Cybersecurity Threats and Data Breaches

This assignment requires you to analyze the Verizon 2017 Data Breach Investigations Report. The analysis should delve into the trends highlighted in the report, focusing on common types of cyberattacks, prevalent vulnerabilities exploited by attackers, and effective mitigation strategies employed to minimize data breach risks. You are expected to demonstrate a comprehensive understanding of the cybersecurity landscape based on the insights provided in the report.

Running head: INFORMATION SECURITY
Assessment
[Student Name Here]
[Institution’s Name Here]
[Professor’s Name Here]
[Date Here]

INFORMATION SECURITY 2
Table of Contents
Part A: Verizon attack (July 21).......................................................3
What was the problem?......................................................................3
How and why it occurred...................................................................4
Solution..............................................................................................5
Part B: Ransomware attack (May 2017)..........................................5
The problem.......................................................................................6
Those affected and how.....................................................................6
How the attack took place..................................................................7
Solution..............................................................................................8
References..........................................................................................10

INFORMATION SECURITY 3
Part A: Verizon attack (July 21)
Earlier on in the year, Verizon the telecommunication company was subject to one of the
biggest data breaches in the world. The company’s systems were severely exposed which
leaked millions of records owned by the company’s customers. The company, however, did
assure its customers that the attack did not present any serious threat as it was contained and
isolated based on their operational systems (Pachal, 2017).
What was the problem?
Verizon has for many years offered telecommunication services to customers and with
mobile communication on the rise, its services have had an increased application which has
subsequently increased the data the company accesses. This data was fairly exposed after
some systems owned by the organization was left unattended lacking the necessary security
procedures. At the start of the breach, investigators highlighted that records owned by 6
million customers were exposed. However, this number later doubled and increased beyond
this number as highlighted by independent research investigations. In the final estimate, the
leak claimed over 14 million victims as their information was publicly available to the public
(Deahl, 2017).
In essence, the data breach affected the customer service department where clients regularly
contacted to have their queries and problems solved. This leak was therefore outlined to have
affected all customers who had been in touch with the company in the six months prior to the
data leak. Moreover, the leak was contained to the department as isolated systems were used
to control the customer care service as compared to all other services. Nevertheless, the leak
exposed a fair amount of sensitive information including addresses, names and contact
details. Moreover, some customers access pins were exposed as they had been used them
during the communication exercise (Verizon, 2017).

INFORMATION SECURITY 4
How and why it occurred
Immediately after the breach was discovered by an independent researcher, Verizon placed
full blame for the breach on an independent service provider who had been contracted to
handle the customer care facilities. In their statements, Verizon highlighted a company by the
name Nice Systems as the responsible party in the events that unfolded. Furthermore, the
organization had been using a cloud facility hosted by Amazon Web Service (AWS) which
helped integrate all the communications between its customers and itself. Now, it was Nice
responsibility to maintain and regulate the operations of the cloud server, a duty that they
failed and which led to the leak (McAfee, 2017).
On Nice Systems behalf, the company’s outcome was propagated by a negligent employee
who failed to secure the cloud infrastructure which left all the data stored in the AWS servers
exposed. The leak uncovered a lot of information which led to the discovery of the amount of
information entrusted to a third party member who had no direct contact with the customer
themselves. Moreover, after several investigations were conducted, the leak was discovered
to have exposed the company’s log records where each and every communication was
outlined. These log records contained unencrypted information that was available to the
public in clear text format which also accounted for minimal redactions as it was earlier
thought. In the end, records containing contact information, access PINS and customers’
account balance was exposed (Kumar, 2017).
Vulnerability used: Although cloud services are easy to maintain and manage, their security
policies require intricate procedures to secure their structures and infrastructures. For
Verizon, these procedures were not implemented at the time of the breach which highlighted
the failure of the organization as its actions (sub-contracting another company) led to the
problem. Moreover, the parties involved also facilitated the attack as there was minimal
accountability based on the hands that the information was exchanged. The data was

