SBM4302 - IT Audit and Controls: NAB Data Breach Investigation

This case study analyzes the National Australia Bank (NAB) data breach, where approximately 13,000 customers' data were compromised due to unauthorized upload to data service companies. The assignment explores common security issues like code injection, malware infection, data breaches, and malicious insiders. It examines NAB's response, including contacting the companies and providing customer support. The study emphasizes crucial information security measures such as strong passwords, system updates, firewalls, employee training, and securing end-user devices. It also highlights the role of cloud computing in enhancing information security through authentication, data protection, and regulatory compliance. The conclusion underscores the importance of robust security practices to prevent future incidents and protect sensitive customer data.

Running head: SBM4302 IT AUDIT AND CONTROLS
SBM4302 It Audit and Controls
Name of the Student
Name of the University
Author Note

1SBM4302 IT AUDIT AND CONTROLS
Table of Contents
Introduction:...............................................................................................................................2
Overview of the Addressed Problem:........................................................................................2
Common Security Issues that an Auditor needs to Investigate:.................................................3
Code Injection:.......................................................................................................................3
Malware Infection:.................................................................................................................4
Data Breach:...........................................................................................................................4
Malicious Insiders:.................................................................................................................5
NAB’s Response to the Data Breach:........................................................................................5
Information Security Measures NAB Should Adopt:................................................................6
Role of Cloud Computing in Information Security:..................................................................7
Conclusion:................................................................................................................................8
References:.................................................................................................................................9

2SBM4302 IT AUDIT AND CONTROLS
Introduction:
Data security is one of the major concerns in the present situation. There are various
of reports regarding the issue of data security from all around the world. The data security is
the mean of protecting the digital data from any type of unauthorised users, unwanted actions
which can include a data breach or a cyber-attack (Huang et al. 2017). Though data security
is extremely important in many cases the data security got breached. From all of the data
security issues it has been identified that internal error is one of the major concern due to
which data security related issues occurs. Many big organizations have faced this type of data
security related issues and have failed to provide enough security to the customer data. One
this kind of data security issues have occurred recently in the National Australia Bank (NAB)
where approximately 13,000 user’s data were compromised. In the following section of this
report this data security related issue is described briefly.
Overview of the Addressed Problem:
The current issue that the National Australia Bank had faced is regarding the data
breach of their customers records. At the time of setting up the account in the bank, the
National Australia Bank takes several of confidential data from its users. These data included
the name of the customers, birth date of the customers, contact details and government issued
identification numbers. All of these data are extremely important for the customers but
National Australia Bank completely failed to protect these data. From the reports of National
Australia Bank, it has been assessed that the data of almost 13,000 peoples were
compromised due to the incident (Hong and Alazab 2017). As per the statement of the bank
there was no externa attack or data breach but the issue was internal. The security of those
data was compromised due to some internal mistakes (Sloan and Warner 2019) where the
confidential data of those customers were uploaded to two data service organizations without

3SBM4302 IT AUDIT AND CONTROLS
any type of authorization. As the issue identified by the National Australia Bank, the security
team of NAB contacted both of the data service organizations and asked them to delete the
uploaded data within the two hours. Due to this small internal mistake confidential data of
around 13,000 peoples got breached.
Common Security Issues that an Auditor needs to Investigate:
The data breach issue is one of the common security issues that the organizations
faces. Thus, it is important for the auditor to investigate this issue. With the data security
issue, there are several of other common issues that an auditor needs to investigate. The
common type of security issues that the auditor needs to investigate are discussed in the
following section, including the data breach issue also.
Code Injection:
Code injection is one of the common issues that most of the organization faces and it
is also very crucial for the investigator to investigate the issue of data security. In this type of
scenarios hackers mainly uses the present vulnerabilities in the application or in the system to
insert some malicious type of code (Mitropoulos and Spinellis 2017). There are several types
of code injection attacks which are used for the different types of purposes. These code
injection attack includes script injection, SQL injection, dynamic evaluation attack, shell
injection and operating system command attack. This type of attacks is performed for mainly
stealing the important user credentials, and destroying data (Niakanlahiji and Jafarian 2017).
Due to this reason it is important for the auditor to investigate this type of security issues very
closely. There are two important ways through which this code injection attack can be
minimised which are avoiding vulnerable coding and filtering the input. For avoiding any
type of vulnerable coding, the auditor plays an important role as he/she will actively identify
any type of vulnerable code is present or not. Also, specific type of applications can used for

