Data Breaches: Analysis of Verizon and Sony Incidents

Desklib provides past papers and solved assignments for students. This report analyzes data breaches at Verizon and Sony.

Contents
Assessment item number 2...................................................................................................................2
Assignment number 2...........................................................................................................................2
A. Part................................................................................................................................................2
Ans. 2.................................................................................................................................................4
B. Part................................................................................................................................................6
References:............................................................................................................................................9

Figure 1: Verizon breach........................................................................................................................3
Figure 2: Base/BOund............................................................................................................................5
Figure 3: Synchronous and Asynchronous.............................................................................................6
Figure 4: Sony breach............................................................................................................................7

Assessment item number 2
Assignment number 2
A. Part
Verizon is a Multinational Company from America which is a public company and working in the
telecommunication sector. Verizon’s products and services comprises Mobile phones, IPTV, Internet,
Broadband, Landline, etc. On 8th of June, director of the cybersecurity and risk research find out that
the Verizon’s Amazon S3 cloud-based data fund is fully accessible and downloadable for the public
out there. Which means that the confidential data of Verizon was open as the public access and
anyone can see that data and also download it just by accessing the S3 URL. The main concern was
that the data wasn’t in a small amount. Terabytes of data were unprotected there which contained
millions of users and customers information and other confidential data.
Figure 1: Verizon breach
There were six folders over there from January 2017 to June 2017 named as “Jan-2017” to” June-
2017”. It also contained.zip extraction files, means compressed files that have names like
“WebMobileContainment.zip.” and “VoiceSessionFiltered.zip” although these files were inaccessible
once the extension is changed from .zip to .gzip, the file can be accessed. The contents available in
these daily log folders are discovered to be the sizable text file, which of them some files are large up
to 23 GB. After analysing them, the overall structure became visible, where the large text blocks
appear to be composed of voice recognition log files and other records of individual were of a
customer call line.
Verizon had records of millions of users who get exposed in public because of the slip in data on the
Amazon S3. According to the Verizon, 6 millions of data were exposed or compromised by the Nice
systems, a partner of Verizon that once facilitates the customer's service calls for the Verizon. All the
records that were exposed in this breach were from January 2017 to June 2017 and were of the
called customers in the customer care service. The main reason is considered as one employee of
the Nice Systems was included in this planning and controlled the data over Amazon S3. The main
concern to think over there were, each record had the name of the customer, their account number

and PIN, also their email address, home address and account balance of Verizon. In those records,
some were edited and most of them were as it was. Anyone who can able to get the access of that
cloud can access the data and edit them as there was no protection.
Nice system and Verizon stated that they are investigating the data breach that happened and trying
to pull out the accused. To hide their fault, Nice systems also stated that the data which is not in
protection is a “part of a demo system” but on asking to give description about it, they refused to
explain it. The data breach was first noticed when a researcher of cyber security from UpGuard
noticed it on the 13th of June and securing of the data was done after 9 days on the 22nd of June.
Verizon took 9 days to secure again the data which was unsecured from a long time and after they
came to know about the data breach that millions of information have public access and anyone can
access them by the cybersecurity researcher from UpGuard.
Senior information security data scientist at Verizon explained that Verizon filters the data set it
receives. For 2016, the actual filtered data set used by Verizon was in fact approximately 60k
incidents and still some 20k more incidents than what Verizon is including in 2017 report. There are
several reasons for the lower incident count, including fewer point-of-sale and botnet-related
incidents, Bassett said.
But this wasn’t the first time when Verizon faced a data breach. Previously, 1 year ago from this
breach, in 2016, Verizon’s enterprise unit became a victim of hacker and data from it stole by the
hackers. This department of Verizon used to provide the customers IT services who are mainly
organisation, industries and companies.
From the investigation and research, the possible resolution that can be taken for such data
breaches and the action that Verizon took are as follows. Some points are here describes the
mistakes and the resolution of those mistakes that can be taken by Verizon to protect the data
available online and accessible to all:
 Errors, theft, and loss continue to plague the telecommunication industry, with nearly 30% of all
breaches in this space linked to misdelivery, improper disposal, and lost assets.
 94% of breaches within the Manufacturing sector were related to cyber-espionage, and 90% of
the data compromised in these breaches was classified as “secret” data. Many breaches in this
sector begin with a phishing attack at the employee level.
 Cyber-espionage and human errors were prevalent patterns in the Education industry, and social
components factored into the majority of attacks in the space, which saw a lot of “combination
attacks
 Keep updating the password so that no one can hack them and using the encrypted password is
always been a good explanation to the hacker that the site is updated and there is no way to
penetrate the security bounding here.

