Woesnotgone Meadow; December 18, 2018

All is relatively well here at Woesnotgone Meadow, where everyone has above average bandwidth.

In the Meadow, our travel is somewhat limited. A number of the residents are retired and just enjoy our simple, natural environment. We may take a walk to Margie’s Ice Cream Parlor and talk about the leaves changing color, or take the short drive to Jerry’s Barbershop for the quick haircut, and catch up on the local gossip.

Other times, we just like to watch television. In this part of the state we don’t have the best reception. Most people subscribe to a paid service for their viewing pleasure. In Brazil, people can subscribe to SKY Brasil. Although a valued service for their television, there has been a relatively serious cybersecurity oversight found.

SKY Brasil is a subscription television service in Brazil. This service is one of the largest in the country. With the issue at hand, Elasticsearch servers were the focal point for the problem. These are used, as the name implies, for powering search functions. For better or worse, this data leak is not the first with this technology.

The term attack is used very loosely with this circumstance. In the traditional sense, this was not truly an attack. There were a number of records open to anyone with internet access for over a week. With the open access for this period, the access and unauthorized exfiltration is expected and likely. This is notable, as anyone who knew where the cache of data was or could search for it, was able to have full access at their whim. The “attackers” only needed use a tool, e.g. Shodan, and search for servers running Elasticsearch.

For access to their system, there was no authentication required. The servers were not configured to require this, which is surprising on many fronts. The researchers happened to find these by searching for servers titled “digital-logs-prd”. Specifically, with these, there was no authentication required. The attacker merely needed to enter a simple command and the indices were available. One of these held 429.1GB of data.

The affected data included up to 32M of SKY Brasil’s client base. This happened to contain, to the benefit of the attackers, the PII for the clients. This included the full name, email address, service login password, client IP address, payment method, phone number, and street address. All of this would be exceptionally useful for the attackers, especially in the short-term, for phishing and other attacks. This included both consumer and business clients.

As if this was not bad enough, this is not the first issue with Elasticsearch. There was also Brazil’s Federation of Industries of the State of Sao Paulo (FIESP) exposing the data of 34.8M users, Fit Metrix exposing 35M records, and a data analytics firm leaked over 57M US clients and 26M companies data.

This unfortunate data compromise brings together the need for cyber- and Info-Sec to be actively applied, not just when there is an issue.

Thanks for visiting Woesnotgone Meadow, where the encryption is strong, and the O/Ss are always using the latest version.

Resources

Cimpanu, c. (2018, November 29). Sky brasil exposes data of 32 million subscribers. Retrieved from https://www.zdnet.com/article/sky-brasil-exposes-data-of-32-million-subscribers/

Dissent. (2018, November 29). Sky brasil exposes data of 32 million subscribers. Retrieved from https://www.databreaches.net/sky-brasil-exposes-data-of-32-million-subscribers/

Ilascu, I. (2018, November 29). SKY brasil exposes 32 million customer records. Retrieved from https://www.bleepingcomputer.com/news/security/sky-brasil-exposes-32-million-customer-records/  

Threat Brief. (2018, November 30). SKY brasil exposes 32 million customer records. Retrieved https://threatbrief.com/sky-brasil-exposes-32-million-customer-records/

Insecure code will cause problems

For consumers, ease of use in the user experience (EX) is paramount. This aspect of daily life draws consumers to the service. One aspect involves entertainment and recreation. To attend certain events, a ticket for entrance is required. One service to purchase this from is Ticketmaster, which is an online option. Ticketmaster, as with many of the other organizations within this field, is multinational. Within the UK arm of Ticketmaster, there was a recently detected issue.

Affected Parties
As this organization is so large, a mass number of clients were affected. There were an estimated 40K clients who purchased tickets within the exposure period ending June 23, 2018. The exposure was through Ticketmaster and other websites owned by Ticketmaster, which were Ticketweb and Get Me In!. The affected may, unfortunately, become victims of identity theft, and fraudulent use of their credit cards.

