Design by Paradigm experienced a security incident related to the engineering application server, resulting in latency issues for engineers. The incident was initially reported through helpdesk tickets, indicating slow performance of the application. The server underwent a reboot by the operations team, but the latency issues persisted, prompting escalation to the security team.

Upon investigation, it was discovered that updates were recently installed on the engineering application server. The administrator responsible for the updates admitted to downloading the updates from an email that appeared to be from the expected vendor contact but was sent from a spoofed email address. Additionally, high GPU and CPU usage was observed on the server, along with unauthorized remote network connections.

The root cause of the incident is attributed to the installation of unauthorized updates on the engineering application server. The administrator downloaded the updates from a spoofed email address, leading to potential compromise of the server. The high GPU and CPU usage, along with unauthorized network connections, indicate possible malicious activity targeting the server.

None No effect to the organization$$s ability to provide all services to all users

Low Minimal effect; organization can still provide all critical services to all users but has lost efficiency

Medium Organization has lost the ability to provide critical service to a subset of system

High Organization is no longer able to provide some critical services to any users

Functional impact:

$($See section: Glossary$)$HIGH

$$MEDIUM

$$LOW

$$NONE

Incident priority: $$HIGH

$$MEDIUM

$$LOW

$$NONE

Additional notes: