Theory: How to Approach These
This in-class case introduces security as a management issue: you are asked to reason about assets, people and business consequences before the technical cause is known.
- Assets go beyond technology (see 1.1 and 1.3): include data, services, people and reputation, not just servers.
- Stakeholders: for each one, ask “how does this outage hurt them?” and “how urgently do they need to hear from us?”
- CIA analysis (see 1.2): answer the three questions separately: was anything seen, changed, or blocked? Mark what is confirmed versus possible but unknown.
- Business impact (see 1.1): split into short-term (hours/days) and long-term (months/years); cover operational, financial, legal and reputational impact.
- Management priorities (see 1.3): think like the security manager. Protect people and core services, keep stakeholders informed, and do not destroy the evidence you will need later.
- For discussion questions there is no single right answer; graders look for a clear choice plus a justification tied to the facts of the case.
The Case
It is the first day of semester registration at a university that depends heavily on digital services: registration, tuition payment, learning management (LMS), email, library access and research systems all run on shared infrastructure. The IT team suspects a cyber incident, but the root cause is still unknown.
| Time | Event |
|---|
| 08:30 | Students report that the online registration system is unavailable. |
| 08:40 | The help desk receives hundreds of calls. |
| 09:00 | The LMS and email become unavailable (the student portal and authentication service also go down within minutes of the first reports). |
| 09:30 | The executive committee requests a status update. |
| 10:00 | Reports begin spreading on social media. |
| 11:00 | The media contacts the university. |
Stakeholders: students, lecturers, the Registrar Office, university executives, the IT Department, parents, government agencies and the media.
Notice the pattern: the technical problem (unavailable systems) spreads within 30 minutes; the business problem (executives, social media, press) escalates within 2.5 hours, while the cause is still unknown.
Case Questions & Model Answers
Exercise Activity 1
Identify Information Assets. List the university’s key information assets, explain why each is valuable, and give each a priority (H/M/L).
Show solution ↓Hide solution ↑
Solution
Start from the services named in the case, then add the shared infrastructure and intangible assets they depend on.
| Asset | Why is it valuable? | Priority |
|---|
| Authentication service (single sign-on) | Every other system depends on it; if it is down, everything is effectively down | H |
| Registration system and student records database | Core business process today; holds enrolment and personal data protected by the PDPA | H |
| Tuition payment system | Revenue; handles financial data | H |
| Shared network / data-centre infrastructure | Single point of failure underneath all services | H |
| Learning Management System (LMS) | Teaching and coursework delivery | M |
| Email | Main communication channel with students and staff, needed to manage the crisis itself | M |
| Research systems and data | Intellectual property and grant obligations; less time-critical today | M |
| Library access | Useful but can wait | L |
| University reputation and student trust (intangible) | Affects future enrolment, rankings and funding | H |
| IT staff knowledge (people) | Only they can diagnose and restore systems | H |
Model answer: authentication, the registration/student-records system, payment, the shared infrastructure, reputation and key IT staff are High; LMS, email and research are Medium; library access is Low. On registration day, priority is driven by what the business needs today.
Exercise Activity 2
Stakeholder Analysis. For each stakeholder, describe how they are affected and assign a priority.
Show solution ↓Hide solution ↑
Solution
| Stakeholder | How are they affected? | Priority |
|---|
| Students | Cannot register for courses (risk of losing seats or missing deadlines), pay tuition or reach the LMS; anxiety; worry their data is exposed | High |
| University executives | Accountable for the decision-making, the public response and legal exposure; need accurate information to act | High |
| IT Department | Under pressure to diagnose and restore; overwhelmed by help-desk calls | High |
| Registrar Office | Its core process today has stopped; must decide on deadline extensions | High |
| Lecturers | Cannot use the LMS or email; classes and class lists disrupted | Medium |
| Parents | Worried about their children’s registration and fees; may contact the university or media | Medium |
| Government agencies | May need to be notified (e.g., if personal data was breached, or if it is a reportable cyber incident) | Medium (High if a breach is confirmed) |
| Media | Will report with or without the university’s input; shape public perception | Medium (rising quickly after 10:00) |
Students are the most directly affected; executives must be informed first internally because they make the decisions that affect everyone else.
Exercise Activity 3
CIA Analysis. Analyze the incident against Confidentiality, Integrity and Availability.
Show solution ↓Hide solution ↑
Solution
Answer each leg separately, marking what is confirmed and what is still unknown.
| Confidentiality | Integrity | Availability |
|---|
| Status | Unknown / possibly affected | Unknown / possibly affected | Confirmed violated |
| Reasoning | If this is a cyber attack (e.g., ransomware), the attacker may have copied student personal and payment data before disrupting services. No evidence yet. | An attacker with system access could have altered registration, grade or payment records. Records must be verified before being trusted again. | Registration, the student portal, authentication, LMS and email are all inaccessible to authorized users. |
Availability is the confirmed and most severely affected leg; Confidentiality and Integrity must be treated as possibly compromised until the investigation rules them out.
Exercise Activity 4
Business Impact. Identify the short-term and long-term impacts of the incident.
Show solution ↓Hide solution ↑
Solution
| Impact | Short-term | Long-term |
|---|
| Operational | Registration and teaching halted; help desk overwhelmed; staff cannot communicate by email | Registration calendar disrupted; possible need to rebuild systems; staff time diverted for weeks |
| Financial | Delayed tuition payments; overtime and emergency recovery costs | Investment in new security controls; possible fines or legal costs; lost future enrolment |
| Legal / compliance | Possible duty to notify regulators if personal data was breached | Regulatory investigation, lawsuits, audit findings |
| Reputational | Negative social media and press coverage by 10:00–11:00; angry students and parents | Damaged trust and rankings; prospective students choose other universities |
The short-term impact is disruption and public embarrassment; the long-term impact, especially reputation and possible legal consequences, is often larger and lasts longer.
