Two point four terabytes, one shared password
A 22-person accountancy firm in Dunedin holds 2.4 TB of client financial records on a single NAS, mapped as a drive on every PC. Backups copy nightly to a USB drive that is swapped weekly and kept in the office manager's desk drawer. Staff use Microsoft 365 with MFA, but the NAS has one shared admin password written on a card in the server cupboard. Three months ago a receptionist entered her Microsoft credentials on a phishing page; nothing visible happened, and nothing was reported beyond her telling a colleague. The firm has NZD 9,000 for security this year and a partner who says ‘we're too small to be a target’. Client records must be kept for seven years.
1. Rank the firm's risks. Justify your ranking in terms of likelihood, impact, and whether controls are correlated.
Read the worked answer
1. The NAS itself. One shared admin password on a card, mapped as a drive to every PC. Any user, opening any attachment, can encrypt 2.4 TB of records the firm is legally required to retain for seven years. Likelihood is moderate to high; impact is severe and, without a working backup, irreversible. A shared credential also destroys accountability - you cannot tell who did what.
2. The backup. Nightly to a USB drive in a desk drawer in the same building, rotated weekly. Fire, theft and ransomware all hit both copies. Worse, a weekly rotation means up to seven days of the ‘clean’ copy can be overwritten before anyone notices encryption. The backup shares a failure mode with the primary, which is the definition of a correlated control failure.
3. Identity and detection. The phishing incident is current evidence, not history: credentials may still be in use, MFA does not cover the NAS, and there is no monitoring, so nobody would know if the NAS were being encrypted right now.
On ‘too small to be a target’: the phishing email already reached the receptionist. Small firms are targeted by volume, automated campaigns precisely because nobody is watching. The firm is not too small to be a target; it is too small to notice.
2. Allocate the NZD 9,000. Justify each line, and state what you would deliberately defer and why.
Read the worked answer
Spend on risk reduction, not on products.
Access control (roughly $0–1,500). Individual NAS accounts, least privilege, removal of drive mappings in favour of access as needed, rotation of the admin password, MFA on any remote access. Mostly configuration time with a contractor. This is the cheapest large risk reduction available and should be done first because it shrinks the blast radius before anything else matters.
Backup (roughly $3,000–4,000). A cloud backup subscription sized for 2.4 TB, plus one offline USB rotated off-site (a partner takes it home). The rule is three copies, two media, one offline or off-site - and it must be restore-tested, because a backup that has never been restored is a hope, not a control.
Identity hardening (roughly $1,000–2,000). A password manager, and an M365 licence upgrade if that is what unlocks conditional access.
People (roughly $500–1,000). Short quarterly phishing awareness, with a blame-free reporting route.
Contingency (roughly $1,000) for the restore test and the inevitable surprises.
Defer: network segmentation, endpoint detection and response, and a penetration test. All are real risks, but they reduce risk less than the three items above for this budget. Write the deferral down with a review date so it is a decision, not an omission. Figures are indicative; get quotes.
3. How would you know whether these changes actually worked? Give measures that test the control, not the intention.
Read the worked answer
Measure the control, not the activity.
Restore. Quarterly, take the off-site copy, restore to a clean machine, and record whether files opened and how long it took. The measure is ‘restore succeeded in X hours’, not ‘backups are running’. Set a target from the firm's tolerance for lost time.
Access. Count accounts with admin rights (target one or two named people), count mapped drives to the NAS (target zero), and report the percentage of accounts with MFA. These are countable facts, not impressions.
Exposure. Maximum hours of data that could be lost if ransomware hit now (target 24 or less), and whether any copy exists that the firm's own network cannot reach.
Behaviour. Phishing simulation click rate over three consecutive quarters, and - more useful - the rate at which staff report suspicious email. The receptionist telling a colleague was a reporting signal; the failure was that there was no route and no response, which is what you are fixing.
Detection. Can the firm tell within a working day that a file share is being bulk-encrypted? Small firms cannot staff 24/7 monitoring, but they can enable alerting and review logs weekly.
Review annually against the seven-year retention obligation, and record the review.