Ransomware on the Exam Records PC
A school office PC running Windows 10 stores 30 GB of student records and results. The records folder is shared read-only with the principal’s PC. The clerk opened a file named result_final.pdf.exe from a USB stick supplied by a local printing shop. Within minutes, documents were renamed with a .locked extension and a ransom note appeared. The PC’s network cable is still connected, the shared folder is mapped on two other office PCs, and the antivirus subscription expired four months ago. The only backup is a 2 TB USB hard disk that has remained connected to the infected PC and was last copied to three weeks ago. An offline DVD from six weeks ago exists in the principal’s cupboard. The school has no budget for new software this term and exams are in ten days.
1. List your first eight actions in priority order for the first 30 minutes, explaining what each action prevents. State what you would not do yet.
Read the worked answer
- Disconnect the PC’s network cable and disable Wi-Fi. This prevents the shared folder and mapped drives on the other PCs from being encrypted. 2. Photograph the ransom note and note the time, then shut the PC down if no forensic support is available; this stops further local encryption, accepting that volatile evidence is lost. 3. Disconnect the two other office PCs from the shared folder and scan them from clean media. 4. Unplug the 2 TB backup disk immediately and label it; do not write anything to it until its state is known. 5. Inform the principal and preserve the offline DVD; do not pay the ransom. 6. Scan the printing-shop USB on an isolated clean PC and stop using it. 7. Change important passwords from a clean device, especially any account used on the infected PC. 8. Start a written timeline and inventory of affected files.
I would not restore over the live system, reconnect the backup disk, delete the ransom note, or reformat the PC yet. Those actions can destroy the only recovery evidence or overwrite recoverable data.
2. Evaluate the backup position. Using the 3-2-1 rule, propose a no-cost or low-cost backup design using the existing 2 TB HDD, DVD writer and one 64 GB USB drive, including schedule and restore test.
Read the worked answer
The current position fails 3-2-1: the only recent copy was on a disk connected during the infection, so it may also be encrypted; the DVD is old and only covers six-week-old data. Three copies should exist: production data, an offline hard-disk copy, and an offsite copy. Two media types: the 2 TB HDD plus DVD or USB. One copy offsite: the 64 GB USB can carry the 30 GB critical set home or to another locked office.
Design: use built-in robocopy or File History to copy the records to the 2 TB HDD in dated folders, then disconnect the HDD. Do this daily during a fixed backup window and keep at least four weekly versions. Weekly, copy the same set to the 64 GB USB and take it offsite. Monthly, export critical registers to DVD as an immutable copy. Enable BitLocker on removable media because student data is sensitive. Quarterly, restore a sample folder to a different location and compare file counts and hashes. A backup that has never been restored is only a hope, not a control.
3. What user and USB controls would you put in place before exams, given that staff resist change?
Read the worked answer
Start with controls that do not depend on buying software. Show file extensions in Windows so result_final.pdf.exe is visibly an executable, and confirm that autorun is disabled by policy. Allow only school-owned USB sticks, require scanning before first use, and keep one designated scanning PC offline from the records share. Remove local administrator rights from the clerk’s daily account and give the clerk a standard user account; use a separate admin account only when needed. Restrict the shared folder to read-only for most staff and limit write access to named people.
Because staff resist change, pair each restriction with a workable procedure: the printing shop should send PDFs by email or return files on a school-provided stick, and staff should report a strange file immediately without opening it. Run a ten-minute briefing before exams, put a one-page rule sheet beside each PC, and make the principal visibly follow the same USB rule. Re-enable antivirus protection or install a free reputable scanner on the records PC, and test that updates work before the exam period.