Security, Audit & Critique of a Hacking Incident at Snowdenia County

This report delves into the security, audit, and critique of a hacking incident that occurred at the Republic of Snowdenia County Council. It begins by outlining the core tenets of network security, specifically the AIC triad (Confidentiality, Integrity, and Availability), and how these principles are essential for ensuring secure operations. The report then analyzes the specific hacking attack, which involved a three-pronged intrusion employing a Man-in-the-Middle attack, password cracking, and exploitation of a work-from-home WiFi facility. It provides a critical evaluation of the attack, highlighting vulnerabilities and failures in the existing security systems. Furthermore, the report offers guidelines for auditing and testing the council's IT infrastructure, emphasizing the importance of administrative, technical, and physical security controls, along with the need for third-party audits. Finally, the report concludes with recommendations to mitigate future security threats, including password changes, software updates, and the implementation of robust security policies and procedures.

Running head: SECURITY, AUDIT & CRITIQUE OF A HACKING INCIDENT
Security, Audit & Critique Of A Hacking Incident At Snowdenia County Council
Your Name (First M. Last)
School or Institution Name (University at Place or Town, State)
1

SECURITY, AUDIT & CRITIQUE OF A HACKING INCIDENT
Table of Contents
Abstract............................................................................................................................................3
Security, Audit & Critique Of A Hacking Incident At Snowdenia County Council.......................4
How To Ensure Secure Operations (Confidentiality, Integrity, Availability)?...............................4
Confidentiality.....................................................................................................................5
Integrity................................................................................................................................6
Availability..........................................................................................................................6
Policies and Procedures.......................................................................................................7
Auditing/Testing Approach for Security and Better Compliance....................................................8
Critique of Hacking Attack..............................................................................................................8
Conclusion.......................................................................................................................................9
Recommendations..........................................................................................................................10
References......................................................................................................................................11
2

SECURITY, AUDIT & CRITIQUE OF A HACKING INCIDENT
Abstract
Anything that is of importance will be stolen or at least attempts will be made to steal it, both
from outsiders and insiders. This holds for digital assets also and securing the data in transit, and
at rest is an inherent responsibility of every network worth its salt. The security of a network
boils down to three core concepts which have to work together. These are confidentiality,
integrity and availability, commonly referred to as CIA or more recently as AIC to avoid
confusion with a government agency of America. This paper is focused on the Republic of
Snowdenia County Council and the recent hacking attack and will explore the tenets of AIC, in
addition to critiquing the attack and providing guidelines for auditing/testing approach for the
council.
Keywords: Snowdenia County Council, network, security, hacking
3

SECURITY, AUDIT & CRITIQUE OF A HACKING INCIDENT
Security, Audit & Critique Of A Hacking Incident At Snowdenia County Council
It is human nature to attempt to get an unfair advantage, to exploit the system and get
benefits from the labour of someone else. Any organisation maintaining computer networks
would do much better to accept this as a part of daily routine and design their networks
accordingly. Network security is an important issue because of their utilisation and
indispensability for storing, accessing, and providing business information, internally as well as
externally to suppliers and customers [1]. The violations can not only occur from outside but
inside the network also. As an illustration, the focus of this paper, the Republic of Snowdenia
County Council, got attacked from inside when an employee launched a three-pronged intrusion,
based on the Man-in-the-Middle (ARP poisoning) attack, password cracking, and access via an
Internet WiFi facility offered for roving staff working at home. This attack will be critiqued later
in the paper.
The security of a computer network can be distilled into three concepts - confidentiality,
integrity and availability. These are referred to as the CIA triad or more recently as AIC triad, to
avoid confusion with the Central Intelligence Agency of America [2]. This paper will explore the
AIC triad, critique the above-mentioned attack, and provide broad guidelines for auditing/testing
to help ensure a more secure as well as more compliant organisation.
How To Ensure Secure Operations (Confidentiality, Integrity, Availability)?
The three tenets of a secure computer network are Confidentiality, Integrity, and
Availability (AIC) and these three must be present and work in tandem. These three require
services and cooperation of the entire organisation.
4

SECURITY, AUDIT & CRITIQUE OF A HACKING INCIDENT
Confidentiality
Confidentiality in network security means privacy. It means to prevent access to
information from people who are unauthorised, while simultaneously ensuring that the
authorised people get the access [3]. Confidentiality consists of two techniques - authentication
and authorisation. Authentication is the process of validating the details of an entity (person,
computer, network, etc) to what it claims to be. Authorisation is the process of ensuring that the
authenticated entity has access to the requested resource.
If a system loses confidentiality, then sensitive data may be exposed to unauthorised
individuals. Now, this may be some sensitive and critical information which in the hands of
competitors, hackers, etc could lead to severe financial loss, or to a loss of goodwill and trust in
the market. Or, this information could be of a more localised effect, like an employee being able
to access the company's payroll details. As an illustration of a more critical loss, Snowdenia
County Council's private data was released into the public domain, published via a website for
criminals seeking information for various illegal activities. The Council is house to lots of
sensitive information which in the hands of unauthorised people can do a lot of harm not only to
the Council but the society at large. It has strict requirements of confidentiality.
Confidentiality is ensured using encryption and cryptography [2]. These techniques
ensure that only authorised people may access the data while the data is at rest (stored in
company's computers) or in motion (being sent from one machine to another). Other techniques
include "principle of least privilege" in which a person is given the minimum rights required to
enable him to carry on with his specified duties. Also, file permissions may be used to help in
achieving confidentiality [4].
5

