Cybersecurity Report: Preventing Data Breaches in Organizations

Desklib provides past papers and solved assignments for students. This report analyzes data breaches at Uber and Sony.

Assessment item 2

Contents
Introduction.................................................................................................................................................3
Part A......................................................................................................................................................4
1...........................................................................................................................................................4
2...........................................................................................................................................................5
Part B.......................................................................................................................................................7
1...........................................................................................................................................................7
Conclusion...................................................................................................................................................9
References.................................................................................................................................................10
2

Introduction
This report focuses on the importance of security in the organization by focusing on the data
breaches that took place in the past years so that effective measures can be taken to prevent the
data breaches. The report consists of the case of a data breach in Uber that took place in 2016.
The information hacked contained contact numbers, address, license numbers, and the names,
and in Sony case, even the credit card details were hacked. The breach affected almost 57 million
people and another data breach that took in Sony affected 70 million people. This report is aimed
to focus on how the data breach occurred and how it could have been prevented. There are some
security mechanisms that can be implemented by the organization to prevent data losses and
hacks.
3

Part A
1
During the past years, there have been a lot of computer security data breaches which have had
an immense effect on the companies and as well as on its users. One such security breach took
place in October 2016, which affected Uber and the sensitive data collected by them. The data
breach that was announced by Uber told that the hackers attacked on the sensitive information
including the license numbers of the registered drivers and the users from all over the world. The
data that was attacked included personal information such as the license numbers, email address,
names and contact numbers of the users. The information regarding the hack was made public by
the CEO of the company, Mr. Khosrowshahi who joined the company in August as the CEO. In
this data breach, around 57 million user’s data was affected. The attack was informed to the users
after one year of when it actually took place (Computerworld 2019)
As confirmed by Uber, the data breach took place through the GitHub repository where the codes
are available in order to host and review it. Two hackers working outside of the company hacked
the code using the GitHub and stole the private information of its users and drivers using the
infrastructure accounts that had the personal information. The code contained the credentials of
users who got hacked as the carelessness of the company. Although GitHub made sure that the
repository doesn’t store tokens and passwords. The information was stolen because the engineers
used the GitHub to move the personal information to Amazon cloud services (Williams, George,
Cranley, McNeely and Smith 2019).
The reason behind the hackers stealing private information is still unclear but they might have
used it for some illegal purposes and personal benefits. As the information being hacked contain
contact numbers, address, license numbers, and the names as well it could have been very
dangerous for the users and drivers whose information was no longer personal. Another reason
behind the stealing of information could be the demand for money as the hackers were given $
100,000, to delete all the personal information that they stole. Although this action taken by the
Uber authorities was highly opposed by the security experts and the government because it will
only serve as the weak point of the companies and it may attract more hackers as they will steal
the data and will demand money in return. Therefore, instead of providing the hacker's money so
that they cannot misuse private information, Uber would have taken some effective steps to
secure the accounts. The steps taken by Uber were justified as they didn’t want any harm of 57
million people getting affected. Uber paid the attackers through a site named as HackerOne, in
Bitcoins, which enable them to track the hackers. After getting information about the hackers,
they made the hackers to sign a non-disclosure agreement with Uber (Theverge 2019).
4

The hack that took place in Uber could have been prevented if the system had all the
functionality described below (Bond and Bond 2019):
 As Uber attackers gained the access through stealing the information from GitHub and
the Amazon web services, which contained the login credentials of users as well as the
registered drivers, which could be used by the hackers to remotely log in and access the
account s. if the system had multi-factor authentication such as text message based,
token-based or card based, it wouldn’t have allowed the hackers to remotely access the
accounts from the sensitive system containing information of millions of users.
 The account should have given privileges to only those who really needed it, and
preventing access to each user and administrator by using the least privilege principle
would have avoided the situation. If the least privilege was given to the administrator
account then it may have not allowed the access to fetch sensitive information from the
Amazon web service’s database.
 The company can assess the portions of their company which are at the high risk of data
breaches and take actions to ensure enough security in those areas. For example, as AWS
had the most sensitive data then Uber would have assessed the security risks and
prevented unwanted access to it.
 When companies use cloud services, they should pay special attention to it by
implementing security, maintenance, and scheduled monitoring. Uber was unaware of
the breach until the hacker informed it about the attack and demanded money in return. If
Uber was monitoring the cloud services then it would have detected the hack.
 Continuous risk assessment can help the organizations to identify the sensitive areas of it
and can help in assessing the risks in advance, which can result in minimizing the risks
of security and data breaches to a great extent.
2
Synchronous input/ output activities wait for the current process to get completed before the
execution of another process hence the requesting process gets temporarily blocked until the
execution of the current gets completed. Whereas in the asynchronous activity, the process which
requests the input/ output immediately gets the control and the current process gets into the
queue for execution (Docsmicrosoftcom 2019). Paging can be defined as the technique used in
the operating system to ensure that the data can be retrieved as quickly as possible. It helps to
place the data or page into the main memory from the hard drive so that it can be accessed easily.
Whenever there is a request to access a page which is not present in the memory then page fault
occurs (Webopedia 2019).
Base bound register allocates the virtual memory to a segment of data and defines where the data
is going to be present in the memory and bound decides the limit of access. Whenever the
5

