set retention, and restrict export. The website must use HTTPS with a valid certificate so payment details are encrypted in transit; better, redirect payment to a compliant gateway and never store card numbers. Backups should follow 3-2-1: three copies, two media, one off-site, with a restore test. Using Aadhaar data to train a chatbot is not appropriate without informed consent and a lawful purpose; training data can leak or be memorised. Anonymise and aggregate, or use synthetic data, and document the purpose. Cloud reduces capital cost but does not transfer the shop's accountability for customer data.
3. The owner plans an IoT door sensor and an AI chatbot. State two security safeguards for the sensor and two controls for the online payment flow, with reasoning.
Read the worked answer
IoT sensor safeguards: change default administrator credentials and use a unique password, because default passwords are the most common entry point; keep firmware updated and disable unused services and ports; put the sensor on a separate Wi-Fi SSID or VLAN so a compromised sensor cannot reach the customer spreadsheet. Payment controls: use a hosted payment page or gateway so card data never touches the shop's server; enforce HTTPS with HSTS and a valid certificate; do not store CVV or full card numbers; enable transaction logs and two-person review of refunds. The reasoning is to shrink the attack surface and avoid storing data that creates liability. The chatbot should not be given access to Aadhaar or payment data; it should answer from a curated FAQ and escalate to a human, with rate limits and prompt-injection testing. Adding technology increases the shop's responsibility, so patch management and incident response should be written down before launch.