BUS809 MIS Assignment 2026: Akwaaba Health Services Ransomware Case Study (MBA, Ghana)

BUS809 MIS Assignment 2026: Akwaaba Health Services Ransomware Case, Information Security and Business Continuity

This MBA management information systems assignment casts you as an MIS consultant to Akwaaba Health Services Ltd (AHSL), a private healthcare network headquartered in Accra that suffered a phishing-led ransomware and data-exfiltration incident on 5 October 2026. Each student works from personal case parameters based on their index number, analyses an evidence pack of email headers, authentication logs, Wi-Fi configuration and backup records, and then advises management on risk, controls, identity management, network design, recovery planning and security investment.

Instructions to Students (Summary)

• Act as an MIS Management Consultant advising AHSL management.
• The assignment is personalised: use the last digit of your index number for Table B1 (organisation size) and the second-to-last digit for Table B2 (financial exposure), and declare your parameters on the first page.
• Cite evidence exhibits by code and line (for example [E2-L07]); unsupported claims earn no marks.
• Calculations for Questions 3, 6 and 7 must be done in Excel with live formulas and the workbook submitted with the report.
• Part E requires a short security audit of a real organisation in Ghana; a 10-minute viva may be requested.
• Complete and sign the Academic Integrity and AI Use Declaration (Appendix C).

Case Summary: The Security Incident at AHSL

AHSL runs EMR, billing and NHIS/insurance claims, payroll, pharmacy and inventory systems and shared file servers across its branches. On Monday 5 October 2026, staff found files on shared drives renamed with a “.locked” extension and a ransom note. Investigation revealed six problem areas:

1. Weak password and account practices: shared generic accounts (such as “nurse01” and “frontdesk”), guessable passwords and active accounts for former staff, including an ex-IT Officer.
2. A spoofed “Finance Department” email that led staff to enter their credentials on an external site.
3. Unauthorised access to payroll files and the EMR database, with a large outbound data transfer.
4. Malware spread through cracked software, personal USB drives and local administrator rights.
5. An outdated wireless security standard with guest and staff networks on the same segment.
6. Incomplete backups that had never been test-restored and no disaster recovery or business continuity plan.

The evidence pack contains Exhibit E1 (suspicious email header), E2 (authentication and file-access log), E3 (wireless controller configuration), E4 (backup and recovery records) and E5 (IT Manager’s note to the CEO). Table B3 provides insurer risk data for five threat scenarios (ransomware, patient data breach, phishing-led payment fraud, wireless intrusion and insider misuse) with SLE bases, AROs and control package costs.

Assignment Tasks

Question 1: Forensic Analysis and Vulnerabilities (15 marks)

• a. Using Exhibits E1–E5, reconstruct a minute-by-minute timeline of the attack from 07:42 to 10:41 on 5 October 2026, as a table with columns: Time | Event | Evidence reference | Security failure that allowed it. (6 marks)
• b. Identify each possible initial access vector, state which one most likely led to the files being encrypted, defend your conclusion using specific log lines, and explain what further evidence you would ask the IT Department to collect. (5 marks)
• c. Identify four vulnerabilities supported by the evidence. For each, state the vulnerability, the risk it creates, how it affected or could affect AHSL given your organisation size (Table B1), and the evidence reference. (4 marks)

Question 2: Cybersecurity Threats and Legal Exposure (10 marks)

• a. Identify three computer crimes or cybersecurity threats evident in the case; explain each, show exactly how it appears in the evidence and its likely effect on AHSL. (6 marks)
• b. List five indicators that the email in Exhibit E1 was fraudulent and explain what “dmarc=fail (p=none)” tells you about AHSL’s own email security configuration. (2 marks)
• c. With reference to Ghana’s Data Protection Act, 2012 (Act 843) and the Cybersecurity Act, 2020 (Act 1038), advise the CEO on notification obligations, consequences of failing to notify and the evidence to preserve, citing the relevant provisions. (2 marks)

Question 3: Quantitative Risk Assessment and Control Selection (15 marks)