process requests to access that data; hardware verifies the range whether the request has reached
its maximum limit or not.
The problem arises due to the base address which differentiates one user from the other. A base
address at the start is provided to the user. The programs in specific areas use the base address. A
user can only access the system until he/she has reached the maximum limit which is also called
an upper bound which doesn’t let the user access within the same address area. A register
maintains the upper bound which is known as the bound register. Therefore, bound register in
mandatory to prevent unwanted access and to maintain the security and integrity. The register
also provides the lower limit and upper limit in pairs to restrict the access within an area. Also,
the importance of paging depends upon the way a program is divided into frames, pages, and
memory. A paging table is maintained to ensure that the proper name of the program as well its
memory address is stored correctly. It helps in quickly identifying the address using the offset
values.
Synchronous activity waits until the other processes are in execution mode. But in the
asynchronous activity, it makes the execution to occur in the background and it doesn’t prevent
other processes from execution. Therefore, it can be proved to be a problem because while
accessing a database, the user wants to fetch or read current values into it, and also if the user
wants to write into a database, the value should not change, but in an asynchronous mode, the
input/output operations can get executed. Therefore the value which is to get read from the
database may change meanwhile or it can be overwritten by someone else. In order to prevent
this problem, there should be a check performed on the basis of a schedule so that any data can
be protected from unwanted access and input/output operations.
6

Part B
1
In 2011 Sony PlayStation network was hacked and it is said to be the largest hack ever to hit the
gamers community which made Sony disable the services for almost a week. It started when a
hacker group tried to attack the servers of Sony which DDOS attacks which can be termed as
Distributed denial of services. The attack made the PSN get down several times before the actual
security breach could take place. The attacker was upset because Sony took severe action against
a person who spread the news of how pirated games can be run on the systems, for which he had
to go to jail. The person was aware of Sony about its system’s loopholes, according to the
attacker. The attacker group wanted to hurt the user of Sony and stopped the attack before April,
but again in April 2011, attacked the PlayStation network. When Sony got to know about the
PSN being down again, it made the PSN unavailable for its users and informed the users for the
same. The engineers started to gather more information about this hack and tried to prevent it
and to restore the PlayStation network. The whole investigation took 3 weeks before PSN
became available to the users. Sony informed the user after completing 48 hours since the PSN
attack that there has been some kind of external intrusion for which a proper investigation is
needed so that users don’t have to suffer again. At that time there was no information regarding
the data that was stolen. After a few days on 26 April, Sony informed its users that the sensitive
data of millions of users have been affected. PlayStation offers its users an ability to play online
games, download and purchase the games and movies. For purchasing purposes, the various
personal details of users are saved into the system. The data breach made all the sensitive
information to get leaked including the passwords, usernames, birthdates, addresses, email id,
etc. it was also announced that maybe the purchasing history and security question have also
been affected. Sony also announced that the credit card details such as expiry date and security
code, of all those who used it for payment, might have been leaked by the hackers. Sony took a
lot of time to announce it to the public that the data has also been affected to which Sony gave
justification as it got late to know that the data was being compromised. Sony hired some outside
experts to help them to know the cause of the incident and how many people have been affected
to know the scope of the incident. And before Sony could know the scope of the attack it didn’t
inform the users about anything. PSN users were unable to change their passwords because the
network was offline for the users. The data breach affected more than 70 million accounts. Also,
the game launchers were affected because the PSN was unavailable for many days (Eurogamer
2019).
The hack was done by using Distributed denial of services in which the Sony was made
unavailable for incoming traffic, as they were unable to keep the traffic and respond to the
incoming requests. This was done by attacking the servers and making the resources unavailable
7