Ans. 2
A process in which the data available in the secondary memory can be used in primary memory is
known as Paging. Basically, it transfers the data from secondary memory to the primary memory
that is also known as main memory so that the user can read and write the data. Paging offers an
advantage of the methods of memory management as it facilitates a faster and efficient use of
storage. Paging is also used in dividing the program into parts of the same length, on in other words
it bisects the program. These divided parts are known as page frames. Hence, this function can be
used the divided parts name and the memory is stored in the main page table. The logical address,
virtual address, physical address space are stored in the page table for any particular memory.
For the process of memory allocations, the base bound registers are used which relocates the
existing memory in a system. The base stands for the basic or lowest limit for the virtual memory.
Base register doesn’t let the main program to cross the lower limits as this is the base for the
memory relocation. Where another or a part of this register is bound to register which is used as the
upper bound for the memory so that data or program doesn’t cross that limit as well. In addition
with that, both of the registers are used to maintain the integrity of the database and a pair of the
base/bound register is used to separate two users as well. When working with a two users case, the
memory sometimes crosses the limits the program mix-up with each other of both users, but using
the base/bound register in that place, register bounds them and only take the required plan to
relocate.
Figure 2: Base/BOund
Base ≦ word address < bound
Transfer of data can be done using synchronous data processing or asynchronous data processing.
The transfer of data using synchronous and asynchronous depends upon the requirement of the
transfer, whether it should return immediately or it should wait until I/O process is completed. Entry
points like read(9E) and write(9E) are known for the synchronous activity and aread(9E) and
awrite(9E) are used for the Asynchronous I/O activity in OS.

More specifically Synchronous I/O wait for the current process to complete for the execution, where
Asynchronous I/O means there won’t be anything waiting for the completion of the process. The
asynchronous process just keeps on running in the background. Or in other words, while the I/O is in
process, synchronous processes stopped but not asynchronous, they keep on running.
Now, sometimes users need to access the database and the file that need the I/O database for
accessing doesn’t have to wait it just keep going in the asynchronous I/O activity. There are some
processes in which the data present in the memory can be accessed and changed by the data of
another process while the I/O asynchronous activity is already going on. This is how the
asynchronous I/O execution becomes a problem in the memory relocation using the base/bound
registers and using the paging technique. Asynchronous I/O activity changes the data of the memory
because of another process which is going on in the background.
Figure 3: Synchronous and Asynchronous
To resolve this problem a data process check can be implemented. In this check, on the entry point
of the data access, a check will investigate the data if it is changed or not. Where the data
accessibility is checked and also the range that is affected by the asynchronous method is also
filtered. The drawback of this solution is after the beginning of I/O process if a process is relocated
for any cause the check won’t be there and data can be changed.

B. Part
Faced Problem
Sony is a big name in the electronics market, IT technologies and many other services that they are
providing. The main focused and highlighted product of Sony is Sony PlayStation and its series.
People have been logging through their account to the Sony PlayStation server and playing games of
their wish and Sony were actually providing a great service to people those days back in 2011. Sony
launched its new featured Sony PlayStation 3 which was a very new technology back in that time.
Lots of customers were attached to that service to use the latest launched Sony PlayStation 3.
Unauthorized access to the Sony PlayStation network ruined all the services that Sony was going to
provide to the customers after the launch. People that had subscribed to the Sony PlayStation
network were not able to log in through their account to play games. Those people were unable to
see the page instead of that Sony mentioned that their screens were showing a message, “Page Not
Found, It’s not you. It’s the internet’s fault”.
Figure 4: Sony breach
Sony investigated for this error and get to know that an unauthorized user hacked the network,
broke into it and steal all the information of the customers that were attached to the Sony
PlayStation Network or PSN. The stolen information comprises the user’s first and last name, e-mail
address, home address, password and birth dates. Because of the facility of Sony of downloading
games through the internet and playing online against each-other, customers were engaged to this
service from 20th April and the attack took place on 3rd May which caused a case where 70 million
subscriber’s information got hacked. A weak point that was expensive and laborious to solve, Sony
ignored that and launched the completed structure of Sony PlayStation.
Affected People