Exercise Activity 5
Management Priorities. Rank the following actions from 1 (highest priority) to 5: Restore critical services, Inform stakeholders, Investigate the incident, Contact external agencies, Preserve evidence.
Show solution ↓Hide solution ↑
Solution
There is no single official ranking; graders look for a defensible order with reasons. A strong model answer:
| Rank | Action | Justification |
|---|
| 1 | Preserve evidence | Takes little time (capture logs, snapshot affected systems) but must be done before restoration, because rebuilding or rebooting systems destroys the evidence needed to find the cause and to stop it happening again. |
| 2 | Restore critical services | Registration day: the business needs authentication and registration back. Restore from known-clean systems so the attacker is not let back in. |
| 3 | Inform stakeholders | By 10:00 social media is spreading rumours. A short, honest status message (what is known, what is being done, when the next update comes) prevents panic; registration deadlines can be extended. |
| 4 | Investigate the incident | The full root-cause investigation runs alongside recovery and continues after services return. |
| 5 | Contact external agencies | Needed (e.g., national cyber authorities, police, and the data protection regulator if personal data was breached), but usually once the facts are clearer. |
In practice items 1–3 happen almost in parallel with different teams. An alternative ranking that puts Restore critical services first is acceptable if it explicitly says evidence must be preserved during restoration. Ranking Contact external agencies higher is also defensible once a personal-data breach is suspected, because data protection law sets notification deadlines.
Model ranking: 1 Preserve evidence, 2 Restore critical services, 3 Inform stakeholders, 4 Investigate, 5 Contact external agencies.
Exercise Discussion 1
What are the most valuable assets, and which one is the most critical asset?
Show solution ↓Hide solution ↑
Solution
The most valuable assets are the authentication service, the registration and student-records system, the payment system, the shared infrastructure and the university’s reputation.
The most critical is the authentication service (and the shared infrastructure it runs on). Reasoning: every other service (registration, portal, LMS, email) needs users to log in, so when authentication fails, all of them fail together. It is a single point of failure. The registration system is the most valuable on this particular day, but it cannot be restored usefully without authentication.
Key grader points: names non-technical assets too (reputation, people); identifies dependency/single point of failure as the reason for criticality.
Exercise Discussion 2
Who are the affected stakeholders, and which stakeholder should be informed first?
Show solution ↓Hide solution ↑
Solution
All eight stakeholders are affected (students, lecturers, Registrar Office, executives, IT, parents, government agencies, media), with students most directly harmed.
The university executives should be informed first, because they hold the authority to make decisions: approve emergency spending, extend registration deadlines, decide public messaging and decide when to notify authorities. Ideally this happens well before 09:30, when they had to ask for an update. Immediately after, students (the largest affected group) need a clear public status message, before social media fills the gap at 10:00.
Key grader points: distinguishes “most affected” (students) from “informed first” (decision-makers); notes the executives should not have had to ask.
Exercise Discussion 3
Which parts of the CIA Triad are affected, and which one is the most?
Show solution ↓Hide solution ↑
Solution
Availability is confirmed and is affected the most: registration, the portal, authentication, LMS and email are all unavailable to authorized users on the busiest day of the semester.
Confidentiality and Integrity are potentially affected. If the cause is a cyber attack, the attacker may have stolen personal data or altered records. Management should treat both as at risk until the investigation proves otherwise, rather than assuming “it’s only an outage.”
Key grader points: separates confirmed from suspected impacts; picks Availability as most affected with a reason.
Exercise Discussion 4
What business impacts occur before we even know the technical cause?
Show solution ↓Hide solution ↑
Solution
Within the first 2.5 hours, with the cause still unknown:
- Operational: registration and teaching stop; hundreds of help-desk calls swamp IT staff.
- Financial: tuition payments are delayed; emergency staff costs begin.
- Reputational: social-media criticism at 10:00 and media enquiries at 11:00.
- Governance pressure: executives demand answers at 09:30.
- Student harm: stress, risk of losing course places or missing deadlines.
The lesson: business impact does not wait for root-cause analysis. The organization must manage impact (communication, workarounds, deadline extensions) in parallel with the technical investigation. This is precisely why security is a management issue, not only a technical one.
Key grader points: covers several impact types; draws the conclusion that management must act before the technical facts are known.
Exercise Discussion 5
What would you recommend to the university president during the first hour?
Show solution ↓Hide solution ↑
Solution
A strong first-hour recommendation:
- Activate the incident response team with a single incident lead and a clear chain of command; schedule regular status updates (e.g., every 30 minutes).
- Contain and preserve: isolate affected systems to stop any spread, and preserve logs and system images before anything is rebuilt.
- Prioritize restoring authentication and registration from known-clean systems, since everything else depends on them.
- Communicate early and honestly: a short public statement to students and staff (what we know, what we’re doing, when the next update is) and a help-desk script to cut call volume. Do not speculate about the cause.
- Reduce business pressure: announce that registration deadlines will be extended, so students do not panic.
- Prepare for legal obligations: involve legal counsel / the data protection officer to assess whether personal data was exposed and whether regulators must be notified.
- Prepare a media holding statement before 11:00, with one designated spokesperson.
Key grader points: covers response leadership, containment/evidence, recovery priority, stakeholder communication and legal readiness: decisions, not tools.