SECURITY, AUDIT & CRITIQUE OF A HACKING INCIDENT
Integrity
Information has value only when it is correct [4]. Integrity in computer security means
that the data is authentic - it is neither altered without authorisation nor the source of the data
fake [5].
Loss of integrity means that data cannot be trusted. This is especially important when the
data is sent through an insecure channel like the Internet. This happens when the data is not
representative of the original and has been modified. This could happen to data at rest when it is
modified by an unauthorised person or could happen to a data in transit as it makes its way over
a computer network. This unauthorised change while the data is moving through the network is
called man-in-the-middle attack and was one of the techniques used in the County hacking
attack. The Council, like any other organisation, is required to ensure the security of its data
while at rest and in motion.
Techniques to ensure integrity involve cryptography (public-key and private-key),
message digests (hashing), checksums, file permissions, the principle of least privilege.
Availability
Availability in network security means that the data and services provided by the network
are available whenever the authorised people want to use them. Two points are relevant to this
discussion. One that only the authorised people must be able to access the resources and this
overlaps with the confidentiality requirement. The other is that when the authorised person wants
to access, that is the defining time for the loss of availability. As an illustration planned and
announced downtime for maintenance is also counted as a loss of availability.
The loss of availability is a directly visible when the authorised person is not able to
access the data or service. This may happen deliberately or unintentionally. Deliberate attempts
6

SECURITY, AUDIT & CRITIQUE OF A HACKING INCIDENT
to subvert availability may be the result of sabotage, attack by competitors or hacker, a general
man-made disaster like a terrorist attack. Unintentional losses may happen due to power outages,
hardware failures, software bugs. The loss of availability may result in the business losing
orders, customers and goodwill. Attacks on an organisation to make it lose its availability are
referred to as Denial-of-Service (DOS) attacks. The Council serves many different types of
people and organisations. Some of them may be able to live with a delay due to loss of
availability, but most others will not. Thus, it is Council's responsibility to have round-the-clock
monitoring and be prepared to recover from any loss of availability.
Availability (also called as uptime) is ensured by maintaining the hardware and software.
Backups of data (hot and cold, on-site and off-site), a disaster recovery and business continuity
plan (DRBCP) are essential. Also, fundamentals like electricity, physical environment, security
of equipment, etc need to be maintained. Additionally, firewalls and automatic scaling of
resources as per the demand (as in cloud computing) may help prevent or mitigate a DOS attack.
Policies and Procedures
As it has been discussed, networks are vulnerable, both from outside and inside. Attacks
on networks can lead to loss of time, money, sensitive information or even lives [6]. Security
tenets are being developed and refined in the face of changing threat and technology landscape.
For the Council, to help ensure a more secure operating environment following procedures and
policies are recommended:
Securing all new hardware and software to meet the organisation's requirements with
minimum facilities, changing the default passwords, updating firmware/software to latest
version. Updating software is essential to cover against Common Vulnerabilities and Exposures
(CVE). Another policy is to remove all privileges and then provide as and when required. Also,
7

SECURITY, AUDIT & CRITIQUE OF A HACKING INCIDENT
verbose logging is recommended [6]. Next, some policies are required to cover the yet
undiscovered vulnerabilities. For this, baselines have to be established and then the systems must
be monitored from deviations from baseline using anomaly-based detection techniques. Next,
firewalls and intrusion detection systems (IDS) are to be configured, updated and used. Finally,
maintenance needs to be done on all hardware and software systems.
Auditing/Testing Approach for Security and Better Compliance
Security is not only a fundamental requirement for business but often also legal and
compliance requirements. A plan is recommended for auditing and testing the security of the
Council's network and Information Technology (IT) infrastructure. Contrary to popular belief,
technical security is a part of the complete security picture of an organisation [8]. The main
security control types are administrative, technical, and physical [7], and these must work
together to help ensure a secure environment and compliance with laws and regulations. It is also
recommended that a third-party security auditor is hired rather than an in-house employee doing
the auditing. That said, is audits confirming if passwords are difficult to crack, access control
lists (ACL) are implemented, creation and follow-up of audit logs, removal of unnecessary
software and data [9], use of techniques to ensure the AIC triad are implemented or not. In
addition, audits on physical infrastructure, physical access policies, utilities (electricity, water,
etc) need to be done.
Critique of Hacking Attack
The mentioned hacking attack on the Council was done by an employee and was a three-
pronged intrusion, based on the Man-in-the-Middle (ARP poisoning) attack, password cracking,
and access via an Internet WiFi facility offered for roving staff working at home. A Man-in-the-
middle attack is like active eavesdropping in that the attacker is not only listening to the
8

