Disaster Recovery Responses

Post1:

Intrusion is an abnormal and unauthorized system activity performed by accessing the network or a system. Higher education institutions are increasingly becoming a target of system intrusion. The network of schools and universities are vulnerable as the iPad or the laptops used or issued by them are exposed to other networks with fewer security measures. I would like to discuss one such intrusion which caused data breach. A student aimed at modifying the examination results and other sensitive information in the database in a school. The intrusion happened through a wireless access point in the school vicinity developed by knowledgeable persons. According to ” Li, M., Sun, X., Wang, H., Zhang, Y., Zhang, J.(2011) “Another difficulty is how to make the access control technology in a trustworthy fashion, when the data provider and the requester are unknown to each other”.

The attack was successful. The root node was compromised, and level of the attack was considered as a high risk. To mitigate this vulnerability the following upgrades are suggested. The first one is Intrusion Detection and Prevention Systems (IDPS) that if installed on all the servers can monitor network systems, block any suspicious activity and restrict administrative privilege that can refrain content access. Secondly, Linux operating system is recommended to be more secure as the server editions are open source and better than the windows operating systems. Additionally, the Remote Access Server (RAS) that can help in authentication, authorization, and accounting by keeping a track of the traffic on the network is recommended. Lastly the Firewall updates, Antivirus, Data backups as part of internal network security is suggested so that it can help assist during an incident if data is corrupted, encrypted, or deleted. Also, with the use of Access Control List (ACL) only the list who can access the network can enter. With the above said changes suggested, the vulnerability of the network system significantly controlled.

References

https://www.researchgate.net/publication/283258166_CyberAttack_Analysis_of_a_School_Computer_Network

Li, M., Sun, X., Wang, H., Zhang, Y., Zhang, J.: Privacy-aware access control with trust management inWeb service. World Wide Web.14(4), 407–430 (2011)

https://link.springer.com/content/pdf/10.1007/s11280-019-00704-x.pdf

Post2:

The data breach that I wanted to discuss here is the one that left almost 144.5 million people affected to possible identity theft and future risks. The 2017 data breach of Equifax opened up its users’ sensitive information, ranging from social security numbers, and driving license to even financial information, at the helm of hackers for stealing identities (Novak & Vilceanu, 2019). Even though the vulnerability in Struts was declared by March of 2017 and Equifax tried fixing it immediately, attackers were able to get personal data by the 3rd day, and inside the system by May using sensitive personal information without the company realizing it. By the time Equifax realized the unusual activity due to high traffic; it was already too late even though they immediately fixed in July. This span of two months gives us the subtle clue as in how difficult it can be to detect such attacks even for such a huge organization and can impact the reputation in a huge way. There were numerous lawsuits which also resulted in loss of faith among stockholders as well. Myself, being an active stockholder, can speak with certainty, most of the market is based on trust in the business that determines its market position, and once lost due to such attacks, can be very tiresome to regain and leave some irreparable damages to the company’s image. Equifax did all things right after it learnt of the intrusion, from removing suspicious entries, to patching as well as involving federal government to assist, however it was still too little, too late.

Another such example was Twitter very recently that hacked from Elon Musk to Ex-President Obama and many other prominent figures. It was first reported by Microsoft to Twitter to immediately take action where it was found that most possible root cause was by hacking the Admin account which definitely should not have those access levels exposed. Though it still is under investigation, and more is being known about it over time, the immediate effect was seen in the stock market on the very next day. Though briefly, thanks to Jack Dorsey’s perseverance, yet even Square, another company managed by Mr Dorsey saw some pullbacks just due to Dorsey’s name attached and Square being a payment related company. So I believe it is fair to say, the impact of such intrusions can last very long if appropriate steps are not taken to remediate, however the most important part of the exercise is about the preventive measures and early detection, else companies or schools, or any other sector, none are immune from reputation being tarnished, and a flurry of lawsuits.

References

Novak, A.N., & Vilceanu, M.O. (2019) “The internet is not pleased”: twitter and the 2017 Equifax data breach, The Communication Review, 22:3, 196-221, DOI: 10.1080/10714421.2019.1651595