Akwaaba Health Services MIS Security Case Study: ALE, ROSI and RBAC Model Answer Extract
For information and reference only – not to be submitted as your own work.
Brief overview
This is a personalised Masters-level Management Information Systems (MIS) assignment set in Ghana. The student acts as a consultant to Akwaaba Health Services Ltd (AHSL), a private healthcare group whose shared drives were encrypted after a phishing email, weak remote-access controls and a cluster of dormant accounts. Eight questions cover forensics, Ghanaian law, a quantitative risk register, identity and access management (IAM), network redesign, disaster recovery, a board paper and a field audit. Every figure must come from the student’s own index-based parameters, and every claim must cite an evidence line. This extract answers selected parts only.
Reviewed by: Liam O’Connor, Bachelor of IT & Cybersecurity Expert (information technology and cybersecurity; 16 years’ experience, as shown on his profile).
Looking for the approach rather than the answers? Read how to structure this kind of security case-study assignment, or see the original assignment question.
Parameter declaration (illustrative)
The brief assigns each student a row from two tables, selected by the last two digits of the index number. This extract uses one illustrative set only: last digit 7 and second-to-last digit 3. A real submission must use the student’s own digits; a different digit pair changes every number below.
| Parameter | Illustrative value |
|---|---|
| Branches | 11 |
| Employees | 500 |
| Patient records held | 180,000 |
| Annual revenue | GH¢50 million |
| Revenue lost per hour of outage | GH¢5,500 |
| Compromised staff accounts | 25 |
| Maximum security budget | GH¢300,000 |
| Cost per breached patient record | GH¢70 |
Q1a: Forensic timeline, 07:42 to 10:41 on 5 October 2026
The timeline below merges the email header (Exhibit E1) with the domain controller and file server log (Exhibit E2). The last column matters most: it names the control that was missing at each step.
| Time (GMT) | Event | Evidence | Security failure |
|---|---|---|---|
| 07:42 | Spoofed “Finance Department” email sent to all staff | [E1-L07, L04] | SPF and DMARC failed but the message was still delivered [E1-L03] |
| 08:06 | Billing officer’s browser requests the look-alike login page | [E2-L03] | No web filtering; no phishing awareness training |
| 08:12–08:14 | 37 failed logons against the shared nurse01 account | [E2-L04] | No lockout or alerting; shared account |
| 08:14 | nurse01 logs in over VPN, password only | [E2-L05] | No multi-factor authentication (MFA) [E5-L01] |
| 08:15 | Billing officer’s account used over VPN from 198.51.100.23 | [E2-L06] | Phished password accepted without MFA |
| 08:22 | Ex-IT officer’s account logs in from the same address | [E2-L07] | Account active five months after departure [E5-L02] |
| 08:23 | svc_backup2 created and added to Domain Admins | [E2-L08] | No privileged-group change alert |
| 08:31 | Payroll workbook read | [E2-L09] | Excess access to HR share |
| 08:33 | Whole patient master table queried | [E2-L10] | No query-volume control on the EMR database |
| 08:40 | 2.3 GB leaves EMR-DB for 198.51.100.23 | [E2-L11] | Outbound firewall rule allowed it; no data loss prevention |
| 09:05–09:06 | USB mounted at a pharmacy PC, cracked software run, antivirus disabled | [E2-L12–L14] | Local admin rights [E5-L03]; no USB control |
| 09:31–09:47 | Pharmacy (4,118 files) and Billing (9,872 files) renamed .locked | [E2-L15, L16] | Domain-admin rights available to an attacker-created account |
| 10:20–10:41 | Ransom note created; billing officer’s account locked out | [E2-L17, L18] | Containment began only after encryption |
Q1b: Entry vectors and the most likely route to encryption
Four possible entry points appear. First, credential phishing through the fake payroll email, which ended in a working VPN login for the billing officer [E1-L11; E2-L03, L06]. Second, password guessing against nurse01 from a different address, 203.0.113.45 [E2-L04, L05]. Third, the orphaned ex-IT officer account [E2-L07]. Fourth, an infected or pirated installer brought in on a USB drive [E2-L12, L13].
The encryption itself was carried out by svc_backup2 [E2-L15, L16], an account created at 08:23 from the ex-IT officer’s session [E2-L08]. That makes the orphaned account the decisive foothold: it supplied the Domain Admin rights that made mass renaming possible. The phishing email is the probable source of the first credentials, because the billing officer’s VPN session and the ex-IT officer’s session share one source address [E2-L06, L07] and the same address received the 2.3 GB transfer [E2-L11]. I would therefore argue for a single intruder using a chain, rather than four independent breaches.
The USB event is the weakest candidate. It occurs at 09:05, after privilege escalation and exfiltration, and the files were renamed under a different identity. It remains a genuine vulnerability, but it does not explain the encryption.
