sec440_week_3_you_decide_transcript.docx
SEC440 Week 3 You Decide Transcript
Scenario Summary
The infectious company, Grocery Stores, Inc. has just been breached by what
was first thought to be a remote attacker who infected the supermarket chain
with a server based malware program. However, after a security assessment was
performed, it was confirmed that it was an inside job. Apparently, a new and
sophisticated plan was developed by a disgruntled employee. The attacker
slipped malware onto servers at all of the company's 200 grocery stores. The
malware appears to have snatched card data from customers as they swiped
their credit cards through the checkout counter machine and transferred the
card data overseas.
Your Role/Assignment
You've been hired as an information security administrator for Grocery Stores,
Inc. Your duty is to assess the situation and determine the best course of action
to take to ensure that the security breach is contained and eradicated. You will
need to interview key staff members and decide how which member(s) can
best assist you in eliminating this risk. Key Players
Character #1: Douglas Smith - Vice President Information Technologies
The fact that the malware was not the ordinary kind of key logger program that
might capture keyboard presses as a customer logs into their online bank
account, but was instead software programmed to lift credit card data as it was
being transmitted to the servers at Gregory Stores, Inc, suggests that the
malware program had to be written specifically to target our stores and
deployed from inside the company network. It seems almost too much of a
coincidence to believe that remote hackers would have a chance to infect
every server with the appropriate malware by using traditional security flaws
such as a misconfigured firewall, or even an out-of-date antivirus application.
We have over 20 network administrators throughout multiple branch offices and
satellite locations. Security was set up so that each network administrator had
the same security access and privileges to each location. In hindsight, I believe
that while having redundant or equal security privileges for all network
1 administrators can be a good thing; it can also be a major security hole. That is
because the administrators have access to the entire system and not just their
local area network. Character #2: Josh Brandenbosh - Network Administrator
The possibility that the security breach of Grocery Stores, Inc. was performed by
an employee is very disturbing. We must review our current employee hiring
policies and procedures to insure that we are performing the appropriate
background checks and monitoring our employees to make sure that valuable
customer data is both secured and protected from external threats and internal
employees. We can't have our I.T. professional circumventing the system
because they have elevated privileges that give them unfettered access to
valuable company data. We must review the current job descriptions and duties
of all personnel who have access to customer data and only give access where
appropriate. Also, during the termination and/or transfer process, we need to be
sure that we have done the steps necessary to disable security access so that
we do not have any rogue accounts.
Character #3: Sarah Campbell – CEO
The recent security breach at Grocery Stores, Inc. indicates to us that our
security policies and procedures need serious scrutiny and oversight. However,
even if we were found compliant with all security controls and financial
protection measures, the fact remains that we were hacked. A major concern
at many corporations is the potential for a man-in-the-middle attack, where an
attacker can install a sniffer program and pull out the data as it flows through.
You can reduce the risk of this type of attack by encrypting the data at the time
it transverses the network. I also want to review the training policies and
procedures of our personnel to make sure that everyone understands the rules,
is complying, and that there are punitive measures in place to reduce the risk of
incidents like these from happening again.
Character #4: Theresa Brown - Human Resources Director
The security breach at Grocery Stores, Inc. has caused major damage to the
reputation and trust that our customers and stakeholders have in this
organization. This cannot be tolerated; security of our valuable data is
paramount. As CEO of this company, I am responsible for insuring security of our
2 critical data and compliance. Security must be an important concept to every
employee from top to bottom. We must demonstrate adequate internal controls
of business records and information security. We need a layered security
program so that if one defense is unsuccessful, the attacker must poke through
other defenses. Even with a layered security program, there's no guarantee that
the company can prevent every attack from succeeding. Good security
requires constant care and it doesn't take much for a vulnerable opening to
develop. We will do everything possible now and review for potential updates
monthly in the future. Assignment
Given the scenario, your role and the information provided by the key players
involved, it is time for you to make a decision.
If you are finished reviewing this scenario, close this window and return to this
Week's You Decide tab, in your course, to complete the activity for this scenario.
You can return and review this scenario again at any time. 3
Arun1990
0
