Project 3 Scenario Update Suspicious Microsoft 365 Account Activity SCHN recently experienced a security incident involving an employee in the centralized billing office. The employee received an email that appeared to be a Mi
2 min read Project 3 Scenario Update
Suspicious Microsoft 365 Account Activity
SCHN recently experienced a security incident involving an employee in the centralized billing office.
The employee received an email that appeared to be a Microsoft 365 security notification. The message directed the employee to a website that closely resembled the Microsoft sign-in page. The employee entered a username and password, then became suspicious and contacted the help desk.
The IT department reset the employee's password approximately 30 minutes later.
A preliminary review identified the following:
A successful login to the employee's Microsoft 365 account occurred from an unfamiliar Internet address shortly after the employee entered the credentials.
A new email forwarding rule had been created in the employee's mailbox.
The employee routinely communicates by email with insurance companies, patients, healthcare partners, and other SCHN employees.
The employee has access to billing, claims, insurance, and patient-related information required to perform the job.
SCHN has not determined whether sensitive information was accessed or removed.
No evidence currently indicates that the electronic health record was accessed through the compromised account.
IT personnel are continuing to investigate.
Executive leadership wants to know whether this incident is isolated or evidence of broader exposure within SCHN.
Important
Do not assume that a major data breach occurred.
Do not assume that SCHN is secure simply because a breach has not been confirmed.
Treat the available information as incomplete evidence that must be analyzed.
Assignment
Prepare a Threat, Vulnerability, and Exploit Analysis for SCHN.
Your analysis must connect realistic threats to specific organizational assets, business activities, vulnerabilities, and potential exploitation methods.
You are expected to exercise professional judgment.
Do not simply generate a generic list of cybersecurity threats. AI Prompt and Evaluation Log Include an AI Prompt and Evaluation Log based on your project.
You must document at least three meaningful AI interactions that contributed to your work.
The three interactions should demonstrate the development of your analysis rather than four slightly different versions of the same prompt.
At least one interaction must demonstrate that you challenged, corrected, substantially revised, or rejected part of an AI response.