To confirm the chain, I would ask the IT Department for VPN concentrator and firewall logs, the mail-gateway delivery record for the ex-officer’s mailbox, domain controller security events for account creation and group changes, an EDR or memory image from the pharmacy PC, and the ransom note and sample file for analysis (Cybersecurity and Infrastructure Security Agency et al., 2023; Nelson et al., 2025).
Q3a: Risk register for the illustrative parameters
Formulas follow the insurer’s definitions: ALE = SLE × ARO; annual risk reduction = ALE before − ALE after; ROSI = (reduction − annual control cost) ÷ annual control cost (Sonnenreich et al., 2005).
| Threat | SLE (GH¢) | ARO before / after | ALE before (GH¢) | ALE after (GH¢) | Reduction (GH¢) | Control cost (GH¢) | ROSI |
|---|---|---|---|---|---|---|---|
| T1 Ransomware | 546,000 | 0.35 / 0.07 | 191,100 | 38,220 | 152,880 | 180,000 | −15.1% |
| T2 Patient data breach | 3,780,000 | 0.25 / 0.08 | 945,000 | 302,400 | 642,600 | 140,000 | 359.0% |
| T3 Payroll fraud | 750,000 | 0.60 / 0.15 | 450,000 | 112,500 | 337,500 | 60,000 | 462.5% |
| T4 Wireless intrusion | 132,000 | 0.50 / 0.10 | 66,000 | 13,200 | 52,800 | 75,000 | −29.6% |
| T5 Insider misuse | 830,000 | 0.80 / 0.20 | 664,000 | 166,000 | 498,000 | 120,000 | 315.0% |
Workings for two rows. T1: SLE = 72 × 5,500 + 150,000 = 546,000. T5: SLE = 25 × 8,000 + 5% × 180,000 × 70 = 200,000 + 630,000 = 830,000. Across all five threats, ALE before is GH¢2,316,100 and ALE after is GH¢632,320.
Q3b: Choosing controls within the GH¢300,000 budget
Decision rule: maximise total net benefit (risk reduction minus control cost) subject to the budget, then test the result against regulatory and patient-safety priorities. All five packages cost GH¢575,000, so something must be left out. I tested every feasible combination; the best is T2 plus T5.
- T2 + T5: cost GH¢260,000; reduction GH¢1,140,600; net benefit GH¢880,600.
- T2 + T3: cost GH¢200,000; net benefit GH¢780,100.
- T2 + T3 + T4: cost GH¢275,000; net benefit GH¢757,900.
- T2 + T3 + T5 would give the highest benefit but costs GH¢320,000, GH¢20,000 over budget, so it fails.
The recommended pair leaves GH¢40,000 unspent. I would use part of it for low-cost wins outside the packages, such as moving DMARC from p=none to enforcement [E1-L03], and request the GH¢20,000 shortfall for T3 as a supplementary item. The package for T1 shows a negative ROSI here, but ransomware is the incident that actually happened. Part (c) of the question tests whether you can argue that patient safety and regulatory exposure justify it anyway (NIST, 2024).
Get help with your own parameter set
If your own numbers are not behaving, our risk management assignment help page explains how model answers are prepared, and the MIS assignment help page covers the wider subject.
Q4b: RBAC matrix extract
Codes: N none, R read, W read/write, A administer. The design follows least privilege; a Front Desk write right on the EMR is restricted to demographic fields, and the locum’s rights expire automatically on the contract end date.
| Role | EMR | Billing/NHIS | Payroll | Pharmacy | File server | Domain admin |
|---|---|---|---|---|---|---|
| Doctor | W | R | N | R | R | N |
| Nurse | W | N | N | R | R | N |
| Front Desk/Records | W (demographics) | N | N | N | R | N |
| Billing Officer | R | W | N | N | R | N |
| Pharmacist | R | N | N | W | R | N |
| HR Officer | N | N | W | N | R | N |
| Finance Manager | N | R | R | R | W | N |
| IT Officer | A | A | N | A | A | A |
| Locum Doctor | W (time-limited) | N | N | R | N | N |
Two segregation-of-duties conflicts this design prevents. First, the HR Officer creates payroll records but only the Finance Manager approves payment, so one person cannot invent and pay a ghost employee. Second, the Billing Officer enters claims but cannot change prescriptions or clinical notes, and the Finance Manager holds read-only billing access, so claim write-offs need a second person. The IT Officer administers systems but has no payroll access, which separates technical control from sensitive business data [E5-L02, L03].