Compromise
This was not a quick operation with the attackers breaching the organization for notoriety. The breach and subsequent compromise occurred over several months. This period is estimated from September 2017 to June 23, 2018. The organization was notified of the breach in April 2018. The issue was disclosed on June 23, 2018.
From this issue, the client’s personal data was exfiltrated. This included the client’s name, addresses, phone numbers, payment data, logins for Ticketmaster, and password. The attackers are still unknown.
The organization should have known there was an issue from the various indicators. The InfoSec team should have noticed something was not correct when the logs were reviewed. What actually brought this to the attention of Ticketmaster was an increase in fraud complaints.
The cause of this issue was from a simple copy/paste. Ticketmaster recycled code from one of their contractors, Ibenta. The code was originally used in a chat function. This was not coded in a secure manner, but with functionality in mind. With this code, the attackers were able to monitor the data inflow from the client’s orders. The Javascript used for the payment page thus was not coded for this function. Although the intention was economical, security was not focussed on in the SDLC.
Handling
The issue was not handled exceptionally well. Generally, the entity should embrace the best practice of urgency, transparency, and empathy. Ticketmaster was notified of the breach and elected not to act on it for a month. Ticketmaster did eventually warn the affected customers. The primary recommendation was for the clients to reset their passwords. The company should have recognized if a mistake is made, own it, and accept the responsibility. This responsibility should not have been shifted to third parties. In this case, Ticketmaster attempted too push the blame onto the contractor, since this was originally their code.

Lessons Learned
Any entity should be open and honest when there is a breach. This may work to minimize the potential exposure and effects. The code was for the application and should be secure. When this does not cc


Resources
CISOMAG. (2018, June 28). Ticketmaster hacked, payment information of several customers may have been compromised. Retrieved from https://www.cisomag.com/ticketmaster-hacked-payment-information-of-several-customers-may-have-been-compromised/

Freedman, L.F. (2018, July 5). Ticketmaster hit with malware compromising UK customer’s data. Retrieved from https://www.dataprivacyandsecurityinsider.com/2018/07/ticketmaster-hit-with-malware-compromising-uk-customers-data/

Levin, A. (2018, June 28). Why the ticketmaster UK breach could happen to your organization. Retrieved from https://adamlevin.com/2018/06/28/ticketmaster-uk-breach/

Ticketmaster. (2018). Information about data security incident by third party supplier. Retrieved from https://security.ticketmaster.co.uk/

Townsend, K. (2018, June 28). Ticketmaster blames third party over data breach. Retrieved from https://www.securityweek.com/ticketmaster-blames-third-party-over-data-breach

Whittaker, Z. (2018, June 28). Inbenta, blamed for ticketmaster breach, admits it was hacked. Retrieved from https://www.zdnet.com/article/inbenta-blamed-for-ticketmaster-breach-says-other-sites-not-affected/

Zhou, M. (2018, June 28). Ticketmaster says credit card data may have been stolen in UK breach. Retrieved from https://www.cnet.com/news/ticketmaster-hit-by-data-breach-in-the-uk/

AI to Supplement InfoSec

            There are currently a minor number of topics creating the press in the computer industry than machine learning (ML) & artificial intelligence (AI). AI has been in process for well over a decade, yet recently has been much more publicized in the press. Most persons may be familiar with ML and AI from the movies (Tron, Her, iRobot, Blade Runner, 2001: A Space Odyssey, and many others) or commercial ventures with security incident and event management (SIEM) applications (Dawson, 2017). These applications have also been implemented with recreational users with the Go game, IBM Watson, and other applications.

InfoSec

            InfoSec has many functions, too numerous to detail. These include, but are not limited to, log analysis, spam filter applications, network IDS/IPS, fraud detection, botnet detection, user authentication and validation, and in general monitoring activities (Rossi, 2016). With the vast number of responsibilities, time is of the essence. This is only further exasperated by the mass number of attacks that are present and that will continue to grow.

            These attacks have been increasing over time as a function of the increasing attack surface of increasing data and system complexity coupled with the potential revenue to be generated. The amount of data generated from daily operations increases making it difficult to analyze all of the data (Siwicki 2017). This grows, in comparison, from a small to medium, or medium to large sized business. The increased amount of available threats (Stevens, 2018) have subsequently increased the network breaches in the mid-decade (Li, 2015) and recently. Although this is abstract, the reality of the situation incorporates the actual cost to the organization. In 2013, the estimated global cost of cybercrime was $113B (Sanders, 2015). As the number of attacks has grown along with the mass volume of data being targeted daily, the cost has increased rather significantly.

            These attacks also have increased in depth. These have moved from the shallow, low hanging fruit to the more in-depth, complex attacks. With the number of new InfoSec tools engineered specifically to compromise systems and these being designed with a GUI for complete ease of use.

