Discuss the below:
1. The first successful cyber-attack that dscuss is one that did a good deed rather than a bad deed. The United States cyberattack against Iran was known as Stuxnet. Iran was building its nuclear capabilities and was becoming more and more successful. All options such as international sanctions were not working to slow down Iran from building a nuclear warhead.
"The Stunext computer worm destroyed centrifuges inside Iran's Natanz uranium enrichment site", (Goodwin, D., 2016). By doing so, this cyber-attack would potentially set Iran back one or two years thus delaying Iran from completing their goal. The cyber-attack also focused on the "Fordo nuclear enrichment site using a computer worm to destroy computer systems", (Goodwin, D., 2016). Many of Iran's control systems were targeted with the intent to disable. The bottom line is Iran would need to start entirely over for certain pieces of their systems to meet their goal of building that nuclear warhead.
The second cyber-attack that I will discuss was conducted by the bad guys. This cyber-attack was known as the Epsilon cyber-attack. This was an email hack intended to exploit Epsilon email system to its customers. The attackers were able to infiltrate the email system. "Computer hackers have stolen the names and email addresses of millions of people in one of the largest internet security breaches in US history", (Halliday,J., 2011). The attackers now had access to the customers email addresses which leads to an opportunity to scam someone of their personal information.
This was a large attack that also affected customers of "Barclaycard US, Capital One, and other large firms", (Halliday,J., 2011). These cyber-attacks that I have mentioned have looked to exploit a vulnerability. One was done to disable or delay. The other was done to gain personal information that could potentially lead to a score of conning someone out some or all of their finances.
2. The first cyber attack that I will discuss occurred in February 2015. This attack targeted one of the largest health insurance company called Anthem. This attack targeted the personal identifiable information of the companyâ€TMs customers as well as employees. Representative from Anthem described this attack as being a “very sophisticated external attack.†(Granville, 2015). The attackers utilized cyber hacking to breach the database of the company and reveal personal information of tens of millions of people. Along with personal information such as addresses, social security numbers, and birthdays, the hackers also stole some data belonging to the company (Granville, 2015).
The second cyber attack also occurred in 2015, however it was a slightly different approach than the previously mentioned attack. This attack was sophisticated yet very simple in nature. The target of this attack was a company named Sacred Heart Health systems. Hackers were able to billing information of more than 14,000 of the companys customers. This was not done through traditional means of hacking. Hackers were able to breach the email account of a single employee of a third-party billing vendor. By doing this the hackers were able to retrieve access to all those accounts that the individual was involved with (EconMatters). While both of these attacks were similar in targets, being personal information and financial data, the motivation was likely the same in which the hackers were attempting to achieve financial gains.
3. The hackers affected all the Target outlets in the U. S. Hackers got access to the company's data stored in the magnetic stripe on the cards. The intention of the hackers was to get the credit and debit card information and use it to make counterfeit cards and steal the customers' money through the ATM's.
Further, in June 2012 the U.S. and Israel were being accused of cyber attacks the Iranian Nuclear program. The article was saying that the cyber attack by the flamer. The US was the principal player in the most sophisticated cyber-attack ever known and has been orchestrating a campaign against Iran designed to undermine the country's nuclear program, it has been claimed. This cyber attack claims to have attacked the plant and made the centrifuges go crazy. This worm was implemented in corrupted hard drives. The motivation of core was to disrupt the uranium enrichment of the Iranian nuclear production. According to the article it also was built to Flamer also targeted Iran, though its main aim was to spy on the country's oil industry. It is believed to have downloaded vast amounts of information over two years and had technical capabilities never seen before... your thoughts?
4. How are some ways corporations and businesses can protect consumers against such instances as the Target incident? First off, I think it is bad business practice to store the information on the cards consumers use. If they were going to store the information, it should be limited in nature, not all that is required to duplicate a false card. It is my belief that it should be required that individuals input the necessary information for every purchase. I realize this is a convenience factor but it is a security factor as well. Once a criminal or criminal entity knows that there is a single place this information is stored, they will target that location for monetary benefit. If it is going to be used, there needs to be a layered security in place that changes and evolves over time. "A layered security model is very strong (if implemented properly) as designed without exception; however, as with any system, there may be circumstances in which exceptions might have to be made" ((Radvanovsky & McDougall, 2013, p. 198). Even though a layered system is in place, practices should be changed regularly so that intruders do not work through each layer systematically until it is defeated.
