MITS5004 IT Security Assignment 2: Data Breach Analysis Report

This report provides a comprehensive analysis of data breaches, focusing on the Equifax data breach and the 2011 Sony PlayStation Network outage. The Equifax section details the unauthorized access of user data, the compromised information, and potential causes related to a flaw in the Apache Struts tool. It explores possible solutions for both the organization and users, including patching systems, credit monitoring, and changing passwords. The report then delves into the technical aspects of memory protection schemes, explaining the challenges of asynchronous I/O activity within base/bounds and paging systems, and suggests a solution to mitigate the risks. The Sony case study examines the problems, the affected parties, the attack methods, and preventive measures. The report emphasizes the importance of security as an integral part of organizational culture, including employee training and proactive security practices to prevent future data breaches. Overall, the report offers a detailed overview of data breach incidents, providing insights into the causes, impacts, and potential solutions in the realm of IT security.

Running head: DATA BREACHES
Data Breaches
[Name of the Student]
[Name of the University]
[Author note]

1DATA BREACHES
Part 1A:
Equifax Data Breach:
During the time span of April-August 2015-2018 there are several of attack that has led
to computer security breach. In these cases of security related breaches Equifax data breach was
one of the most highlighting security breach which was happened on July 29, 2017 (Zou et al.,
2018). This data breach affected millions of users in this segment. Equifax is one of the largest
credit reporting organization which faced this issue and due to this issue identity theft related
issue occurred among 145.5 million US customers.
The main Problem: In this data breach incident the main problem was regarding unauthorised
access of data. The problems due to this data breach has been announced by the Equifax on
September 7 of 2017. On that day the Equifax clearly defined a cyber-security related attack was
performed on their servers where the attackers accessed several of data of the customers in an
unauthorised way (Zou & Schaub, 2018). This unauthorised data accessed was performed by the
attackers starting on the mid May to throughout the July 2017. This data breach was discovered
by the Equifax on July 29 and immediate actions was taken by the Equifax to solve this data
breach issue. In this case data which was compromised was the personally identifiable
information. This type of data mainly consists the personal information which includes names,
birth dates, addresses, any type of licence numbers and social security numbers.
Occurrence of this Problem: How this data breach of the Equifax is occurred is still mostly
unknown. The recent researches in this data breach issue highlighted that the possible occurrence
of this type of issues was regarding a flaw in the web application which helped the attacker to
gain access to the sensitive information stored by the Equifax (Robbins & Sechooler, 2018). In

2DATA BREACHES
the press conference Equifax also admitted that they were aware about this security flaw before
the attacker performed the attack. In the brief statement the Equifax stated that attackers were
able to gain access to the data due to the tool which was known as the Apache Struts. This tool
was not only used by the Equifax but also this was used by several of other government and
business organizations (Wang & Johnson, 2018). This tool was used by the Equifax to support its
customers through the on-line portal provided by the Apache Struts. The main flaw was in this
tool. The customers of Equifax used this on-line tool for logging their issues with the credits
reports of them. Due to this single flaw the attacker was able to take control over the website.
This flaw in the Apace Struts was knows by the Equifax and they were working on this to fix this
issue. While they were working on this issue the hackers identified this security flaw in the
system and gained access through it to the sensitive data of the users.
Possible Solutions: There are numerous number of activity that must be done by the Equifax
and the users of it after this type of data breaches occurred within the system. This type of credit
related data breach can lead to financial loss to the users so users always need to take some
approach at end of themselves for possible solution of this type of cases (Gressin, 2017). For the
organization the Equifax must discover some specific way for patching the existing system so
that data breach can be stopped immediately. After that other security measures also need to be
implemented by the Equifax for securing the data of the customers. The Equifax also need to
ensure that while they are patching the system other type of security issues does not occurs
within the system.
At the end of the users they also need to take some precautions. In this type of situations
first of all the customers must check their credit accounts for any type of suspicious activity. This
is the first step of analysing any type of data breach (Xu, 2015). However, only monitoring the

3DATA BREACHES
credit account data will not help the customers in this case. The customers or the users
immediately need to change their login id and the respective passwords for the further safety of
them. The Equifax data breach was the personally identifiable information type of data breach in
which their personal information was breach. Thus, it is very likely that the users will can also
face attacks on their other on-line accounts also which includes bank accounts, e-commerce
accounts and the social media accounts. Thus, the users must change all the passwords and
important credentials for each of the account (Sun, Liu & Xie, 2016). With that the users of
Equifax must also freeze their credit accounts so that any type transaction cannot be happen
anonymously. Though adding freeze and removing freeze from accounts is chargeable from the
end of the service provider and the charge can vary for different kind of situations. Still the
freezing of the accounts is the only solutions in this type of data breach cases.
Part 1 B:
The fence register is associated with providing of abilities related to the relocation. For
the purpose of separating the two user areas they are provided with a start address which is also
known as the base address which is being provided. Along with all this each and every program
present in the specific user area are offset from the base address (Van Schaik et al., 2017). In
addition to all this a user who is associated with the usage of the address space might be seen to
be exceeding beyond its limit, for this reason the upper bound is also very important for the
purpose of restricting the user from entering into another user area. The upper bound register is
also known as the bound register. For this reason, in order to provide separation along with the
maintenance of the integrity of data the base or the bound register scheme is very important
which needs to be implemented (Stevens, 2016). A pair of base or bound register is associated
with providing the lower and upper limits of the area specific to that user, so it is not possible for

