Problem-Based Learning (PBL) Scenario
Title: The "Medi-Secure" Ransomware & Expansion Crisis
The Problem Scenario
You are a team of junior security consultants hired by Medi-Secure, a mid-sized regional
hospital. The hospital has two major issues:
1. The Crisis: This morning, the hospital’s primary patient database became inaccessible. A
digital note appeared on the screens of nursing stations demanding 50 Bitcoin to
"unlock" the data. Patient surgeries are being postponed because doctors cannot access
medical histories.
2. The Expansion: Next month, the hospital plans to open a "Telehealth Wing" where
doctors will work remotely and patients will connect via an unencrypted mobile app.
The hospital Board of Directors wants to know if they are "secure enough" to proceed
while still dealing with the current attack.
Student Tasks:
Identify which security principles were violated.
Propose an immediate Incident Response plan.
Design a secure network architecture for the new Telehealth Wing using ISC2 concepts.
PBL Solution
1. Security Principles & Governance (Domain 1)
Analysis: The ransomware attack is a violation of Availability (data is locked) and
potentially Integrity (if data was altered).
Solution: Recommend a Risk Treatment strategy of "Mitigation" by implementing offline
backups. Establish an Administrative Control (Acceptable Use Policy) to prevent staff
from clicking phishing links, which likely started the attack.
2. Incident Response & BC/DR (Domain 2)
Analysis: The hospital is currently in the "Detection and Analysis" phase of Incident
Response.
Solution: * Immediate Action: Isolate infected segments of the network (Containment).
o BC Plan: Switch to "Paper-based charting" to keep the hospital running while
systems are down.
o DR Plan: Restore the database from the last known "clean" backup (prioritize
patient history).
3. Access Controls (Domain 3)
Analysis: If the ransomware spread from a nurse’s station to the main server,
Segregation of Duties or Least Privilege failed.
Solution: Implement Role-Based Access Control (RBAC). A nurse should not have
administrative rights to the database server. Implement MFA (Multi-Factor
Authentication) for all logins to prevent credential harvesting.
4. Network Security (Domain 4)
Analysis: The proposed Telehealth Wing is high risk.
Solution: * Network Segmentation: Place the Telehealth servers in a DMZ
(Demilitarized Zone).
o Encryption: Use VPNs (Virtual Private Networks) for doctors working remotely.
o Defense in Depth: Use a combination of Firewalls and NIDS (Network Intrusion
Detection Systems) to monitor for unusual traffic patterns.
5. Security Operations (Domain 5)
Analysis: Systems are likely unpatched, allowing the ransomware to exploit
vulnerabilities.
Solution:
o System Hardening: Disable unnecessary ports and services on medical devices.
o Awareness: Launch a mandatory "Security Awareness Training" program focusing
on Social Engineering (phishing) for all hospital staff.