Tag Archives: data breach

WHAT TO DO BEFORE AND AFTER A CYBERSECURITY BREACH?

How to respond when a breach occurs?

As discussed above, managers and organizations should take preventative steps to avoid the risk of a breach occurring. After spending time planning, spending money, and training employees, someone still manages to break through the organization’s security measures? What do you do now?! Once a breach has been discovered, the organization should take the following immediate steps to limit the breach.

Step 1: Survey the damage

Following the discovery of the breach the designated information security team members need to perform an internal investigation to determine the impact on critical business functions. This deep investigation will allow the company to identify the attacker, discover unknown security vulnerabilities, and determine what improvements need to be made to the company’s computer systems.

Step 2: Attempt to limit additional damage

The organization should take steps to keep an attack from spreading. Some preventative strategies include:

  • • Re-routing network traffic
  • • Filtering or blocking traffic
  • • Isolating all or parts of the compromised network

Step 3: Record the details

The information security team should keep a written log of what actions were taken to respond to the breach. The information that should be collected include:

  • • Affected systems
  • • Compromised accounts
  • • Disrupted services
  • • Data and network affected by the incident
  • • Amount and type of damage done to the systems

Step 4: Engage law enforcement

A major breach should always be reported to law enforcement. The law enforcement agencies that should be contacted are: • The Federal Bureau of Investigation (FBI) • The U.S. Secret Service (USSS) • The U.S. Immigration and Customs Enforcement (ICE) • The District Attorney • State and Local law enforcement

Step 5: Notify those affected

If a breach puts an individual’s information at risk, they need to be notified. This quick response can help them to take immediate steps to protect themselves. However, if law enforcement is involved, they should direct the company as to whether or not the notification should be delayed to make sure that the investigation is not compromised. The individuals are usually notified via letter, phone, email, or in person. To avoid further unauthorized disclosure, the notification should not include unnecessary personal information. 

Step 6: Learn from the breach

Since cybersecurity breaches are becoming a way of life, it is important to develop organizational processes to learn from breaches. This enables better incident handling, should a company be effected by a breach in the future. Some learning issues include:

  • Document all mistakes
  • Assess how the mistakes could have been avoided •
  • Ensure training programs incorporate lessons learnt

Must Do’s

  • Organizations must put the proper resources in place to ensure that any form of cybersecurity breach is dealt with swiftly and efficiently. 
  • There should be an effective Incident Response Plan.
  • Thoroughly check all monitoring systems for accuracy to ensure a comprehensive understanding of the threat. 
  • Engage in continuous monitoring of their networks after a breach for any abnormal activity and make sure intruders have been inhibited thoroughly. 
  • It is important to perform a postincident review to identify planning shortfalls as well as the success in execution of the incident response plan. 
  • Be sure to engage with Law Enforcement, and any other remediation support entity, soon after the threat assessment is made to allow for containment of the breach and to inform any future victims.
  • Documentation is paramount. Thorough documentation from the onset of the breach through the clean-up must be a priority to ensure continual improvement of the Incident Response Plan. 
  • It is critical to the success of a business to integrate cybersecurity into its strategic objectives and to ensure that cyber security roles are defined in its organizational structure.

References

Why is a 22GB database containing 56 million US folks’ personal details sitting on the open internet using a Chinese IP address?

Exclusive A database containing the personal details of 56.25m US residents – from names and home addresses to phone numbers and ages – has been found on the public internet, served from a computer with a Chinese IP address, bizarrely enough.

The information silo appears to belong to Florida-based CheckPeople.com, which is a typical people-finder website: for a fee, you can enter someone’s name, and it will look up their current and past addresses, phone numbers, email addresses, names of relatives, and even criminal records in some cases, all presumably gathered from public records.

However, all of this information is not only sitting in one place for spammers, miscreants, and other netizens to download in bulk, but it’s being served from an IP address associated with Alibaba’s web hosting wing in Hangzhou, east China, for reasons unknown. It’s a perfect illustration that not only is this sort of personal information in circulation, but it’s also in the hands of foreign adversaries.

Read more in

https://www.theregister.co.uk/2020/01/09/checkpeoplecom_data_exposed/

CyberSecurity: Data breach in Canada post

You might be a regular user of Canada post especially those who will in Canada or working in Canada. There are a lots of valuable information every customer keeps in the their profile e.g personal details, address, credit cards etc. Even pay checks copies are there.

Canada Post Corporation, trading as Canada Post, is a Crown corporation which functions as the primary postal operator in Canada.

wiki

Today morning, I received an email from Canada post regarding a cyber attack or data breach. As per Canada post email to the user, Canada Post is still investigating the matter however, it seems they are investigating a data breach in 2017.

An Interesting thing to look in the customer email, they are asking to change the password which we all have been using since 2017. If any compromise is done then it is too later to fix anything. Hackers would have already misused customer data long back. What’s the point of changing the password now?

It is pretty normal occurrences that most of the Organizations discover a cyber attack or data breach after a few months or years. When they call a cyber expert to investigate such cases, Cyber experts simply tell them that Yes there is a cyber attack but it happens 2 or 1 year back. So, relax! damage is already done.

My take on this issue:

Canada post response to the customers is standard response whenever a data breach happens and they never assessed the actual damage. No organization isn’t being transparent in such cases. They are lying about how big the data breach is? and how much damage is done to their customers? We have to wait & see.

Here is a sample email.

CyberSecurity: Hackers can steal your card info at a gas station using card skimmers

What is the Card Skimmer?

Credit card skimming is a type of credit card theft where crooks use a small device to steal credit card information in an otherwise legitimate credit or debit card transaction. When a credit or debit card is swiped through a skimmer, the device captures and stores all the details stored in the card’s magnetic stripe.

You might be wonder how each & everything is weaponized to steal your hard earned money.

Gas station pumps are a different story, however. Most can easily be opened using a universal key which isn’t hard to acquire, allowing the skimming hardware to be installed inside so it’s completely invisible to unsuspecting users

To retrieve the data that’s collected throughout a day, like card numbers and PINs, criminals just need to pull up nearby and download it all over a wireless Bluetooth connection. 

How does hacker use card skimmer?

Read more in https://www.thebalance.com/how-credit-card-skimming-works-960773

Is there any solution to this problem?

The team from the University of California San Diego, who worked with other computer scientists from the University of Illinois, developed an app called Bluetana which not only scans and detects Bluetooth signals, but can actually differentiate those coming from legitimate devices—like sensors, smartphones, or vehicle tracking hardware—from card skimmers that are using the wireless protocol as a way to harvest stolen data. 

So far Bluetana app has identified successfully 42 Gas stations in United States. As of now, details of smartphone app has not been public because of hackers will find a way to bypass app algorithm.