4DATA BREACHES
the pair to provide protection to a single user area from other users. Paging is associated with
dividing the program into equal-sized pieces. Pages, along with the memory is seen to be divided
into page frames. With this, the page table name and the related memory address are stored in a
page table (Whitty et al., 2015). Using the page and the offset value. Different addresses can be
accessed.
The synchronous operation is seen to be waiting along with which the other operations
are also seen to be in an ongoing process. By having the asynchronous activity, the process
continues to be executed in the backend. For example, like a user is accessing the data base at
that time. The file that needs an input/output write does not have to wait. Besides all this by
having the asynchronous I/O execution, it might be seen that a process is associated with
accessing or being associated with the modification of the data in the memory which is seen to
be accessed by some other data (Brown, Gommers & Serrano, 2015). For this reason, the data
present in the base or in the bound register along with the paging values might also be
overwritten.
The asynchronous activity can be prevented from modification of the data BY
implementing a check on the data access.
Another one of the major solutions is the application of the one more pair of bases or bound. One
of the pairs would be associated with providing of instructions whereas the other one would be
associated dealing with the data space (Shin, Son & Heo, 2015). The instructions are cached
through the register which possess accessed initially and verified through the next register. The
power to divide the program into two parts that should be able to relocate individually was the
major benefit.

5DATA BREACHES
Part B:
1. 2011 Sony Playstation Network Outage Case
a. What was the problem?
Sony suffered a huge breach in its computer game online system that encouraged the
break-in of names, addresses and perhaps charge card information having a place with 77 million
client accounts and this is considered to be one of the biggest ever Internet security break-ins.
Sony also discovered that data of the clients were stolen from the PlayStation Network seven
days before it was forced to close down the system promptly (Kogiso & Fujita, 2015). The
"unlawful and unapproved individual" also received the data of individuals' including the names,
addresses, email address, birth dates, usernames, passwords, logins, security inquiries and that's
only the tip of the iceberg.
b. Who was affected and how?
Sony had also been associated with making of announcements related to the account
break-in of more than 93,000 customers. This break-in was done by means of making certain
attempts related to logging in to Sony (Maglaras et al., 2018). This was reported to be done by
usage of large list of usernames and passwords. The security redirection changes from week to
week and companions approaches need to adhere to this equivalent example. Besides all this the
untouchable surveys should necessarily be ending up in a customary manner and for this reasons
the associations are seen to be capable of having an essential course of action of eyes exploring
their wellbeing endeavors (Genge, Haller & Kiss, 2017). Development should be revived as
often as possible, as well. What you were using as a section isn't any longer pertinent today.
Additionally created measures like framework interference revelation and passage testing can

6DATA BREACHES
help thwart and recognize security breaks. One of Sony's most concerning issues wasn't being
hacked; it was fail to recognize the hack until the point that it ended up open. By then, it was past
the final turning point. The last, anyway apparently most fundamental, some portion of security
is the substitute game-plan. In reality, even with the best wellbeing endeavors set up, no
affiliation is completely anchored. Associations need to wake up to this reality in case they might
want to survive a data burst.
c. How was the attack carried out?
The security preoccupation changes from week to week and companions approaches need
to adhere to this same example. Untouchable audits should end up the standard so associations
can have an essential course of action of eyes researching their wellbeing endeavors.
Advancement should be invigorated as often as possible, as well (Sabaliauskaite & Mathur,
2015). What you were using as a piece of 2007 isn't any longer pertinent today. Additionally
created measures like framework interference disclosure and passageway testing can help hinder
and recognize security breaks. One of Sony's most concerning issues wasn't being hacked; it has
failed to recognize the hack until the point that it ended up open. By then, it was past the final
turning point.
d. What could have been done to prevent the attack?
For Sony along with the other associations which are having the essential need of having
a sidestep is practically going to meet an identical fate — security must to be an essential bit of
association culture, from the best the separation down.
For instance, if the Email is considered then it should not be left aside and besides this all
the corporate correspondence should necessarily be mixed which would be acting as an issue of

7DATA BREACHES
the entire preparation (Khorrami, Krishnamurthy & Karri, 2016). Everything thought of it as', not
just passwords and Social Security numbers that can make hurt an association.
All the associations need to prepare their delegates on the best way to live and breathe in
best security sharpens. Delegates need to grasp the setting of not only their condition (don't
enable PCs to sit unbothered out in the open places and think about joining open Wi-Fi hotspots
of their data. Information is critical, and understanding this can go far in settling people's
presumptuous perspective toward it.
In the interim, it is very essential to make sure that the IT offices are associated with
making themselves get advance by means of the diversion. Besides all this the consistency which
would be Negligible should not be the consistency (Evans et al., 2016). They should also
associated with rehearsing a steady carefulness along with a reliably check for the infections on
the off chance that they should necessarily be associated with considering this type of danger
very important.
The diversified changes in the security which are seen to be taking place weekly along
with the friendly approaches which are associated with helping should be necessarily be
associated with sticking to the similar type of pattern. In addition to this the review which are
received from the outside reviewer is seen to be associated with winding up of the entire thing
ordinarily. This is mainly done so as to provide help to the organization in the process of having
the basic arrangements which are seen to eb related to the investigation of the various kinds of
efforts related to providing of security.
In addition to all this there also exists the need of refreshing the innovation in a frequent
manner. This mainly includes those which are things that are being utilized as of the 2007 which