• a. Using your parameters (Tables B1 and B2) and the insurer’s data (Table B3), calculate in Excel for threats T1–T5 the SLE, ALE without and with the control, annual risk reduction and ROSI, and present them as a risk register. (6 marks)
• b. Determine the combination of control packages AHSL should fund within your security budget, state your decision rule and show the choice stays within budget. (5 marks)
• c. Discuss whether a control with negative ROSI should still be funded and the limitations of ALE/ROSI for a healthcare provider (patient safety, regulatory penalties, reputation). (4 marks)

Question 4: Design an Identity and Access Management (IAM) System (15 marks)

• a. Explain how AHSL should manage user accounts, authentication, authorisation, roles, privileges, onboarding, role changes, termination and activity monitoring, removing the weaknesses in Exhibits E2 and E5. (5 marks)
• b. Design an RBAC matrix for nine roles (Doctor, Nurse, Front Desk/Records Officer, Billing Officer, Pharmacist, HR Officer, Finance Manager, IT Officer, Locum Doctor) against EMR, Billing/NHIS claims, Payroll, Pharmacy/Inventory, File Server and Domain Administration using N/R/W/A, and identify at least two segregation-of-duties conflicts it prevents. (5 marks)
• c. Explain step by step how your design handles: a nurse promoted to Ward Manager; a two-week locum doctor; a Billing Officer serving notice after a dispute; 2:00 a.m. break-glass access to another branch’s record; and night-shift nurses who insist on sharing “nurse01”. (5 marks)

Question 5: Network and Wireless Security Design (10 marks)

• a. Using Exhibit E3, explain precisely why AHSL’s current wireless configuration is dangerous. (2 marks)
• b. Draw a network diagram for head office and your branches showing the firewall, separate VLANs/SSIDs for clinical, administration, guest/patient Wi-Fi and medical/IoT devices, the RADIUS server, VPN gateway and branch connectivity. (4 marks)
• c. Justify your recommendations on wireless security, authentication, encryption, VPN, secure remote access from personal laptops and separation of staff and visitor access. (4 marks)

Question 6: Disaster Recovery and Business Continuity Plan (15 marks)

• a. Explain the difference between DRP and BCP with an AHSL example of each. (2 marks)
• b. Carry out a Business Impact Analysis for EMR, Billing/NHIS claims, Payroll, Pharmacy/Inventory and Email/File Server: propose RTO and RPO and calculate the financial impact of 4-, 24- and 72-hour outages using your hourly revenue loss. (5 marks)
• c. Identify and justify the three systems to restore first, considering patient safety and the backup status in Exhibit E4. (3 marks)
• d. Design a 3-2-1 backup strategy that fixes every weakness in E4, plus a manual fallback procedure that lets a branch with no IT staff register, treat and bill patients for 48 hours without computers. (5 marks)

Question 7: Board Paper on Information Security Investment (10 marks)

• Write a board paper of no more than two pages that evaluates the Finance Director’s and IT Manager’s arguments, states your position with your Question 3 figures, proposes an annual method for setting the security budget with quarterly key risk indicators, and presents a 90-day action plan (Days 1–7, 8–30, 31–90) with owners and estimated costs.

Question 8: Field Application, Real Organisation Security Audit (10 marks)

• Interview the IT or administration lead at a real organisation in Ghana using the 12-item checklist (Appendix A); present the scored checklist out of 24, compare the organisation with AHSL’s six incidents, recommend three costed improvements and attach the signed Field Audit Confirmation Form (Appendix B).

Submission Requirements

• Three files: the report (PDF), the Excel workings with live formulas, and the signed field form (PDF).
• A4, 12-point Times New Roman or 11-point Calibri, 1.5 line spacing, index number in the header of every page.
• Front matter: cover page, signed declaration, Parameter Declaration table, then answers in question order.
• Late submissions lose 10 marks per day and are not accepted after 3 November 2026; similarity and AI-content checks apply.

The post BUS809 MIS Assignment 2026: Akwaaba Health Services Ransomware Case Study (MBA, Ghana) appeared first on Students Assignment Main.