Engineering Firm Portal Breach: Notification and Identity Controls
A 240-person engineering firm's client portal stores project documents, including personal data of site visitors. A phishing email compromised a project coordinator's credentials; the attacker accessed three shared folders for six days. The firm has multi-factor authentication available but not enforced; 38% of staff are enrolled. The incident log shows 14 failed logins from foreign IP addresses before a success. The client contract requires breach notification within 72 hours; the firm detected the compromise on day 2. Legal says there is no evidence of exfiltration, but access logs are incomplete. The COO wants to avoid notifying clients to prevent reputational damage and asks whether 'no evidence of exfiltration' is sufficient. IT proposes mandatory MFA, conditional access, and 90-day password rotation. The firm operates in a jurisdiction with a general data-protection law and has no documented incident-response plan.
1. Advise the COO on the notification decision. Explain why 'no evidence of exfiltration' is not the same as no breach, and list the factors that should drive the decision.
Read the worked answer
Unauthorized access to personal data can trigger notification duties even without confirmed exfiltration; incomplete logs increase uncertainty rather than eliminate the obligation. 'No evidence of exfiltration' is absence of evidence, not evidence of absence. The 72-hour contractual clock likely began at detection on day 2, so the decision must be documented now.
Factors: the legal basis and contract terms; the types and volume of personal data in the three folders; whether access was read-only or included downloads; the six-day duration and 14 failed logins; log gaps; risk to affected individuals; regulator guidance; and whether the firm can remediate. Recommend preserving logs, engaging counsel, and notifying clients or the regulator if the risk threshold or contract requires it. If deferring, record the rationale, set a re-evaluation deadline, and prepare a notification draft. Reputational avoidance is not a lawful basis; late notification usually costs more than timely disclosure.
2. Evaluate IT's three proposed controls and recommend an implementation priority. What would you add or change?
Read the worked answer
Mandatory MFA is the top priority because 38% enrollment is the direct gap exploited; enforce it for all remote and privileged access, using phishing-resistant methods for administrators. Conditional access is second: risk-based policies on geography, IP reputation, and device compliance would have challenged the foreign-IP success, but only after an identity inventory and emergency-access path exist. 90-day password rotation is low value and can reduce security by driving predictable incremental changes; prefer long passphrases, breached-password screening, and forced reset only on compromise.
Add least-privilege review of shared folders, adequate logging and retention, endpoint detection, DMARC, phishing simulation, and an incident-response plan with a tabletop exercise. Sequence: contain (reset credentials, revoke sessions), enforce MFA, improve logging, then conditional access. Measure enrollment, time to revoke access, and alert coverage. The COO should approve a funded remediation plan, not a password-rotation gesture.