            The attacks have also increased in criticality. The targets are involved with more criticality. The targets are involved with more critical operations for the organization. The attacks are becoming more concerned with these high-value targets, providing greater attention when compromised.

Current Workforce

            In InfoSec, as a general indicator, there have been and continue to be a significant shortage of qualified staff. In cybersecurity, this is much worse. There presently is and will continue to be a severe shortage of cybersecurity professionals throughout the country (Li, 2015). The issue isn’t merely with the number of staff members not being sufficient, but also with experience. The expertise of the staff members also is lacking (Cowley, & Greitzer, 2016).

            One area this is specifically problematic is within the automotive cybersecurity field. With the new modules and operations, along with the new push for autonomous drive (AD) vehicles, there is a much larger need for cybersecurity professionals. This demand for the automotive cybersecurity professionals will continue to outpace the supply (Uchill, 2017).

Staffing Limitations

                        The InfoSec staffing shortage is well-known and published in various mediums, and a challenge (ISACA, 2018). This shortage is not localized, but a global issue (Ollmann, 2016). Within this industry, 59% of cyber- and InfoSec positions are not filled (Zorz, 2018). The same study also noted 54% of respondents say filling an open position generally requires at least three months. This time frame experience is not acceptable.

            To further this, 59% of the enterprises responded the organization experienced open security positions (Teitler, 2018). This is as of a limited time span. Over time, this has also been the case. ESG recently conducted their annual global survey focussing on the state of IT. From this survey, the number of organizations claiming a shortage of cybersecurity skills has increased since at least 2014 (Oltsik, 2018). This study indicated the obvious of filling these cybersecurity positions was more difficult in 2018 versus 2017 (Rio, 2018).

Expected Labor Force Shortage

            As noted, the past and present shortage of qualified, experienced cybersecurity staff has been growing noticeably (Morgan, 2017). This is the reality for the industry. Looking forward, the shortage of staff is expected to be approximately 1.8M by 2020-2022 (Condon, 2018; Stolte, 2018; MacDonald, 2018; Gil, 2018; Kawamoto, 2017).

AI to the Rescue

            The past, present, and future labor shortage is well-known. One discipline which may be of assistance is AI (Rio, 2018). While this is not a panacea and won’t be able to solve all the presented issues (Oliver, 2018), there is a clear benefit to the implementation (Scroxton, 2018). In general, AI will be able to increase human productivity (Reese, 2018). As the beneficial processes are experienced by the organization, the cybersecurity teams will achieve a greater level of understanding (Ismail, 2017). This greater depth of understanding will provide for a faster, better, and less costly cybersecurity program.

            This understanding will provide for the upgraded modules to better identify threats, assess the risk, and apply the remediation protocol. Identifying threats has proven to be difficult due to the attack surface and data continuing to grow. There is a limited amount of resources being applied to the network, endpoint protection, applications, cloud services, mobile devices, and other points and processes. Assessing the risk involves correlating the external threat data with the business criticality. This activity along is well-suited for ML and AI applications, along with the added functionality AI provides for. This may be used to assess the security gaps and possible points of breach or compromise.

Trust

            For the full implementation of AI into InfoSec, there has to be trust with the system. The humans require a full understanding and appreciation of the system, knowing the risk of an oversight or negligent decision is as close to a null as possible, with the awareness that there will be a rather insignificant level of potential error in the application. No human deiced without an error on some level over decades of work. This confidence in the system is vital (Stilgherrian, 2018).

            For the trust to be in place, there need to be two pertinent factors in place. These are operational and data security (Hengstler, Enkel, & Duelii, 2016). The operational safety facet involves the technology itself being reviewed and approved per the appropriate level of governance. The data itself also has to be secure, and not modified. With these fully engaged, the issue of a lack of trust would be marginalized.

Replacing Humans

Another issue noted was the AI system would replace most of the humans, leading to mass unemployment. Users may have the visions from Hollywood of the machine taking over step by step. This will not be the case. The AI systems will work to supplement the workflows, not replace humans, freeing time which may be applied elsewhere on other projects (Rio, 2018).

There are many types of duties and work which AI is not able to do so (Skilton, 2017). Humans have the ability to generalize, reason through issues, and intuition, which would not be able to be fully replaced by code or a machine (Towers-Clark, 2018). From this, clearly, the cybersecurity role is and won’t be targeted (Korolov, 2016).