5. The primary reason that enterprises consciously use outdated technology makes a lot of sense. With the introduction of new technology and programs, the vulnerabilities of these new systems are yet to be discovered and it is unknown how severe the impact will be if these vulnerabilities are exploited. This is one of the reasons why enterprises use outdated technology; it has known vulnerabilities that entities can work to minimize and avoid being compromised (Radvanovsky & Mcdougall, 2013). Knowing what the vulnerabilities are reduces the unknowns in the infrastructure and provides the agency with information that will assist in developing and implementing safety protocols.
Other reasons and advantages of using outdated technology is that it is cost effective. Many older platforms still provide regular security software updates. These programs and systems are already implemented throughout the agency as well. New technology and distribution of this technology throughout an entire organization is extremely expensive and will minimize profit margins. In regards to vulnerabilities, the cost of developing and implementing security protocols for unknown vulnerabilities can be expensive as well. In the event of an attack, the agency will need to develop and implement security protocols almost immediately to avoid further exploitation. This type of time sensitive reaction can be incredibly expensive due to the hours engineer need to put in and the costs of recovery and stability will increase as well.
Many programs, such as Windows 7, discontinued the development of new security updates. When this occurs, the agency will need to locate and implement new software relatively quickly to avoid security vulnerabilities to be exploited. It would appear that other than cost, operating on outdated technology is the more reactive way to handle cyber security safeguards.
Major enterprises are focused on maximizing profit. If expenses are paid to purchase, distribute, and safeguard new technology on a regular basis, profits become minimized. It would seem that many major organizations are comfortable with potential exploitation as long as there is continued revenue.
6. The two primary reasons enterprises would utilize outdated technology is simply fear and money. Many enterprises are fearful of utilizing advanced technology because they fear this technology creates an additional vulnerability to being attacked. This goes back to the cloud discussion we had. Many old age leaders are hesitant to convert to something such as the cloud because they feel that the outdated or older technology they are accustomed to is the only method available. They also believe the newer technology is simply more susceptible to attacks. Additionally, these individuals are often times stuck in their ways and against change. Also, many enterprises do not want to put the financial investment into something that cannot really be seen or is materialistic in nature. This goes back to the risk calculation and vulnerability assessment we discussed earlier in the course. When it is all said and done this financial investment will likely save the enterprise or user a lot more money in the future when they are able to successfully defend against a cyber attack. The advantages to outdate technology is hard to see. Often times these older technology systems are actually easier to breach, however there can be some situation where older technology is harder to breach because it is not understood by the new age hacker. This like our children one day having to learn to text on an old school cell phone where you have to hit the button 6 ties to get the letter you want. However, more times than not these systems are actually easier for hackers to get into because of the lack of advanced security systems and protocols that come with new technology. At the end of the day the disadvantage of using old technology far outweighs the benefits and if any enterprise wants to be successful they must be willing to adapt to their environment and in todays world that environment is all about the technology. If security managers are not willing to adjust and adapt to the enemy then they are ultimately allowing the enemy to get ahead.
7. If companies or businesses do not wish to upgrade their control systems due to physical constraints or capability, what should be done? In my opinion, if they are going to use outdated equipment that simply cannot be protected against the current cyber threats; they should remain on a closed network. Unfortunately, "[c]ontrol systems are increasingly using wide-area networks and the Internet to transmit data to their remote or local stations and individual devices" (Radvanovsky & McDougall, 2013, p. 184). By doing this, they are exposing something that cannot be protected to outside threats. I understand this is a matter of convenience but it is cheaper to pay an individual to monitor a system than conduct a complete system upgrade. Along with that, there needs to be a continuity plan in place. Through this plan, the company prepares for a time when the current equipment is set to stop running or begin its downward cycle. Older systems have a shelf life and they need to plan for when that expires. If they decide to incorporate new technology, they need to consider the expenses associated with the protection of those assets.