SECURITY, AUDIT & CRITIQUE OF A HACKING INCIDENT
conversation but also modifying the contents which the receiver is unknown of. For the receiver,
the messages received are bona fide and sent by the original sender. Address Resolution Protocol
(ARP) was designed to resolve Internet layer addresses into link layer addresses. This is an
essential functionality that cannot be done away with. Unfortunately, ARP in inherently insecure
in that it will accept updates at any time [10] allowing a hacker to spoof packets to pretend to be
somebody else and the recipient obliges. Password cracking involves trying different
combinations of the password by an unauthorised person. Brute-force attacks, dictionary attacks
etc are common ways, though for the said attack it appears that employee was more readily able
to crack the password on account of his being an insider. Finally, work-at-home facility's
weaknesses in implementation were exploited. All these attacks were launched simultaneously
and the current security systems were unable to detect or prevent the attack.
Conclusion
Computer networks have revolutionized the way businesses are run, but attacks to the
network can be fatal to the business [6]. As recently experienced by the Republic of Snowdenia
County Council, attacks can originate from outside as well as inside the network. Attacks on a
network should not be considered an aberration. They are a norm with competitors, saboteurs,
and hackers wanting to benefit from the loss to the network. Security concepts have been defined
and refined to handle the issues and are encapsulated in the AIC triad. The paper looks into this
triad, with techniques and tools to help implement these. Also, the attack on the Council is
critiqued, and a guide for auditing is proposed.
9

SECURITY, AUDIT & CRITIQUE OF A HACKING INCIDENT
Recommendations
 User names, passwords, and other information leaked in the hacking attack be replaced so
that any hacker trying to use that information hits a dead-end.
 Change all default passwords and configurations of devices
 Create new passwords, and implement an expiration policy.
 Update all equipments and computers to the latest software.
 Firewall, IDS, verbose logging, audit trails need to be maintained.
 Baselines to be established for routine and acceptable user and system behaviour.
 Anomaly-detection techniques to be run for noticing and alerting on deviations from
baseline to cover novel ways of attacks e.g. an employee account accessing the system at
two in the morning.
 Establish and implement a DRBCP
 Get the security audited by a third-party auditor.
10

SECURITY, AUDIT & CRITIQUE OF A HACKING INCIDENT
References
[1] O. Poole, Network Security, 1st ed. Routledge, 2007.
[2] Jim Doherty., Wireless and Mobile Device Security, 1st ed. Jones and Bartlett Learning,
2015.
[3] M. Haughn and S. Gibilisco, "What is confidentiality, integrity, and availability (CIA triad)?
- Definition from WhatIs.com", WhatIs.com, 2014. [Online]. Available:
http://whatis.techtarget.com/definition/Confidentiality-integrity-and-availability-CIA.
[Accessed: 24- Dec- 2016].
[4] T. Chia, "Confidentiality, Integrity, Availability: The three components of the CIA Triad «
Stack Exchange Security Blog", Security.blogoverflow.com, 2012. [Online]. Available:
http://security.blogoverflow.com/2012/08/confidentiality-integrity-availability-the-three-
components-of-the-cia-triad/. [Accessed: 24- Dec- 2016].
[5] C. Mills, "Confidentiality, Integrity, and Availability", Mozilla Developer Network, 2016.
[Online]. Available:
https://developer.mozilla.org/en-US/docs/Web/Security/Information_Security_Basics/
Confidentiality,_Integrity,_and_Availability. [Accessed: 24- Dec- 2016].
[6] J. Allen, "CERT System and Network Security Practices", Proceedings of the Fifth National
Colloquium for Information Systems Security Education (NCISSE'01), George Mason
University, Fairfax, VA USA, 2001.
[7] C. Jackson, Network security auditing, 1st ed. Indianapolis, IN: Cisco Press, 2010.
[8] C. Jackson, Network Security Auditing, 1st ed. Cisco Press, 2010.
[9] B. Hayes, "Conducting a Security Audit: An Introductory Overview | Symantec Connect",
Symantec.com, 2003. [Online]. Available:
11

SECURITY, AUDIT & CRITIQUE OF A HACKING INCIDENT
https://www.symantec.com/connect/articles/conducting-security-audit-introductory-
overview. [Accessed: 24- Dec- 2016].
[10] C. Sanders, "Understanding Man-in-the-Middle Attacks - ARP Cache Poisoning (Part 1) -
TechGenix", Techgenix.com, 2010. [Online]. Available:
http://techgenix.com/Understanding-Man-in-the-Middle-Attacks-ARP-Part1/. [Accessed:
24- Dec- 2016].
12