INFORMATION SECURITY 5
controlled by the AWS, Nice and Verizon which presents a lot of challenges when
accounting for access and security procedures. In addition to this, Nice had also contracted
another party member to handle the data which further intensified the problem (Pachal,
2017).
Solution
First, the problem was caused by a negligent team member who failed to secure the online
services. Therefore, the first possible solution would be to implement security procedures that
outline detailed descriptions of setting up the necessary security measures. It is common to
forget to implement some security measures as they are either too trivial or too extensive to
apply. However, with a laid out guideline, the support team can follow a step by step
guideline to deploy the cloud service solutions. Therefore, as a company, Verizon should
develop a new security policy to guide its employees and sub-contracted company (Micro,
2015).
Secondly, Verizon should do away with third party members as they present more challenges
when dealing with the security of sensitive information. Remember, cloud infrastructure like
any other online services has many risks and threats, from intruders to malware attacks which
necessitate the need for accountability. These risks are increased by contracting a third party
member to handle the data owned by an organization. Furthermore, as a subcontracted
company, Nice Systems does not have a direct connection with the consumers, therefore, they
may fail to face the same consequences as the mother company (Verizon). This outcome may
facilitate the negligent behaviour observed in this scenario where employees forget to
implement the necessary operational procedures (McAfee, 2017).
Part B: Ransomware attack (May 2017)
Ransomware attacks fall under the greater category of malware intrusions where malicious
programs are used to infiltrate computer systems. Moreover, with ransomware attacks, the

INFORMATION SECURITY 6
perpetrators will use the intrusion to demand certain resources which in most cases are
usually money related. In all, a malicious program will hold a machine under ransom
disabling the files and data owned by the user until the money is paid (Mullin & Lake, 2017).
The problem
In accordance with the explanation given above, the attack that took place earlier in the year
subjected its victim to financial demands, an outcome that generally disabled the
functionalities of many computer systems. The intrusion was known as the WannaCry attack
and it affected thousands of computers worldwide as it compromised multiple systems that
were connected to the online infrastructure. WannaCry employed serious vulnerabilities in
computer systems to propagate its attack, a process that was difficult to stop as it affected
many systems at the same time (Chappell, 2017).
In all, the problem began with a leak in the NSA’s (National Security Agency) hack tools
which contained a number of system vulnerabilities as per the organization’s cyber-weapons
initiatives. Now, the initial leak was conducted by a rogue access group known as Shadow
Brokers who for a long time had been compromising many computer systems around the
globe. Therefore, it’s through their initial attack set the precedence for the final attack that
took place using the malware (Chappell, 2017).
Those affected and how
WannaCry attacked all systems without any form of distinction which facilitates its success
across the globe. In fact, at the start, the malware had infected over 45, 000 systems across
100 countries. Moreover, these systems were fairly distributed across different fields of life
including the public and private sectors. However, the attack did affect some countries more
than others as outlined by the damages it imposed on the end users. WannaCry heavily
affected the countries of Russia, United Kingdom, China and Spain. These countries had

INFORMATION SECURITY 7
widespread intrusions, some which compromised the major sectors of business (Larson,
2017).
In Russia, for instance, the banking industry was severely affected as some of the major
financial organizations were attacked. Moreover, the countries public sectors was included as
its ministries (Health and Interior) were faced with the intrusion. The same outcome was also
experienced in the United Kingdom where its healthcare industry was exposed to the attack
owing to the connections of the NHS systems (National Health System). In all, the NHS
system coordinated the health care activities in the country providing a centralised access to
medical data. Now, the intrusion targeted this system which disabled all the computers
connected to it affecting the work of medical practitioners and the services offered to medical
patients (Graham, 2017).
A similar attack was experienced in Spain where its private sectors, led by the
telecommunication and electrical industry were compromised. To start with, the countries
second most favoured company Telefonica was affected, an intrusion that was followed by
the attack on Iberdrola the country’s Power Company. Furthermore, the attacks on these
companies were so severe that the organization's shut down their systems in an attempt to
contain the attack, an outcome that led to many financial damages (Larson, 2017).
How the attack took place
As stated before, the root of the problem was NSA and its hacking tools which were accessed
by the rogue group Shadow Brokers. Through these tools a vulnerability known as
EternalBlue was discovered, a vulnerability that affected Windows systems based on its
Server Messaging Blocks (SMB). Now, the SMB is a communication protocol that is used by
the application layer (TCP/IP) to connect and transfer information across networks. This
functionality is usually achieved by two main operations; one, the facilitation of the read and
write action on files found in networks and two, the ability to request for services across