Q6: Business impact analysis, RTO and RPO
A Business Impact Analysis (BIA) ranks systems by the harm of losing them and sets recovery targets (Swanson et al., 2010). The shares below are my stated assumptions, allocating the GH¢5,500 hourly loss across the five systems.
| System | Share of hourly loss | RTO | RPO | 4 h (GH¢) | 24 h (GH¢) | 72 h (GH¢) |
|---|---|---|---|---|---|---|
| EMR | 35% | 2 h | 15 min | 7,700 | 46,200 | 138,600 |
| Billing/NHIS claims | 30% | 12 h | 4 h | 6,600 | 39,600 | 118,800 |
| Pharmacy/Inventory | 20% | 4 h | 1 h | 4,400 | 26,400 | 79,200 |
| Email/File server | 10% | 24 h | 4 h | 2,200 | 13,200 | 39,600 |
| Payroll | 5% | 72 h | 24 h | 1,100 | 6,600 | 19,800 |
| Total | 100% | 22,000 | 132,000 | 396,000 |
Restoration order: EMR first, because treatment decisions depend on it; Pharmacy second, for medication safety; Billing third. The backup record explains why this is hard: the EMR backup has failed since 23 September [E4-L02], and Payroll and Pharmacy have no backup job at all [E4-L04, L05].
Q7: Board paper outline (two pages maximum)
- Purpose and decision requested: approve GH¢260,000 of annual controls (T2 and T5) and a GH¢20,000 supplementary request.
- Finance Director’s argument: security budget requests were declined in 2024 and 2025 [E5-L04]; the incident is the cost of that deferral.
- IT Manager’s argument: for the funded pair, ALE falls from GH¢1,609,000 to GH¢468,400, a net benefit of GH¢880,600 a year.
- Position: invest, in the order of net benefit and legal duty, accepting that ALE is an estimate.
- Annual method and KRIs: re-run the register each year (NIST, 2012); quarterly indicators such as MFA coverage, orphaned accounts, backup test-restore success and phishing click rate.
- 90-day plan: Days 1–7 contain the incident and notify the regulators; days 8–30 remove dormant accounts and enforce MFA; days 31–90 deploy the funded controls and test restores.
On legal duties, Act 843 requires notifying the Data Protection Commission and affected individuals as soon as reasonably practicable after unauthorised access to personal data (Data Protection Act, 2012, s. 31), and Act 1038 sets a 24-hour incident-reporting duty to the relevant CERT (Cybersecurity Act, 2020, ss. 39, 47). The Data Protection Commission and the Cyber Security Authority both publish online reporting routes (Cyber Security Authority, n.d.; Data Protection Commission, n.d.). Check the exact wording of each section before you cite it.
Need help with your own version?
A personalised brief like this fails on small things: a wrong digit, an uncited log line, a typed number where Excel formulas were required. Our specialists can walk you through the method and prepare reference material for your parameters. It is academic support, not something to hand in as your own, and your institution’s integrity rules still apply.
Submit your assignment details
For the network and wireless question, see our network security assignment help page; for general systems coursework, information technology assignment help.
References
Cyber Security Authority. (n.d.). Report an incident. https://csa.gov.gh/report
Cybersecurity and Infrastructure Security Agency, Multi-State Information Sharing and Analysis Center, National Security Agency, & Federal Bureau of Investigation. (2023). #StopRansomware guide. https://www.cisa.gov/stopransomware/ransomware-guide
Cybersecurity Act, 2020 (Act 1038) (Ghana). https://ghalii.org/akn/gh/act/2020/1038
Data Protection Act, 2012 (Act 843) (Ghana). https://ghalii.org/akn/gh/act/2012/843
Data Protection Commission. (n.d.). Report a breach. https://dpc.gov.gh/report-a-breach/
Joint Task Force Transformation Initiative. (2012). Guide for conducting risk assessments (NIST Special Publication 800-30, Rev. 1). National Institute of Standards and Technology. https://doi.org/10.6028/NIST.SP.800-30r1
National Institute of Standards and Technology. (2024). The NIST cybersecurity framework (CSF) 2.0 (NIST Cybersecurity White Paper 29). https://doi.org/10.6028/NIST.CSWP.29
Nelson, A., Rekhi, S., Souppaya, M., & Scarfone, K. (2025). Incident response recommendations and considerations for cybersecurity risk management: A CSF 2.0 community profile (NIST Special Publication 800-61, Rev. 3). National Institute of Standards and Technology. https://doi.org/10.6028/NIST.SP.800-61r3
Sonnenreich, W., Albanese, J., & Stout, B. (2005). Return on security investment (ROSI): A practical quantitative model. In Proceedings of the 3rd International Workshop on Security in Information Systems (pp. 239–252). SciTePress. https://www.scitepress.org/Papers/2005/25802/
Swanson, M., Bowen, P., Phillips, A., Gallup, D., & Lynes, D. (2010). Contingency planning guide for federal information systems (NIST Special Publication 800-34, Rev. 1). National Institute of Standards and Technology. https://doi.org/10.6028/NIST.SP.800-34r1