Regarding job functions, there will be fewer jobs at risk of being affected by automation than previously thought (Vincent, 2018). There will not be the need for humans lessening as the new paradigm shift occurs. This potentially will affect, to the detriment of, low skilled jobs. As an example, there have been in use for over a year AD bus lines on the campus of the University of Michigan-Ann Arbor. These naturally have a limited scope of use, however, have been in place, are actively used, and are trusted by the students and University.

This will be used more to review threats originating from outside of the entity (Needle, 2017), for data protection (Help Net Security, 2018), to detect anomalies in traffic, and to create a more difficult environment for attackers to compromise (Osborne, 2018).

There is a level of faulty reasoning as the AI system will not be usurping the human’s authority and autonomy. The industry and civilization will still need human developers (Merritt, 2018). There is no question as to this use case. Humans will be needed for advancing to tools we have in place presently. Each business is unique in its parameters and application requirements (Allen, Filar, & Seymour, 2017). The humans will be needed to fulfil the varied requests and requirements in a creative manner. While creativity is one of the functions of AI in the long-term, the humans will still need to be directly involved in these endeavours.

The humans will be required to manage the contingencies involved with business operations, incident response, and many other areas. While computing this is a controlled process, the human aspect will be needed as creativity is a required function. The decision process is multi-faceted and still will require a human’s interpretation of events, and rank in the decision matrix.

ML and AI will assist with InfoSec as an effective assistant (Siwicki, 2017). The users are too numerous to enumerate, however, the generalized uses are notable. These include, however, are not limited to:

a.            Analyzing the mass amount of data generated daily from operations, AD vehicles, and the myriad of other sources (Graham, 2018),

b.            Improving accuracy, which would subsequently increase the human's confidence (Ashford, 2017),

c.            Automating initial and secondary false positive review (Morgan, 2017), effectually freeing up a large block of time for the InfoSec team,

d.            Improving predictive analytics to possibly identify pre-compromised targets, reviewing the requirements for the InfoSec team to remediate issues,

e.            Force multiplying; as this will supplement the InfoSec team’s efficiency, allowing each member of the team to achieve more in different areas, and

f.             Training, personalized for each staff member to assist them with their position, goals, and careers.

Supplement and Augment

            AI will be a benefit to commercial organizations, consumers, and others involved. In the subject context, the benefits are numerous and too expansive to list for the InfoSec field. This, as the implementation evolves and increases in usage, will become more evident and show not only its promise, however also its potential to make the InfoSec worker more efficient, and multiply their efforts.

This shift in the application will not be quick. This is a needed, as with this level of a technology shift, the steps need to be sure, planned, and executed within a governance model.  

References

Allen, C., Filar, B., & Seymour, R. (2017, October 19). Harnessing the power of conversational interfaces in security. Retrieved from https://www.oreilly.com/ideas/harnessing-the-power-of-conversational-interfaces-in-security

Ashford, W. (2017, October 18). McAfee forges ahead with analytics, deep learning and AI. Retrieved from http://www.computerweekly.com/news/450428465/McAfee-forges-ahead-with-analytics-deep-learning-and-AI

Condon, J. (2018, May 8). Survey suggests younger generations, including females, may fill the cybersecurity talent gap. Retrieved from https://www.protectwise.com/post/survey-suggests-younger-generations-including-females-may-fill-the-cybersecurity-talent-gap/

Cowley, J.A., & Greitzer, F.L. (2015). Organizational impacts to cybersecurity expertise development and maintenance. Proceedings of the Human Factors and Ergonomics Society Annual Meeting, 59(1), 1187-1191. doi:10.1177/1541931215591185

Dawson, J. (2017, October 1). Training machine learning for cyberthreats. Retrieved from https://www.afcea.org/content/training-machine-learning-cyberthreats

Gil, L. (2018, March 22). The debate is over: Artificial intelligence is the future for cybersecurity. Retrieved from https://www.scmagazine.com/the-debate-is-ver-artificail-intelligence-is-the-future-for-cybersecurity/article/749603/

Graham, K. (2018, April 13). Managing cybersecurity in the age of artificial intelligence. Retrieved from http://www.digitaljournal.com/tech-and-science/technology/managing-cybersecurity-in-the-age-of-artificial-intelligence/article/519790

Help Net Security. (2018, April 4). Would automation lead to improved cybersecurity? Retrieved from https://www.helpnetsecurity.com/2018/04/04/automation-cybersecurity/

Hengstler, M., Enkel, E., & Duelli, S. (2016). Applied artificial intelligence and trust-The case of autonomous vehicles and medical assistance devices. Technological Forecasting & Social Change, 105(2016), 105-120. doi:http://dx.doi.org/10.1016/j.techforce.2015.12.014