INFORMATION SECURITY 8
networks. Therefore, using the SMB, a machine is able to access and share information with
the networks it’s connected to as well as other machines (Titcomb & McGoogan, 2017).
EternalBlue compromised this functionality of the SMB which gave the intruder unsolicited
access to machines connected to various networks across the globe. In all, the following
simple steps were used to attack machines.
1. WannaCry started by establishing a connection with a network through the SMB
protocol. This protocol used a simple handshake, a process that was fairly exploited in
this stage.
2. From the access procedure, the second step was the delivery of the malware itself
which was done using an encrypted file having the activation program of the
ransomware (Response, 2017).
3. After delivering the file, the activation file was triggered which compromised the
host machine. In addition to this, the program also scanned for other connections to
spread the attack in subsequent networks.
4. The final step was the replication process where other unsecured networks were
attacked.
Solution
According to Windows, the attack would have been avoided if the compromised systems had
updated their firmware. WannaCry exploited an initial bug contained in Window’s operating
systems which based on its extensive application in world facilitated the attacks. Therefore,
had the consumers updated their system, the necessary patches that fixed the vulnerability
would have been installed stopping the attack before it happened. However, at the same time,
the affected organizations should also have had better security procedures to detect and
contain network intrusions. Yes, the systems were compromised by the EternalBlue

INFORMATION SECURITY 9
vulnerability, but this weakness should have been contained by the isolation techniques used
by the security measures of network control. In addition to this, the users’ would have had
better intrusion detection systems to highlight the possible compromises within the networks
themselves. Therefore, the lack of optimal security procedures and policies facilitated the
attack as much as the Windows vulnerability. As such, the prevention solutions would have
been to implement an optimal security policy after thorough risk assessment procedures
coupled with the necessary systems updates (EY, 2017).

INFORMATION SECURITY 10
References
Chappell, B. (2017). WannaCry Ransomware: What We Know Monday. The two way,
Retrieved 30 August, 2017, from:
http://www.npr.org/sections/thetwo-way/2017/05/15/528451534/wannacry-
ransomware-what-we-know-monday.
Deahl, D. (2017). Verizon partner data breach exposes millions of customer records. The
Verge, Retrieved 30 August, 2017, from:
https://www.theverge.com/2017/7/12/15962520/verizon-nice-systems-data-breach-
exposes-millions-customer-records.
Graham, C. (2017). NHS cyber attack: Everything you need to know about 'biggest
ransomware' offensive in history. The Telegraph, Retrieved 30 August, 2017, from:
http://www.telegraph.co.uk/news/2017/05/13/nhs-cyber-attack-everything-need-
know-biggest-ransomware-offensive/.
Larson, S. (2017). Massive cyberattack targeting 99 countries causes sweeping havoc. CNN
tech, Retrieved 30 August, 2017, from:
http://money.cnn.com/2017/05/12/technology/ransomware-attack-nsa-microsoft/
index.html.
McAfee. (2017). Verizon 2017 Data Breach Investigations Report. McAfee, Retrieved 30
August, 2017, from: https://www.mcafee.com/us/security-awareness/articles/verizon-
2017-dbir.aspx.
Micro, T. (2015). Follow the Data: Dissecting Data Breaches and Debunking Myths. Trend
Micro Analysis of Privacy Rights Clearinghouse 2005–2015 Data Breach Records,
Retrieved 30 August, 2017, from:
https://www.trendmicro.de/cloud-content/us/pdfs/security-intelligence/white-papers/
wp-follow-the-data.pdf.
Pachal, P. (2017). If you're a Verizon customer, you should change your PIN — now.
Mashal, Retrieved 30 August, 2017, from: http://mashable.com/2017/07/13/verizon-
data-breach/#bZDR9.cdOqq9.
Titcomb, J., & McGoogan, C. (2017). Cyber attack: Latest evidence indicates 'phishing'
emails not to blame for global hack . The Telegraph, Retrieved 30 August, 2017,
from: http://www.telegraph.co.uk/technology/2017/05/15/nhs-cyber-attack-latest-
authorities-warn-day-chaos-ransomware/.
Verizon. (2017). Verizon's 2017 data breach report. Verizon, Retrieved 30 August, 2017,
from: http://www.verizonenterprise.com/verizon-insights-lab/dbir/2017/.

INFORMATION SECURITY 11