Reference no: EM133669723

IT Security

Introduction
In this individual assessment, you will write a critique on a contemporary research paper(s) or security incident approved by the lecturer in the field of IT security.

Once the title has been selected, you may start working on writing your critique.

When writing the critique, you must read the paper and identify its key components. Additionally, you should pinpoint the scientific contribution, methodology, and main outcomes of the paper. Then, provide your general opinion about the selected paper. Your critique should include the following components:

Introduction
Summary of the Article
Evaluation of Methodology
Analysis of Results
Discussion of Scientific Contribution
Critical Reflection

Conclusion
Ensure that your critique is well-organized and supported with necessary references. The Report should not exceed 1000 words.

Introduction
The case study has been selected from the news article titled "Equifax data breach FAQ: What happened, who was affected, what was the impact?" by Josh Fruhlinger.

The Equifax data breach of 2017 was one of the most significant cybersecurity incidents in recent history, impacting millions of consumers and highlighting critical vulnerabilities in data protection practices. Personally, identifying data of hundreds of millions of people was stolen from Equifax, one of the credit reporting agencies that assess the financial health of nearly everyone in the United States.

According to the above new article a top-level picture of how the Equifax data breach happened looks like this:

"The company was initially hacked via a consumer complaint web portal, with the attackers using a widely known vulnerability that should have been patched but, due to failures in Equifax's internal processes, wasn't.
The attackers were able to move from the web portal to other servers because the systems weren't adequately segmented from one another, and they were able to find usernames and passwords stored in plain text that then allowed them to access still further systems.
The attackers pulled data out of the network in encrypted form undetected for months because Equifax had crucially failed to renew an encryption certificate on one of their internal security tools.

Equifax did not publicize the breach until more than a month after they discovered it had happened; stock sales by top executives around this time gave rise to accusations of insider trading."

Further to the above, the article elaborates on the below:

"The crisis began in March of 2017. In that month, a vulnerability, dubbed CVE-2017-5638, was discovered in Apache Struts, an open- source development framework for creating enterprise Java applications that Equifax, along with thousands of other websites, uses. If attackers sent HTTP requests with malicious code tucked into the content-type header, Struts could be tricked into executing that code and potentially opening up the system Struts was running on to further intrusion. On March 7, the Apache Software Foundation released a patch for the vulnerabilities; on March 9, Equifax administrators were told to apply the patch to any affected systems, but the employee who should have done so didn't. Equifax's IT department ran a series of scans that were supposed to identify unpatched systems on March 15; there were in fact multiple vulnerable systems, including the aforementioned web portal, but the scans seemed to have not worked, and none of the vulnerable systems were flagged or patched.

Forensics analyzed after the fact revealed that the initial Equifax data breach date was March 10, 2017: that was when the web portal was first breached via the Struts vulnerability. However, the attackers don't seem to have done much of anything immediately. It wasn't until May 13, 2017 - in what Equifax referred to in the GAO report as a "separate incident" - that attackers began moving from the
compromised server into other parts of the network and exfiltrating data in earnest. (We'll revisit this time gap later, as it's important to the question of who the attackers were.)

From May through July of 2017, the attackers were able to gain access to multiple Equifax databases containing information on hundreds of millions of people; as noted, a number of poor data governance practices made their romp through Equifax's systems possible. But how were they able to remove all that data without being noticed? We've now arrived at another egregious Equifax screwup. Like many
cyberthieves, Equifax's attackers encrypted the data they were moving in order to make it harder for admins to spot; like many large enterprises, Equifax had tools that decrypted, analyzed, and then re-encrypted internal network traffic, specifically to sniff out data exfiltration events like this. But in order to re-encrypt that traffic, these tools need a public-key certificate, which is purchased from third parties and must be annually renewed. Equifax had failed to renew one of their certificates nearly 10 months previously - which meant that encrypted traffic wasn't being inspected."

After analysing the above case study, your group must detail the below points that could have been fixed in the Equifax data breach. Your report should be more than 2000 words, and your presentation should not be more than 3 minutes. The report should address the following:

Appropriate security technologies to fix the above-mentioned vulnerabilities.
Appropriate cryptographic techniques to fix the above-mentioned vulnerabilities.
Tools that you can use to identify and fix the vulnerabilities.
The techniques you suggest ensuring CIA (Confidentiality, Integrity, and Availability) before and after the Equifax data breach.

