So Sony case
study hack is kind of an interesting
example of things that
kind of happened to a well-known
corporation and encompasses kind
of several of things we talked about
before.
So if you're not familiar with the
the the hack on the twenty
fourth of November, a crushing
cybersecurity attack was launched
on Sony Pictures and employees
logging onto the networks were met
with sounds of gunfire, scrolling
threats and menacing image of a fire
skeleton looming over the
little tiny, zombified heads of the
studio's top two executives.
So if you can imagine, that's
probably pretty terrifying and
caused some consternation among the
Sony employees.
But before the Sony cyber staff
could actually pull the plug,
the hackers malware had leaked from
machine to machine, essentially
wiping out half of Sony's global
network. So it wasn't just isolated
to the United States, it was
essentially Sony worldwide,
Sony, Japan, Sony, California,
and it erased everything stored
on three thousand two hundred and
sixty two companies, six thousand
seven hundred ninety seven personal
computers and eight hundred
and thirty seven of its one thousand
five hundred and fifty five or so.
It did a significant amount of
damage to Sony.
So to make sure nothing
could be recovered, the attackers
actually added the special deleting
a logarithm to overwrote the
data seven different ways.
So that that's pretty significant.
And then when that was done, the
code zapped each computer startup
software and rendered the machines
brain dead.
And then before destroying the
company's data, the hackers
had stolen it, so over
the next three weeks, they'd dump
nine batches of confidential files
into the public file sharing sites,
everything from unfinished movie
scripts and mortifying emails
to salary list more than four
thousand seven hundred Social
Security numbers.
So that's a significant amount of
data. So you have
personally identifiable information
that's out there. You've got
proprietary information that's
out there.
You've got emails that are out
there now that could actually cast
people in a negative light.
They may have to resign from their
jobs or it may make them harder to
get a job in the future.
So four of the five are five
Sony Films.
Four of them were unreleased and
they were leaked to the public
on these piracy websites for free
doing so. Obviously, that's going to
cost Sony some revenue as well.
So to kind of continue
this this case study on the
19th of December, the FBI
blamed the hack on North Korea,
which had issued threats over
one of the films that were released.
So it was that Seth
Macfarlane film regarding
Kim Jong un.
So they were pretty
unhappy with that and tried to get
Sony to stop that film.
And then when they wouldn't do it,
they essentially hacked into Sony's
networks.
So the FBI
stated that the malware used was
undetectable by an industry standard
antivirus software.
And then experts say Sony
Electronic Security probably wasn't
worse than that of many of its
others, but it's clear
that Sony, which failed to employ
basic safeguards, didn't
put up much of a fight.
So that's that's a pretty
significant event.
And if we go back to to one
of our first slides, we talked about
that security that the first 10
are the first 90 percent.
But it's either it's got to be that
first part.
Sony apparently did not have
that mantra in mind.
And kind of one of the interesting
things I found from Fortune magazine
talked about their actual security
posture. So you can actually go to
this link and look at it and
read the whole story.
But this is a little snippet and
it talks about one of the consumer
security consultants that actually
had gone to Sony
and Fortune
had interviewed him and he related
that after a quick security check at
the front gate and then proceeding
to the George Burns building on the
east side of the Sony lot,
the Norse group walked straight
into the unlock first floor offices
of the Information Security
Department marked with a small
sign reading infosec.
There was no receptionist or guard
to check who they were.
In fact, there was no one inside
at all.
The room contained cubicles with
unattended computers providing
access to Sony International
Data Network.
So apparently Sony didn't
really have a good security
posture in place,
even within their own
network facilities.
Goes on to say that the visitors
found their way to a small sitting
area outside of the office
of Jason Sepultura
of Sony, senior vice president for
Information Security Seldin
and waited alone for 15 minutes.
So again, if someone
had malicious intent, they had
quite some time to access Sony's
networks from within
the corporation.
And then it goes on
to say, I got a little shocked, says
Tommy Stanson,
nauseas co-founder and chief
technology officer.
There. InfoSec was empty and all of
their screens were logged on.
Basically, the janitor can walk
straight into their infosec
apartment as Mickey Shapiro,
a veteran entertainment attorney who
helped set up the meeting and was
present that day.
If we were bad guys, we could have
done something horrible.
So, again, cybersecurity,
is this going to be paramount to,
one, preventing these incidents from
occurring and you have to do
something and put
procedures and policies in place and
you have to follow them in order to
prevent incidents from occurring?
And obviously that did not happen.
And we can see the consequences
of what happened.
And then you're going to have to
remediate that problem, which Tony
is still actually trying to deal
with fallout from this hack.
So an ounce of prevention
is obviously worth a pound of cure,
so most incidents can be or
could have been prevented.
Human error is the likely cause of
security failures.
And a new study finds that only
one in 10 consumers have had any
classes of training or about
protecting their computer and other
personal information in the last 12
months. So, again, that talks about
kind of the end user and how
much they really know
about cybersecurity and protecting
their data.
And even cybersecurity experts
have lapses in judgment or
practices. And oftentimes we may
think that we know better.
So we may not follow the
simple security procedures that
we put in place.
So we may actually be one of the
worst offenders as well.
Companies may not want to invest
the necessary time or money to
provide adequate assets until
something happens.
And then they have to go back
or mediate that and then spend the
extra money to
to provide that adequate defense.
And worse, they may not know what to
defend. So that's why cybersecurity
is kind of a growing field
right now. And you have a lot of
people who have information systems,
but they don't quite know what to do
with them. So essentially
that son Sumantra
know the enemy and know yourself.
You have to know exactly what it is
that you have and you have to know
that kind of what it is that your
enemy is going to do in order to
kind of prevent the cybersecurity
incidents from occurring, preventing
them and mitigating them.
So the need for cybersecurity
incident response, we know
these cybersecurity incidents
are going to happen in
end, users are going to be weakest
link, but there's always someone out
there who's trying to one up you,
trying to get patched through
network security.
So we now understand why
it's important to have that cyber
security is exemplified.
That Sony hack, they had several
pieces of information, proprietary,
personally identifiable information,
emails that they didn't want to get
out, essentially
that caused significant damage to
their business.
So now we know that we need to
do something when we have an
incident. But what is that something
what do we do when we have a
cybersecurity incident and how
do we do it?
So that's what's going to be
discussed and future videos.
So thank you.
And I hope to see you again.