Scenario

ECHRS Ltd are based in Bradford and provide a telephone and web-portal outsourcing service for human resources records and payroll for a range of companies across diverse sectors.

A specialist division of ECHRS based in Leicester handles occupational health services via a pool of doctors and nurses on casual zero-hours contracts. Their contact with external clients is normally via the ECHRS staff at Bradford. 

The Bradford site has the following IT infrastructure:

• desktop PCs, mostly Windows 10;

• a large, customised web server running IIS on Windows Server 2012 R2 with Remote Desktop Services;

• VoIP telephony server / Fax. 

Backups are via tape and stored in a fireproof safe at Bradford. ECHRS’s web and email is provided via GoDaddy and cPanel configuration.  Occupational health services division staff based at Leicester use remote desktops (served via the Bradford remote desktop services). The workstations themselves are a mixture of very old Windows XP devices all the way up to powerful Windows 10 machines.  All staff have access to email via the GoDaddy service; many are known to access it via personal devices (mobile phones and tablets). 

Occupational health services doctors and nurses sometimes visit employees of external clients at their home address or workplace. They are known to make notes on their own devices prior to writing reports via the remote desktop services. Some access the remote desktop services from their home PCs

ECHRS believe that they have suffered an intrusion. This is because a large amount of data has been found by a third party on a web forum accessed via I2P (Invisible Internet Project). The third party has reported this to ECHRS via anonymous email. The data is reported as containing a substantial amount of personal and payroll data for many (but not all) external client companies, which is not compliant with the GDPR. There are also a small number of detailed occupational health reports on external client employees. 

You have been brought in as an external security specialist. 

Task

1. Explain the consequences of the event, including non-compliance with the GDPR.

2. Explain how you would investigate this intrusion.

3. Make recommendations for immediate actions to limit the compromise. You should make reasonable assumptions about the possible means of intrusion.

4. Identify the other potential means of information leakage (based on the scenario) if there was no intrusion.

5. Make recommendations for future security at ECHRS.

6. Describe, with rationale, the relevance of this ICA to you and your future employment and how you believe it could be improved 

Read less