Ransomware at a Twelve-Partner Accounting Firm
A twelve-partner accounting firm of 40 staff runs a Windows file server, a cloud accounting portal and one firewall. Last month a partner opened an email attachment named Invoice_9281.zip. Within two hours the shared folders were encrypted, and so was the USB backup drive that stayed plugged in overnight. The firm paid RM40,000 for recovery and lost three working days. A review found: 9 of 40 accounts hold local administrator rights; the portal uses one shared login, firmadmin, with the password on a note in the server room; four PCs still run Windows 7; staff reuse the same password on the portal and personal email; there is no written incident procedure and no successful test restore in two years; and client tax files sit on the file server with no classification. The firm has RM25,000 and one IT officer.
1. Map the incident onto initial access, privilege escalation, lateral movement, impact and recovery, and name the control that failed at each stage.
Read the worked answer
| Stage | What happened | Control that failed |
|---|---|---|
| Initial access | Partner opened a malicious zip attachment | Email filtering and, more importantly, user behaviour - no routine for verifying unexpected invoices |
| Execution / privilege | The payload ran in the partner's session, which held local administrator rights | Least privilege: 9 of 40 accounts were administrators, so no elevation barrier existed |
| Lateral movement | Within two hours shared folders across the server were encrypted | Flat file-share permissions: one set of credentials reached every shared folder, and unpatched Windows 7 hosts offered easy targets |
| Impact | Files encrypted, three days lost, RM40,000 spent | No network segmentation or file classification, so everything was reachable from one workstation |
| Recovery | The USB backup was encrypted too | Backup design: a permanently connected drive is online and therefore in scope. No offline or immutable copy, no tested restore |
The shared 'firmadmin' portal login belongs here too: it is a credential that cannot be attributed to a person, so even after the event the firm cannot say who used it or when. Notice that antivirus alone would not have saved this firm - the decisive failures are privilege, segmentation and backup architecture, which are design choices, not signature updates.
2. Propose a remediation plan in priority order for RM25,000 and one IT officer, justifying each item and stating what you would defer.
Read the worked answer
Priority 1 - remove standing administrator rights (cost: staff time). Reduce to two named admin accounts used only for installation, with day-to-day accounts as standard users. Likelihood is high that phishing recurs; impact of an admin session is total; cost is near zero. This is the single largest reduction in risk per ringgit.
Priority 2 - rebuild the backup as 3-2-1 with one offline copy (about RM6,000-8,000). Three copies, two media, one off-site; the removable drive is connected only for the backup window and disconnected afterwards, and a cloud copy is versioned and immutable. Test a restore quarterly and record the result. Without this, every other control only reduces the chance of an incident; this one determines whether the firm survives it.
Priority 3 - MFA and individual named accounts on the cloud portal (low cost). Kills the shared-password-on-a-note problem, gives attribution and audit logs, and blocks credential reuse from personal email breaches.
Priority 4 - patch or replace the four Windows 7 PCs (about RM8,000). Unsupported systems cannot be fixed, only removed or isolated; put them on a separate segment until replaced.
Priority 5 - a one-page incident procedure with contact list, isolation steps and notification duties. Written by the IT officer, tested in a tabletop exercise.
Defer: a full EDR suite and a new firewall - valuable, but they cost more than the remaining budget and rank below privilege and backup. Also defer a phishing simulation programme until the standard-user change has settled. Sequence matters: backup first if the firm cannot tolerate another three-day loss, because a working restore is the only control that bounds the impact of the failure that has already happened once.
3. State two legal or ethical obligations the firm owes its clients after this incident, and one action that would be tempting but wrong.
Read the worked answer
Obligation 1 - notify affected clients honestly and promptly. The firm holds tax and financial records, so it must determine which client files were encrypted or could have been copied and inform those clients in plain language: what happened, what data was involved, what the firm has done, and what the client should watch for. The firm must also comply with the data-protection notification duties that apply to it, including notifying the regulator where the threshold is met, and must not delay notification to protect its reputation.
Obligation 2 - preserve evidence and maintain confidentiality during recovery. Logs and disk images must be secured before rebuilding, both for the regulator and for any insurance claim, and client data must not be handed to an outside recovery vendor without a confidentiality agreement and a defined scope. Confidentiality does not lapse because the firm is under pressure.
Tempting but wrong: quietly paying the ransom and saying nothing. Paying does not guarantee recovery - the backup was encrypted precisely because it was reachable - it funds criminal activity, and concealment converts a technical incident into a professional-ethics and possibly legal failure. Equally wrong: blaming and dismissing the partner who opened the attachment, which guarantees that the next person hides a click instead of reporting it within minutes. A blame-free reporting route is a control, not a courtesy.