4SBM4302 IT AUDIT AND CONTROLS
ensuing protection against this type of attack which keep the separate from the queries and
the commands.
Malware Infection:
The malware infection is another type of common security issue which many
organizations faces. To contain this type of issues, again the auditor plays a vital role. Many
of the organizations are aware about the attack of malware infection where many of the
organizations unaware about this. The most common type of malware infection attack is
performed by the attackers through the spam mails (Holt et al. 2018). A general awareness
among the organizational employees is mainly required for minimising this kind of security
issues. The malware in the organization can come from different types of sources. So, the
organizations can implement different types of tools to prevent this kind of malware
infection. One of the effective solutions that can be used in this case is implementing a robust
filtering and robust system.
Data Breach:
Data breach is another important security issue that must be audited by the
investigator and it is the same which has been occurred for the National Australia Bank. The
cost of the data breach can be very high for the organisation if any type of sensitive data is
breached. The common type of data breech includes the compromised credentials. There is
some specific type of reasons due to which the data breach occurs (Solove and Citron 2017).
The common reason behind the data breach includes hardware issue, software
misconfiguration and the malware attacks. To implements an efficient type of measure
against the data breach several of good practices needs to be employed. One of the important
ways for minimising the data breach is implementing the encryption services using the SSL
(Goode et al. 2017). Also, data access permission must be distributed properly so that any

5SBM4302 IT AUDIT AND CONTROLS
type of unnecessary access can be restricted. Also, appropriate employees training is
important to handle this kind of issues.
Malicious Insiders:
It has been assessed that malicious insiders are one of the common security issues that
the auditors must be investigating. This issue actually requires some serious considerations.
The malicious insider means a specific type of attack which is performed internally, which
means this type of attack are performed by the insiders (Omar, Mohammed and Nguyen
2017). The only way for limiting this kind of attack is limiting the access to the potential
malicious insider. It means organization need to implement the logical access control policy
within the organisation and all the networks of the organizations must be audited properly to
minimise the threat of malicious insider.
NAB’s Response to the Data Breach:
As the data breach was acknowledged by the National Australia Bank, they
immediately taken some of the important actions to ensure the safety of both the customers
and the data. As the data was uploaded to the servers of two data service organizations
without any type of authorization, the National Australia Bank immediately contacted the
both of the data service organizations advised them to delete all the uploaded data to their
servers within two hours. This was the first step taken by the National Australia Bank so that
any type of further breach of the data can be avoided (Manworren, Letwat and Daily 2016).
Also, in this type of situation it was also important for the bank to ensure their customers.
Considering the situation, the National Australia Bank created a specialist support team for
the customers which was available 24/7. This team called each of the affected customers and
briefly described them the current issue. Also, this team took care of any type of concerns
from the customer end and provided a proper support to them. Also, as a result of this data

6SBM4302 IT AUDIT AND CONTROLS
breach issue enhanced their fraud detection identification service for the customers who were
affected due to the data breach (Cheng, Liu and Yao 2017). National Australia Bank also
assured their customers that they do not have to take any actions with their bank accounts as
NAB successfully reviewed all the accounts of the affected customers.
Information Security Measures NAB Should Adopt:
The recent data breach over the systems of National Australia Bank was very costly
for them and they faced several types of issues regarding their organizational operations.
Thus, is it being important that National Australia Bank takes appropriate measures regarding
information security so that this type of data security breach can be avoided. In the following
section these information security measures are discussed.
 Strong Password Establishment: Establishing a strong password is one of the
important security measures that the National Australia Bank should adopt
(Abdellaoui, Khamlichi and Chaoui 2016). This will highly help NAB in the aspect of
data security.
 System Update: To ensure the proper security of the information system it is
extremely important for NAB to ensure the regular system update. System updates
introduces new patches and fixes which will ensure that there is no loophole in the
system that the attacker can use (Riley, Stewart and DiNapoli 2019). So, it is
important keep the system always updated.
 Establishing a Firewall: Organizational networks requires protection from different
types of threats. Thus, it is important to implement proper firewall system so that
organizational network can be protected and it another security measure that must be
adopted by NAB (Wool 2018).

7SBM4302 IT AUDIT AND CONTROLS
 Providing Security Trainings to the Employees: Another important aspect the
information security measure is providing appropriate training to the employees. If the
employees are well educated about the potential security threats then the overall
number of information security breaches faced by the organization can be easily
reduced.
 Securing the End User Devices: Ensuring the security of end user devices is another
important security measure that must be undertaken by National Australia Bank. It is
possible that the end user devices used for the organizational purposes is holding
many sensitive information for the organization. In such situation it is very much
important to ensure the security of these end user devices (Kravitz and Cooper 2017).
One of the effective solutions for securing this end user device is encrypting the
device, so that access to the devices can be limited.
Role of Cloud Computing in Information Security:
Cloud computing is one of the emerging technologies in the current technological
field. Considering the information security, the cloud computing also plays an important role
in this aspect. In the aspect of information security, the cloud computing is also known the
cloud security. The cloud computing security is based on some specific set of policies,
procedures, control and technologies which all works together so that cloud-based systems
can be protected from any type of security breaches. The specific security measures
implemented by the cloud-based system are configured for the protection of crucial data,
privacy of the customers and for supporting the regulatory compliance (Sehgal, Bhatt and
Acken 2020). Also, the cloud computing system establishes proper authentication rules for
each of the devices and the users. The cloud computing solutions can be the exact
requirement for the businesses for the security purposes as it has the flexibility. All rules
regarding the security can be managed within a single space which is another important

