One password and a USB in a handbag
A charity running a school-feeding programme keeps a database of 3 000 donors on one office computer. The database holds full names, postal addresses, telephone numbers, bank account details for monthly gifts, and notes on which donors have asked not to be contacted again. Two staff share one login, 'admin', with the password written on a note stuck to the monitor. Each Friday the finance officer copies the database to a USB flash drive and takes it home in her handbag for safekeeping; the same drive is used for her children's homework. Last Tuesday a message that appeared to come from the charity's bank asked her to confirm the charity's account details through a link, and she entered the shared login and password. Nothing appeared to happen, so she mentioned it only today. The trustees meet next week and have asked for a report on whether donor data is being handled properly.
1. Identify the three most serious weaknesses in the present arrangement. For each, state the consequence and the data-protection principle it offends.
Read the worked answer
First, the shared 'admin' login with the password on the monitor. Nobody can be shown to have done anything, so there is no accountability and no audit trail; any visitor, cleaner or volunteer who passes the desk has full access to 3 000 donors' bank details. This offends the principles of access on a need-to-know basis, of security, and of accountability. Consequence: an insider or intruder can copy or alter the entire database, and the charity cannot even say who did it.
Second, the unencrypted USB drive in a handbag. It is a copy of the whole database travelling off-site without authorisation, it can be lost or stolen, and because it doubles as a homework drive it is exposed to malware from other machines. This offends the security principle and the rule that personal data should not be transferred or taken off-site without protection. Consequence: a reportable loss of 3 000 donors' bank details, with the charity unable to show it took reasonable care.
Third, single-person knowledge. One officer holds the only backup and one password is shared by two staff, so absence, illness or a dispute can leave the charity with no access to its own data. This offends accountability and the availability side of security; the reverse risk, that the single copy is lost, is equally serious.
2. Set out, in order, what the charity should do in the 48 hours after the phishing link was clicked, and explain why the order matters.
Read the worked answer
Contain first. Change the 'admin' password immediately, sign out all sessions, and take the office computer off the network until it has been scanned. While the attacker may still be logged in, investigating first simply tells them they have been noticed.
Second, establish scope from records rather than from the message: check the mail system and database logs for logins from unfamiliar locations, for mail-forwarding rules or new accounts, and for any change to bank details or standing orders. Third, telephone the bank on a number the charity already holds, not the one in the email, and ask them to block changes to the account and flag suspicious instructions. Fourth, restore from a backup predating the incident if tampering is found, then change all other credentials that were stored on that machine.
Fifth, decide whether this is a reportable personal-data breach. Bank details are involved, so the risk to donors is real; the trustees and the relevant data protection authority should be informed, and donors told to watch their accounts, because the notification clock usually starts when the organisation becomes aware, not when it finishes investigating. The report to trustees should then cover the permanent fixes: separate named accounts, two-factor authentication, a password manager and phishing training.
3. The trustees ask whether the Friday USB copy counts as a backup. Advise them, and say what should replace it.
Read the worked answer
It is a copy, but it is not a backup in any useful sense. There is exactly one of it; it is unencrypted removable media; it lives in a handbag and then in one person's home, so the data is off-site without authorisation and exposed to loss, theft and household accidents; it is used for unrelated personal files, so it can carry malware back into the office; there is no schedule, no versioning, no log and no proof that it can be restored; and if the office machine and the drive are both lost, everything is gone. The charity cannot demonstrate care over the data, and it has no way of retrieving last week's version if a record is corrupted rather than deleted.
What should replace it is the 3-2-1 pattern: three copies, on two different types of medium, one of them off-site, with encryption, named access and a restore tested at least once a term. A cloud service with versioning plus an encrypted local drive would satisfy this at modest cost. The backup must itself be protected, because it holds the same personal data and the same legal duties. Finally, the trustees should adopt a retention rule: donors who have asked not to be contacted should have their contact data removed on a fixed schedule rather than kept indefinitely.