for its users. The reason behind the hacking and accessing the sensitive information of its users
was mainly because the information was not present in the encrypted form. The hackers possibly
moved the data to another hacker group and identified the loopholes in the security system of
Sony. Then the attackers may have take help of SQL injections to attack the sensitive data of its
users (Anthony 2019).
Sony added two-factor authentication to avoid any such condition further. Although the security
practices in Sony at that time was too weak because the emails and any such important
information was not even encrypted, it was only dependent on plain text passwords. To prevent
these types of security breaches, the company should encrypt all such sensitive information.
 Sony could have used two-factor authentication to prevent unwanted access from the
system administrator account.
 By implementing data loss prevention mechanism at the endpoint, data losses could be
prevented.
 By implementing strong policies, deploying software to prevent information losses at the
end point, protecting the transaction information.
 The computer system has been made more secured to store the credit card and transaction
information from getting leaked, as two of the old employees of Sony were aware that the
system is not capable enough of saving the credentials.
 There could have been accessing privileges that ensured no unwanted access can be
granted to perform web server operations, database access and unwanted access to system
applications. By restricting the access of various critical areas such as servers and
database, it could have been prevented.
 By investing more into the Distributed denial of services and implementing the rate-
limiting services for web servers, it could have been prevented.
 Scraping could also have used to ensure the security of the system.
 In case of an attack, the system could have monitored in such a way so as it could defend
itself from any kind of further attack.
 There could have been a security plan so as to prevent risks and assessment of the
incident that took places such as the response strategy and the prevention measures to
prevent such breach (Forbes 2019).
8

Conclusion
Data breach that took place in Sony and Uber could have been prevented by implementing data loss
prevention mechanism at the end point, two-factor authentication to prevent unwanted access
from the system administrator account and by assessing the portions of their company which are
at the high risk of data breaches and take actions to ensure enough security in those areas. The
report also focuses on various aspects of security mechanisms and asynchronous activity.
9

References
Computerworld. (2019). Uber confirms massive 2016 data breach. Retrieved from
https://www.computerworld.com.au/article/630328/uber-confirms-massive-2016-data-breach/
Williams, C., George, T., Cranley, G., McNeely, D., & Smith, A. (2019). How the Uber Data
Breach Could Have Been Prevented. Retrieved from https://blog.centrify.com/the-uber-data-
breach/
Bond, R., & Bond, R. (2019). How to Prevent the Uber Hack: 5 Defensive Tactics. Retrieved
from https://www.hitachi-systems-security.com/blog/how-to-prevent-the-uber-hack/
Theverge. (2019). Uber covered up a cyberattack last year that exposed data of 57 million riders
and drivers. Retrieved from https://www.theverge.com/2017/11/21/16687796/uber-cyberattack-
data-breach-exposed-users-57-million
Docsmicrosoftcom. (2019). Synchronous and Asynchronous I/O - Windows applications.
Retrieved from https://docs.microsoft.com/en-us/windows/desktop/fileio/synchronous-and-
asynchronous-i-o
Webopedia. (2019). What is Paging? Webopedia Definition. Retrieved from
https://www.webopedia.com/TERM/P/paging.html
Eurogamer. (2019). Five years ago today, Sony admitted the great PSN hack. Retrieved from
https://www.eurogamer.net/articles/2016-04-26-sony-admitted-the-great-psn-hack-five-years-
ago-today
Anthony, S. (2019). How the PlayStation Network was Hacked - ExtremeTech. Retrieved from
https://www.extremetech.com/gaming/84218-how-the-playstation-network-was-hacked
Forbes. (2019). What Do Security Professionals Think Sony Should Have Done Differently.
(2019). Retrieved from https://www.forbes.com/sites/quora/2014/12/26/what-do-security-
professionals-think-sony-should-have-done-differently/#31ea4530d463
10

11