IDENTITY & ACCESS MANAGEMENT (IAM)

XYZ Business School uses a cloud identity platform for faculty email, the learning management system (LMS), HR documents, and shared project storage. Faculty sign in with an institutional account. Sensitive folders should be restricted by role, and multi-factor authentication (MFA) is available but is not enforced for every legacy application.

On 14 October, a faculty member receives an urgent email claiming that the IT Service Desk will suspend accounts unless users verify their identity. The email contains a link to a look-alike sign-in page. Later, a QR code appears on a notice near the staff room, claiming to be a faster way to update account-security settings. Within hours, the identity team sees a successful sign-in, a large download from shared storage, and a later access attempt from an unfamiliar location. The team blocks the later attempt, but cannot yet prove whether the email link, QR code, or another route exposed the credentials.

Your role: act as a junior IAM incident analyst. Identify the likely attack path, determine which controls failed or were incomplete, recommend immediate containment, and propose long-term improvements. Do not treat an indicator as proof unless the evidence supports it.