The Major Data Security Breaches That Have Happened In The Recent Time (Research Paper Sample)

Assignment ID 31164 Research Report Introduction In this technologically advanced world, we have come a long way in terms of providing the people with utmost satisfaction by identifying their needs and requirements along with their preference. Most of the business organizations utilize valuable information which has been collected about the customer from different sources to provide them better services. This information includes the name and contact information of a person along with their address, taste and preference, and much more. This information is strictly confidential and must not be shared with any other party for any purpose. However, there are still security breaches happen all around the world due to many reasons such as the negative intentions of a hacker or cyber attacker or negligibility of the business owner or their employees. In this report, we are going to discuss some of the major data security breaches that have happened in the recent time and find out what are the main reasons behind these security breaches and how it could have been avoided. Part A Exactis security breach: Exactis is an America based company which is a compiler and aggregator of consumer and business information having a Universal data warehouse that is considered the largest and most respected warehouse in the direct marketing and Retail Industry, which currently stores up to 3.5 billion consumers, digital records and businesses which are updated on monthly basis. The company was founded in 2015 and have corporate offices in New York, California and Florida and comprise of 10 employees. The company receives information through small packets of data sent from different websites when a user visits the website and cookies and store it as a user information. These information allow the websites to keep track of the movement of the user throughout the website. And with the help of the cookies, the company can get a better picture of the browsing habits and behaviour of the user (Cavusoglu et al, 2004). And since the cookies track everything a user does around the web, it can sync together and share information with each other related to the user. Cookies can also Link your mobile devices to the laptops and can get a deep information about you. The security breach was discovered by Vinny Troia in June 2018 who is the security researcher. He was testing the security of ElasticSearch which is a widely utilized database. With the help of a search tool called Shodan, she uncovered some 7000 databases on the publicly accessible servers (Ameen, 2012). Out of these 7000 databases, one was of exactis which were completely unprotected. Troia accessed and analysed the data in order to confirm its accuracy and alert both the company and the FBI. The database had around 2 terabytes of data which include the personal details of millions of American people and businesses (Cavusoglu et al, 2004). He came to find at least 340 million individual records which is a bigger security breach than the 2017 Equifax breach which shocked the entire world. The major issue with Exactis in this incidence are many which have led to this unfortunate security breach from their side. The company did not pay definite attention towards the sensitive information they have stored in their database. Especially companies who store valuable and private information of consumers and businesses should have done a regular vulnerability scan of internet facing infrastructure in order to determine any potential threats and export opportunities which Exactis did not perform (Cavusoglu et al, 2004). The company also did not implemented network level authentication in order to secure Remote Desktop protocol connection. Apart from that, they also should have utilised multi factor authentication to add second layer of Identity verification so that they can prevent illicit access to the server. The reason behind Vinny Troia was able to identify the security breach that is there they did not perform any of the functions required to ensure that the database is safe guarded from any kind of unauthorised access (Caughey, 2008). There have been many reasons behind the exact is security data breach and negligence from the company and its employees is the biggest of all. There are many ways the company could have protected the valuable information of 340 million individuals including companies which contained information such as email address, phone numbers, age and gender, physical address, smoking habits and religious affiliations. If the company would have protected their structured and unstructured data using efficient security protocols, then It wouldn't have happened. The company should have ensured effective endpoint, email protection and network, provided efficient training to the Employees, make better use of security management tools, develop and implement data protection policy and securing their remote access to the network could have easily diverted this large security breach (Caughey, 2008). It was certainly a miracle that the security breach was found by a security researcher and not a hacker who would have misused such information in order to perform fraudulent activities (Ameen, 2012). Exactis should have regularly verified their security measures and find out the efficiency of security of their databases which would certainly have eliminated the chances of this security breach. The exactis security breach should be considered as a great lesson for business organizations all over the world on how they should not protect their consumer information. Part B WannCry is a very dangerous cyber attack which is the type of ransomware which can affect the functionality of a computer and gain access to the information is stored in the computer and encrypt it, making the user does not access to these important files unless they pay a ransom money in the form of Bitcoin (Perlroth, 2017). WannCry ransomware cyber attack has infected NHS and number of organizations all over the world including government institutions in Russia, US and China. The NHS cyber attack is considered as the biggest ransomware WannCry cyber attack in the history which happened in May 2017 that affected over 300000 computers having Windows operating system in countries such as Russia, India, Ukraine and Taiwan. According to the chief research officer of F-secure which is a cybersecurity company based in Helsinki, Mikko Hypponen, it was the biggest ransomware outbreak in history. Another high-profile ransomware is Petya cyber attack that shook the entire business Industry all over the world in May 2017. It was considered as the sequel of WannCry which utilizes the same technique of propagation as WannCry. The petya cyber attack targeted all the windows based computers especially those who are not protected against the vulnerability in Microsoft messaging protocol called SMB 1 (Perlroth, 2017). It denied all the employees access to their desktop and displayed the ransom note. When the workers and managers try to access the files and folders, all of them were greeted with a message on the screen for a payment of $300 in Bitcoin, which is a digital currency utilized by the cyber criminals as it is easy to send and difficult to track. Petya cyber attacks has infected various organizations in countries like United States, italy, Australia, Germany, Russia, Ukraine and Poland. Some of the companies which were severely affected were Maersk, Rosneft, WPP, and Merck. According to various reports, petya cyber attacks also affected hospitals, government institutions, banks, airports in other important organizations. The functioning of both WannCry and petya cyber attack or similar. These Malware are often delivered through emails which trick the recipient to opening the attachment which releases the virus into the system. This technique is known as phishing. The moment the computer become affected with the virus, it locks and encrypts all the files in such a manner that the authorized person cannot access it anymore (Mohurle, 2017). And then, payment is demanded in the form of Bitcoin. According to many security experts, there is no guarantee that the employee will be granted access to the files after the payment. Britain's NHS was the worst hit organization from the WannCry ransomware attack. The staff was forced to use pen and paper and their mobile devices after the attack affected the main system including the telephones. The doctors could not perform surgeries in England and have to turn away the patients and cancel their appointments due to the ransomware which demanded payment upto $300 to $600 in order to restore access (Perlroth, 2017). What can be done in order to protect such cyber attacks? Before May 2017 when these ransomwar...