ISACA. (2018). State of cybersecurity 2018: Part I: Workforce development. Retrieved from http://ww.isaca.org/Knowledge-Center/Research/Documents/cyber/state-of-cybersecurity-2018-part_1_res_eng_0418.pad?regnum=441968

Ismail, N. (2017, April 19). The role of AI in cyber security. Retrieved from http://www.information-age.com/role-ai-cyber-security-123465795/

Kawamoto, D. (2017, June 7). Cybersecurity faces 1.8 million workers shortfall by 2022. Retrieved form https://www.darkreading.com/careers-and-people/cybersecurity-faces-18-million-worker-shortfall-by-dd-id/1329084

Korolov, M. (2016, December 2). AI is coming, and will take some jobs, but no need to worry. Retrieved from https://www.csoonline.com/article/3146137/it-careers/ai-is-coming-and-will-some-jobs-but-no-need-to-worry.html

Li, C. (2015). Penetration testing curriculum development in practice. Journal of Information Technology: Innovation in Practice, 14, 85-99. doi:https://doi.org/10.28945/2189

MacDonald, R. (2018, June 18). Working through the cybersecurity skills gap. Retrieved from http://www.helpnetsecurity.com/2018/06/18/working-cybersecurity-skills-gap/

Merritt, T. (2018, May 3). Top 5: Tips for using AI in your business. Retrieved from https://www.techrepublic.com/article/top-5-tips-for-using-ai-in-your-buisness/

Morgan, S. (2017, June 6). Cybersecurity labor crunch to hit 3.5 million unfilled jobs by 2021. Retrieved from https://www.csoonline.com/article/3200029/security/cybersecurity-labor-crunch-tohit-35-million-unfilled-jobs-by-2021.html

Oliver, J. (2018, March 29). Introduction to machine learning (ML) for cybersecurity. Retrieved from http://www.cyberdefensemagazine.com/introduction-to-machine-learning-ml-for-cybersecurity/

Olmann, G. (2016, December 28). How artificial intelligence will solve the security skills shortage. Retrieved from https://www.darkreading.com/operations/how-artificial-intelligence-will-solve-the-security-skills-shortage/a/d-id/1327756

Oltsik, J. (2018, January 11). Research suggests cybersecurity skills shortage is getting worse. Retrieved from https://www.cso.online/article/3247708/security-research-suggests-cybersecurity-skills-shortage-is-getting-worse.html

Osborne, C. (2018, March 21). Artificial intelligence key to do “more with less” in securing enterprise cloud services. Retrieved from http://www.zdnet.com/article/artificial-intelligence-key-to-do-more-with-less-in-securing-enterprise-cloud-services/

Rio, A. (2018, June 21). Will AI help close the skills gap? Retrieved from http://www.clomedia.com/2018/06/21/will-ai-help-close-the-skills-gap/

Rossi, B. (2016, June 20). Bring the noise: How AI can improve cybersecurity. Retrieved from http://www.information-age.com/technology/security/123461b38/bring-the-noise-how-ai-can-improve-cyber-security

Sanders, A. (2015, October 29). Will AI be smart enough to protect us from online threats? Retrieved from https://techcrunch.com/2015/10/29/will-ai-be-smart-enough-toprotect-us-from-online-threats/

Scroxton, A. (2016, January 24). AI is moving towards acceptance in cybersecurity, says Check Point. Retrieved from https://www.computerweekly.com/news/252433705/AI-is-moving-towards-acceptance-in-cyber-security-says-Check-Point

Siwicki, B. 92017, June 29). Artificial intelligence is giving healthcare cybersecurity programs a boost. Retrieved from http://www.healthcareitnews.com/news/artificial-intelligence-giving-healthcare-cybersecurity-programs-boost

Skilton, M. (2017, February 13). Impact of artificial intelligence on cyber security. Retrieved from https://www.huffingtonpost.com/professor-mark-skilton/impact-of-artificial-inte_b_14702160.html

Stevens, G. (2018). How to approach AI-enhanced cybersecurity. Retrieved from https://www.scmagazine.com/how-to-approach-ai-enhanced-cybersecurity/article/761867/

Stilgherrian. (2018, August 1). AI can deliver ‘faster better cheaper’ cybersecurity. Retrieved from https://www.zdnet.com/article/ai-can-deliver-faster-better-chearper-cybersecurity/

