Shared Admin Accounts and a Six-Day Dwell Time
Vantia Health runs a multi-tenant SaaS for 60 clinic customers holding records for about 1.1 million patients. It has 240 staff and 4 platform engineers. An external audit raised five findings. The 14-person operations team shares 3 administrative accounts whose common password is stored in a chat channel. A contractor's account stayed enabled 94 days after the contract ended, and sign-in logs show it was used twice. Three standing break-glass accounts hold permanent domain-administrator rights. During a phishing incident, one employee's credentials were captured and the attacker read a reporting share for six days before a customer reported unusual activity; central log retention is seven days. Leadership is considering cyber insurance and ISO/IEC 27001 certification and asks what to fix first.
1. Recommend an access control model. Why is neither pure RBAC nor pure ABAC sufficient across 60 tenants, and how do you fix the break-glass finding?
Read the worked answer
Hybrid: RBAC for the verb, attribute scoping for the object, one central policy decision point.
- Pure per-tenant RBAC explodes: 60 tenants × roughly 6 roles × exceptions is 360+ roles no one can review, and review is the control that matters.
- Pure ABAC drifts into free-form attributes and policies nobody can test, which for patient data is worse than a coarse role.
- So a role grants the action (read-record, export-report, administer-tenant) and attributes - tenant_id, record type, data classification - constrain which objects it applies to. Enforce in one policy layer, not in each service.
- Shared accounts are eliminated regardless of model: with 14 people on 3 identities, non-repudiation is impossible and offboarding cannot be verified. Per-person credentials with phishing-resistant MFA, privileged sessions vaulted with recording.
- Break-glass becomes just-in-time elevation: 60 minutes, a reason field, automatic alert to the security channel, and post-hoc review.
- Deprovisioning is driven by the HR and contractor system as the authoritative feed with automated disablement, plus quarterly recertification by each resource owner.
2. Classify each finding as mitigate, transfer, accept, or avoid, and justify the classification. Where does insurance genuinely help and where does it not?
Read the worked answer
Mitigate the identity findings, transfer only money, accept almost nothing here.
- Shared admin accounts: mitigate - per-person accounts, PAM vaulting, MFA. Residual risk is insider misuse, addressed by session recording and review, not insurance.
- Contractor account active 94 days: mitigate, with automated deprovisioning from the contractor system and an alert on any sign-in by a terminated identity. The two sign-ins also demand an investigation, not just a fix.
- Standing break-glass: mitigate by redesigning to time-bound, alerted elevation.
- Six-day dwell time and seven-day log retention: mitigate - extend retention to 90–400 days with anomaly alerting and phishing-resistant MFA. This is a detection gap, and detection is never insurable.
- Transfer: cyber insurance covers recovery cost, legal defence, and third-party liability. It does not transfer the duty to notify patients and customers, the regulatory exposure, or reputation. Insurance is a financing decision, not a control, and underwriting will price the open findings anyway.
- Accept: valid only for a low-impact finding with a named owner, written rationale, and a review date - never for an open finding touching patient data.
- Sequence by risk: identity first, then detection and logging, then certification. ISO/IEC 27001 certifies a management system, not the absence of findings.
3. Sequence the response to the phishing compromise. What must happen before the mailbox is cleaned up, and what notification clocks apply?
Read the worked answer
Contain the identity first, but preserve evidence before remediation.
Order: reset the password, revoke all refresh tokens and active sessions (disabling the account alone often leaves issued tokens valid), revoke OAuth consents and app passwords. Then hunt for persistence: new mail-forwarding rules, MFA device enrolments, new service principals or API keys. Persistence routinely outlives a password change.
Before deleting anything, snapshot sign-in logs, audit logs, and mailbox contents. With seven-day retention the evidence needed to scope the breach is already aging out - export now and extend retention as part of the response, not after it.
Scope: which shares, which files, how many patient records, and whether data left the tenancy. Volume and data class drive the notification decision.
Clocks: GDPR-style obligations run to 72 hours from awareness; HIPAA-style breach notification without unreasonable delay and no later than 60 days from discovery; the 60 clinic customers almost certainly have shorter contractual clocks than either. Start the timeline log at hour one - every containment decision made early is audited months later.