Presentation
The oral presentation must be recorded using PowerPoint and submit the link through Moodle. The presentation should not exceed 3 minutes, and each member should submit their presentation. They can explain the parts they worked on in the report. In case of absence or late submissions, individuals will be affected individually.
The presentation time for individual should not exceed 3 minutes in recording and must be recorded as a group meeting.
All students should log into one Zoom or Microsoft Teams meeting and share the slides to present.
All students should keep their video turned on during the entire presentation. Failure to do so will result in the student being marked as absent.

Students should use the provided presentation template to create their presentation. The template should be downloaded and edited according to the project

Assessment Item

Introduction
Case Study Introduction: EITest Scam Impact on Ginko Bank

The following case study is created based on several Internet sources referring to the links below. The Bank name "Ginko Bank" is a hypothetical name created for the purpose of explaining the assignment.

Ginko Bank, a multinational banking and financial services company headquartered in Melbourne, Victoria, Australia, serves as a prominent institution in the global finance sector. Ginko Bank stands as Australia's second-largest bank by assets and the 3rd largest by market capitalization.

Established in 1990, Ginko Bank's current corporate entity emerged from the merger with several local banks in different countries, marking a milestone in Australian banking history. This merger propelled Ginko Bank's evolution into a leading financial institution.

With operations spanning across multiple countries, Ginko Bank caters to a diverse customer base, offering a wide range of banking and financial solutions. Ginko Bank oversees a global network of branches and subsidiaries, extending its services to customers in 34 countries worldwide. With a dedicated workforce of around 40,000 employees, Ginko Bank remains committed to delivering exceptional banking experiences and solutions to over nine million customers across the globe.

Similarly, serving nine million customers across multiple countries, Ginko Bank caters to a diverse customer base have users, including non-tech-savvy individuals, who may be vulnerable to fraud and manipulation by cybercriminals.

Recently, Ginko Bank's customers have complained of unusual network delays in the banking system, as well as being redirected to different websites irrelevant to them. Moreover, Ginko Bank's customers report receiving unusual popup messages on their mobile application. Therefore, Ginko Bank recently hired your team as the expert cybersecurity team to assess this situation. Your team discovered evidence suggesting Ginko Bank's potential exposure to the EITest scam, a sophisticated cybercriminal operation notorious for its deceptive tactics in distributing malware and conducting phishing attacks.

The EITest Scam is a type of malicious campaign that utilizes hacked websites to perform malicious redirections. This campaign exploited vulnerable websites and redirected users to exploit kit landing pages, which launched Internet Explorer and Flash exploits, resulting in the download of malicious binaries onto the user's system.

Concerned about the potential risks posed by this threat, Ginko Bank has tasked your team with conducting a comprehensive security report to assess the vulnerabilities and potential Business Impact Analysis due to the EITest scam and to maintain their Business Continuity. Your team has been tasked to study this case and compile a comprehensive security report comprising Business Impact Analysis, and Business Continuity Plan and evaluate the potential cyber threats and risks posed by the EITest scam to Ginko Bank. The report should analyze the impact of the scam on Ginko Bank's systems, networks, and data security, as well as provide recommendations for mitigating the identified risks and enhancing the organization's cybersecurity defences to maintain the business continuity. Your recommendations should be presented in both a written report and an oral presentation.

Your report should include the below sections.

Executive Summary: Overview of EITest scam and its potential impact on Ginko Bank.
Introduction: Provide background information on Ginko Bank and its global presence, highlighting the diversity of its customer base and the potential vulnerability of non-tech-savvy users to cyber threats.
Threat Analysis: Identify and analyze the potential cyber threats posed by the EITest scam, including compromised websites, malicious redirection, and exploit kits. You have to perform a detailed analysis of the EITest Scam and then report in this section.
Vulnerability Assessment: Assess the vulnerabilities in Ginko Bank's systems, networks, and processes that could be exploited by the EITest scam.
Risk and business impact Analysis: Conduct a risk assessment to determine the likelihood and potential impact of EITest to Ginko Bank and make a BIA identifying its main functions and stakeholders.
Business Continuity plan: Provide an actionable business continuity plan to Ginko Bank's defences against the EITest scam. This may include implementing security controls, enhancing employee training programs, improving incident response capabilities, and fostering a culture of cybersecurity awareness across all branches.
Conclusion: Summarize the key findings and recommendations from the security report. Emphasize the importance of proactive measures to mitigate the risks posed by the EITest scam and safeguard Ginko Bank's systems, data, and reputation from cyber threats.
Oral Presentation: Explain your contribution of the above analysis and your conclusion about the EITest scam.