8DATA BREACHES
are not seen to be applicable anymore in today’s world (Balzacq & Cavelty, 2016). In addition to
all this the further development measurer’s such as the discovery of the system interruption
discovery and entrancing of the testing which is capable of helping the forestall as well as the
distinguish security breaks. One of Sony's most concerning issues wasn't being hacked; it was
neglecting to distinguish the hack until the point that it wound up open. By at that point, it was
past the point of no return.
The last, however seemingly most essential, part of security is the alternate course of
action. Indeed, even with the best safety efforts set up, no association is totally secured.
Organizations need to wake up to this reality on the off chance that they would like to survive an
information rupture.

9DATA BREACHES
References:
Balzacq, T., & Cavelty, M. D. (2016). A theory of actor-network for cyber-security. European
Journal of International Security, 1(2), 176-198.
Brown, S., Gommers, J., & Serrano, O. (2015, October). From cyber security information
sharing to threat management. In Proceedings of the 2nd ACM workshop on information
sharing and collaborative security (pp. 43-49). ACM.
Evans, M., Maglaras, L. A., He, Y., & Janicke, H. (2016). Human behaviour as an aspect of
cybersecurity assurance. Security and Communication Networks, 9(17), 4667-4679.
Genge, B., Haller, P., & Kiss, I. (2017). Cyber-security-aware network design of industrial
control systems. IEEE systems Journal, 11(3), 1373-1384.
Gressin, S. (2017). The equifax data breach: What to do. Federal Trade Commission, 8.
Khorrami, F., Krishnamurthy, P., & Karri, R. (2016). Cybersecurity for control systems: A
process-aware perspective. IEEE Design & Test, 33(5), 75-83.
Kogiso, K., & Fujita, T. (2015, December). Cyber-security enhancement of networked control
systems using homomorphic encryption. In 2015 54th IEEE Conference on Decision and
Control (CDC) (pp. 6836-6843). IEEE.
Maglaras, L. A., Kim, K. H., Janicke, H., Ferrag, M. A., Rallis, S., Fragkou, P., ... & Cruz, T. J.
(2018). Cyber security of critical infrastructures. ICT Express, 4(1), 42-45.

10DATA BREACHES
Robbins, J. M., & Sechooler, A. M. (2018). Once more unto the breach: What the equifax and
uber data breaches reveal about the intersection of information security and the
enforecement of securities laws. Criminal Justice, 33(1), 4-7.
Sabaliauskaite, G., & Mathur, A. P. (2015). Aligning cyber-physical system safety and security.
In Complex Systems Design & Management Asia (pp. 41-53). Springer, Cham.
Shin, J., Son, H., & Heo, G. (2015). Development of a cyber security risk model using Bayesian
networks. Reliability Engineering & System Safety, 134, 208-217.
Stevens, T. (2016). Cyber security and the politics of time. Cambridge University Press.
Sun, C. C., Liu, C. C., & Xie, J. (2016). Cyber-physical system security of a power grid: State-
of-the-art. Electronics, 5(3), 40.
Van Schaik, P., Jeske, D., Onibokun, J., Coventry, L., Jansen, J., & Kusev, P. (2017). Risk
perceptions of cyber-security and precautionary behaviour. Computers in Human
Behavior, 75, 547-559.
Wang, P., & Johnson, C. (2018). CYBERSECURITY INCIDENT HANDLING: A CASE
STUDY OF THE EQUIFAX DATA BREACH. Issues in Information Systems, 19(3).
Whitty, M., Doodson, J., Creese, S., & Hodges, D. (2015). Individual differences in cyber
security behaviors: an examination of who is sharing passwords. Cyberpsychology,
Behavior, and Social Networking, 18(1), 3-7.
Xu, S. (2015). Cybersecurity dynamics. arXiv preprint arXiv:1502.05100.

11DATA BREACHES
Zou, Y., & Schaub, F. (2018, April). Concern But No Action: Consumers' Reactions to the
Equifax Data Breach. In Extended Abstracts of the 2018 CHI Conference on Human
Factors in Computing Systems (p. LBW506). ACM.
Zou, Y., Mhaidli, A. H., McCall, A., & Schaub, F. (2018). " I've Got Nothing to Lose":
Consumers' Risk Perceptions and Protective Actions after the Equifax Data Breach.
In Fourteenth Symposium on Usable Privacy and Security ({SOUPS} 2018) (pp. 197-
216).