8SBM4302 IT AUDIT AND CONTROLS
advantage cloud computing security measure. In this way, the cloud computing plays an
important role in the aspect of information security. How the security will be provided by the
cloud computing measures is depend on individual cloud computing service provider (Song,
2017). Implementation of the information security through the cloud computing measures is a
joint responsibility of the cloud service provider and the organization.
Conclusion:
From the above discussion, it can be concluded that proper information security
measures must be implemented within the organisations so that any type of security measures
can be resisted. In this report the case study of the National Australia Bank has been analysed
where a data breach occurred within this organization. In respect of the case study, in this
report, first the overview of the addressed problem by NAB has discussed where the main
issue occurred was regarding the data breach of the customers and also the main reason
behind the data breach has been identified. Following that, the report has identified and
discussed common type of security issues that must be properly investigated by the auditor.
As this type of big data breach case occurred in the organization, response of the National
Australia Bank was crucial. Here, NAB executed proper response and managed the situation.
Following the response of the NAB, some crucial information security measures have been
proposed which should be adopted by NAB. In the further section of this report, the role of
cloud computing security in information security has been demonstrated.

9SBM4302 IT AUDIT AND CONTROLS
References:
Abdellaoui, A., Khamlichi, Y.I. and Chaoui, H., 2016. A novel strong password generator for
improving cloud authentication. Procedia Computer Science, 85, pp.293-300.
Cheng, L., Liu, F. and Yao, D., 2017. Enterprise data breach: causes, challenges, prevention,
and future directions. Wiley Interdisciplinary Reviews: Data Mining and Knowledge
Discovery, 7(5), p.e1211.
Goode, S., Hoehle, H., Venkatesh, V. and Brown, S.A., 2017. User compensation as a data
breach recovery action: An investigation of the Sony Playstation network breach. MIS
Quarterly, 41(3), pp.703-727.
Holt, T.J., van Wilsem, J., van de Weijer, S. and Leukfeldt, R., 2018. Testing an Integrated
Self-Control and Routine Activities Framework to Examine Malware Infection
Victimization. Social Science Computer Review, p.0894439318805067.
Hong, S.H. and Alazab, M., 2017. Cybercrime and Data Breach: Privacy Protection through
the Regulation of Voluntary Notification. Prepared for the Korea Legislation Research
Institute (KLRI).
Huang, Z., Liu, S., Mao, X., Chen, K. and Li, J., 2017. Insight of the protection for data
security under selective opening attacks. Information Sciences, 412, pp.223-241.
Kravitz, D.W. and Cooper, J., 2017, June. Securing user identity and transactions
symbiotically: IoT meets blockchain. In 2017 Global Internet of Things Summit (GIoTS) (pp.
1-6). IEEE.
Manworren, N., Letwat, J. and Daily, O., 2016. Why you should care about the Target data
breach. Business Horizons, 59(3), pp.257-266.

10SBM4302 IT AUDIT AND CONTROLS
Mitropoulos, D. and Spinellis, D., 2017. Fatal injection: a survey of modern code injection
attack countermeasures. PeerJ Computer Science, 3, p.e136.
Niakanlahiji, A. and Jafarian, J.H., 2017, October. Webmtd: defeating web code injection
attacks using web element attribute mutation. In Proceedings of the 2017 Workshop on
Moving Target Defense (pp. 17-26).
Omar, M., Mohammed, D. and Nguyen, V., 2017. Defending against malicious insiders: a
conceptual framework for predicting, detecting, and deterring malicious
insiders. International Journal of Business Process Integration and Management, 8(2),
pp.114-119.
Riley, R., Stewart, R. and DiNapoli, S., 2019. NDBC Ocean Wave Observation System
Update.
Sehgal, N.K., Bhatt, P.C.P. and Acken, J.M., 2020. Foundations of Cloud Computing and
Information Security. In Cloud Computing with Security (pp. 13-48). Springer, Cham.
Sloan, R.H. and Warner, R., 2019. How Much Should We Spend to Protect Privacy: Data
Breaches and the Need for Information We Do Not Have. JL Econ. & Pol'y, 15, p.119.
Solove, D.J. and Citron, D.K., 2017. Risk and anxiety: A theory of data-breach harms. Tex.
L. Rev., 96, p.737.
Song, H., 2017, May. The development and application of information security products
based on cloud computing. In International Conference on Mechatronics and Intelligent
Robotics (pp. 223-228). Springer, Cham.
Wool, A., 2018. Trends in Firewall Configuration Errors.