Visitor Data and the Fake Security Patch
A jail warder at the visitor gate uses a shared computer logged in with the username visitor_desk and the password jail@123. The visitor management software stores names, the last four digits of Aadhaar numbers, mobile numbers and photographs of 2,300 visitors. At 3:10 p.m., a man posing as a software vendor calls the gate and asks the warder to install a security patch from a link sent on WhatsApp. The warder's colleague has already plugged in a personal USB drive to copy a visitor list for a relative in the police department. The computer shows a pop-up saying Windows Defender has expired. The warder has 15 minutes before the next visiting slot. The jail's IT officer is on leave, and the control room says the server is running but slow. The warder must decide whether to install the patch, allow the USB copy, or stop the process. There are 60 visitors waiting outside.
1. Identify the specific information-security failures and their likely consequences.
Read the worked answer
The failures are: shared login with a weak, guessable password; no multi-factor authentication; no verification of the caller's identity; clicking or installing software from an unsolicited WhatsApp link; use of a personal USB drive on an official system; expired endpoint protection; and no clear data-handling rule for visitor records. The likely consequences include malware or ransomware infection, theft of personal data, identity fraud, loss of trust, disciplinary action and legal exposure under the IT Act and the DPDP Act, 2023. Copying the visitor list to a personal USB also creates an unauthorised data transfer and evidence-handling problem.
2. What should the warder do in the next 15 minutes, and what should he not do?
Read the worked answer
He should not install the patch, not open the WhatsApp link, and not allow the USB copy to continue. If the USB is already connected, he should stop the copy, leave the drive in place for the IT investigation, and isolate the computer from the network if that can be done without destroying evidence. He should inform the control room and the senior officer immediately, note the time and caller number, and verify the vendor through an official number, not the number supplied by the caller. Visitors should be handled through a manual paper register with a clear explanation, so the queue does not become a security incident. He should preserve the pop-up and system logs, and not delete anything.
3. Recommend three controls to prevent recurrence.
Read the worked answer
- Replace shared accounts with unique named logins, strong passwords and multi-factor authentication for the visitor system. 2. Block personal USB devices and require a logged, scanned transfer process for any official data. 3. Establish a vendor-verification and patch-management procedure: no remote link is installed without confirmation through an official contact and IT approval. Additional controls include role-based access, regular antivirus updates, visitor-data minimisation, staff training and an incident-reporting register.