Although Sony took an instant action against the attack and turn down all the PSN services of that
time, still 77 millions of people were affected by this attack and lost confidentiality on their
confidential information because of the unconcerned nature of that weak point of Sony PlayStation
in 2011. The server that got a chance to hack and halt the facility, wanted to keep it on halt till 20 th
May and make a great loss to the Sony PlayStations. Although, the security analyst and worker of
Sony stopped their plan in the middle still Sony lost too much customer, their trust and their money
invested in their services.
This network outage damaged the status of the company in the global market and put it in danger.
Sony was continuously criticized for the same and downed their customers. In this way, the outage
too much affected the people out there and also the Sony PlayStations for a very long time. Due to
which Sony PlayStations has to pay a very high amount of money to the customers and caused a loss
of about $177 million. An in the next month of June the shares of Sony PlayStations fallen by 30 per
cent. And the whole attack and recovery of the attack caused Sony approximately $2 million. Also,
apart from the loss of the money on services by Sony, the customer also had to pay for their fault.
The hacker stole the private and confidential information of the users and put it all on the edge of
danger.
Dealing with problem
After the complaints receiving from the customer of not able to sign in the company tried to find out
the reason which lately discovered as an external intrusion by some group or individual which
affected the overall business of Sony PlayStation 3. According to manufacturers the lost was around
$171 million.
From 20th April the hacker was attacking the system and stealing the information of the customers
subscribed with Sony PlayStation. They wanted to carry on this method until the 20th of May. But
somehow, Security Analyst of Sony and IT experts managed to get to the outage and shut down all
the services by apologizing to the customer. Even the CEO of Sony apologized for more than 3
weeks.
As apologizing wasn’t an option, Sony didn’t just close the PlayStation Network services, they also
sealed the Qriocity worldwide. As the attack was really large and embarrassing for Sony they assure
their customer that they will create a more secure network than this for their customers and also
will provide the compensation to the people who have faced this attack and lost their fund from
their cards. Fortunately, there was no customer who lost their funds and Sony didn’t have to pay the
compensation but still they made some decision for their new network strategies.
Sony planned to get engaged with the better network security regulation that can engage the whole
network without any backbone. Sony also introduced an online verification procedure with email id
or the number for the verification of the user. And asked the entire customer subscribed to Sony to
change their passwords and keep updating them.
Prevention Strategy.
For the prevention of attack, Sony could use the following strategy.

A plan that introduces a better connection with much better security fences.
Working on the network strength and testing of the service for the flaw identification.
Testing of new flaws and their resolution.
Keep updating the user to change their password from time to time.
Two factors authentication for better management of security.
Investigation for specific information that is lost.

References:
Deahl, D., (2017), Verizon partner data breach exposes millions of customer records, Retrieved from
https://www.theverge.com/2017/7/12/15962520/verizon-nice-systems-data-breach-exposes-
millions-customer-records
O'Sullivan, D., (2018), Cloud leak: how a verizon partner exposed millions of customer account,
Retrieved from https://www.upguard.com/breaches/verizon-cloud-leak
Zorz, M., (2017), Industry reactions to the verizon 2017 data breach investigations report, Retrieved
from https://www.helpnetsecurity.com/2017/04/28/reactions-verizon-2017-report/
Milian, M., (2017), Sony: hacker stole playstation users' personal info, Retrieved from
http://edition.cnn.com/2011/TECH/gaming.gadgets/04/26/playstation.network.hack/index.html
Goode, S., Hoehle, H., Venkatesh, V., & Brown, S. A. (2017). User compensation as a data breach
recovery action: An investigation of the Sony PlayStation Network breach. MIS Quarterly, 41(3).
Pandey, A. (2018). A history of data breaches. XRDS: Crossroads, The ACM Magazine for
Students, 24(4), 11-11.
Braunstein, A. (2016). Standing Up For Their Data: Recognizing the True Nature of Injuries in Data
Breach Claims to Afford Plaintiffs Article III Standing. Journal of Law and Policy, 24(1), 3.
Yang, J. M. (2015). A simple fault tolerant control for input/output asynchronous sequential
machines. Automatica, 52, 76-82.
Silberschatz, A., Gagne, G., & Galvin, P. B. (2018). Operating system concepts. Wiley.