I85PREP
⌘ K
SEE Science & Technology study materials
SEE Science & Technology study resources

The Lab That Lost Its Exam Papers: Ranking Risks on Rs 25,000

SEE Science & Technology · Put your knowledge to work in context.

All case studies

The Lab That Lost Its Exam Papers: Ranking Risks on Rs 25,000

A community school in Butwal runs a 12-computer lab on a 4 Mbps ADSL line. The machines run an operating system that stopped receiving security updates two years ago; the antivirus trial expired eight months ago. All students log in to one shared account with no password, and homework is carried between home, cyber café and school on a single shared USB flash drive. Last month, on three computers, every folder became hidden and each document was replaced by a shortcut file of the same name; the flash drive was also affected. In the same month, a hard disk failed after a sudden power cut, and the only copy of the half-yearly examination papers, stored on that computer's desktop, was lost. Power cuts now last about five hours a week. The head teacher has Rs 25,000 and wants 'an antivirus CD' as the first purchase.

1. Rank the four risks and say how you would spend the Rs 25,000. Justify the order.

Read the worked answer

Ranking by impact × likelihood:

  1. No backup of examination papers - impact: irreplaceable; likelihood: certain while one copy sits on one desktop. Already happened once.
  2. Malware and USB worm - impact: medium to high (hidden files, lost work, staff time); likelihood: very high, already demonstrated. The shared USB and the password-free shared account make it easy.
  3. Unsupported operating system - impact: high (no patches, new malware stays unpatched); likelihood: certain over time.
  4. Power cuts and sudden shutdowns - impact: hardware loss, already one disk; likelihood: certain, five hours a week.

Spending plan with Rs 25,000:

  • 1 TB external hard disk plus an off-site copy, about Rs 7,000 - fixes risk 1.
  • Free supported operating system, free antivirus/Defender, AutoPlay and autorun disabled, per-student standard (non-administrator) accounts - near zero cost, fixes 2 and 3.
  • One 600–1,000 VA UPS, about Rs 8,000–12,000, for the office computer holding records - fixes 4.
  • Keep about Rs 3,000 for a surge protector and cables.

An antivirus CD alone leaves the unsupported system, the missing backup and the power risk untouched, so it is the wrong first purchase.

2. What do the symptoms tell you about this infection, and what is the cleaning procedure?

Read the worked answer

Hidden folders, shortcut files of the same name, rapid spread through a USB drive - that is the signature of a USB worm. It marks the real files hidden and system, writes an autorun.inf and .lnk shortcut files that point to its own executable, and copies itself onto every drive connected. The shared password-free account let it run without resistance.

Cleaning sequence:

  1. Disconnect from the network, unplug the USB, and disable AutoPlay on all machines.
  2. Update antivirus definitions on a clean machine and run a full scan; boot from clean media if the machine will not behave.
  3. Show hidden and system files, and at the command line run attrib -h -s -r /s /d on the affected folders.
  4. Delete the .lnk files and autorun.inf, and check startup entries and Task Manager for the running process.
  5. If the real documents are gone, attempt file recovery before any formatting; then restore from the new backup.
  6. Format and rebuild the USB, re-scan it, and keep one dedicated clean drive instead of the shared one.

Prevent recurrence by patching or replacing the operating system and running students as standard users.

3. Give three controls for safeguarding examination papers and explain what each one protects.

Read the worked answer
  1. Confidentiality - keep the paper encrypted (password-protected archive or encrypted USB) and stored offline in a locked cupboard, not on a lab desktop. With a shared password-free account, any student could open it. Only the head teacher and one deputy hold the password.
  2. Integrity - keep two dated copies, one on the external disk and one on an encrypted USB or cloud folder, and actually restore and open them to confirm the page count and content match. A corrupt backup is discovered on exam day, which is too late.
  3. Availability - keep a sealed printed copy or an off-site copy, for example at the head teacher's home, so a disk failure, theft or ransomware cannot stop the examination. Add least privilege: staff use their own accounts, students are standard users, and the master copy sits on an office machine without internet access.

The three map directly onto the confidentiality–integrity–availability triad for a single asset, and cost almost nothing beyond discipline and the external disk already in the budget.