Stolte, R. (2018, June 21). Filling the cybersecurity skills gap with artificial intelligence. Retrieved from http://journal.ahima.org/2018/06/21/filling-the-cybersecurity-skills-gap-with-artificial-intelligence/

Teitler, K. (2018, May 1). ISACA workforce development report highlights need for more & more qualified security employees. Retrieved from https://www.misti.com/infosec-insider/isaca-workforce-development-report-highlights-need-for-more-qualified-security-employees

Towers-Clark, c. (2018, April 21). AI will not take our jobs, but it will fundamentally change them. Retrieved from https://www.gigabitmagazine.com/ai/ai-will-not-take-our-jobs-it-will-fundamentally-change-them

Uchill, J. (2017, July 30). Demand for automotive cybersecurity pros outpaces supply. Retrieved from http://thehill.com/policy/cybersecurity/344539-demand-of-automative-cybersecurity-pros-outpaces-supply

Vincent, J. (2018, April 3). AI and robots will destroy fewer jobs than previously feared, says new OECD report. Retrieved from https://www.theverge.com/2018/4/3/17192002/ai-job-loss-predictions-forecasts-automation-oecd-report  

Zorz, Z. (2018, April 17). Tech-skilled cybersecurity pros in high demand and short supply. Retrieved from https://www.helpnetsecurity.com/2018/04/17/cybersecurity-pros-high-demand/

Static InfoSec Does Not Work Well

Attacks on the enterprise and embedded systems are not slowing down. These are increasing as the attacks are expanding the sophistication, the number of attacks is growing in numbers, the attackers have modified their activities to a business model, and the notoriety associated with an attack has increased the publicity with these. As an increase in the issue’s potency, these attackers are located across the globe.

The mainstream, present response is to put the defensive architecture in place, monitor the SIEM, and respond if there is an issue (e.g. attacker’s successful phishing attack). An immense amount of trust is placed into these appliances to monitor and protect the enterprise. This static thinking has not and will not be acceptable in the future against advanced attackers.

The security operations command (SOC) is under an increasing level of pressure from management and the attackers. This is budgetary from inside sources and external from the seemingly daily attacks, both old and new from attacks not experienced previously. To defend against these using the static security architecture, not consistently updating the applications and tools, looks to create and further problems for the CISO and business.

The InfoSec Architect, to adequately protect the system, has to be flexible and creative. These simple acts would work to directly keep pace with the attackers on various activity and technology levels. Without this in place, then the enterprise would be maintaining the security put in place years prior (e.g. bronze age tools) against an enemy using the current attack technique (e.g. iron age tools).

The enterprise needs to keep pace, or this will continue to be breached and compromised regularly and with ease.

Railway breach in Europe

For a business to be targeted, there needs to be something of value to exfiltrate.
The attackers are not going to go through the effort of the full attack cycle for
practice. If there were to happen to be a breach, there should be tools in place
monitoring activities so the attacker’s actions would be noticed and halted.

An incident occurred in Europe on their railway system. If you happen to be
traveling on the rail in Europe, naturally the traveler has to purchase a ticket.
This process includes the usual information with credit card numbers, full legal
name, mailing address, email, and phone numbers. This information in its entirety
would provide for a nice target for any attacker. THis sensitive data used in unison
could provide for a fair number of successful attacks.

Such an incident occurred in late 2017. On November 29, 2017, the Rail Europe
system was breached. If this was not bad enough for a scenario, the attackers
had accessibility from the breach (November 29, 2017) through February 16, 2018.
During this time, the attackers had time to exfiltrate the PII and data they desired.
To further worsen the situation, Rail Europe was not aware they had been breached.
A bank affiliated with RENA noted this and informed the company. The number of
affected clients was unknown. The number could be rather substantial, as RENA
had transactions with 5M Americans.

The recommendation at this point is for RENA customers to change their password
and watch their accounts. There is also identity theft protection available, which over
the long-term may not have a substantial amount of value, as the attackers would be
able to use certain data indefinitely, not just a year.

The vulnerability involved the webpage used by the clients. This was infected by
malware coded to log the client’s information, including the debit and credit card
numbers, expiration date, and the important CVV numbers.

There are several areas to focus on with this compromise. Primarily, the lesson
would be to monitor the logs, network, and access. The business should have
known something was occurring within the network over the three months of exfiltrating
so many records
(https://www.informationsecuritybuzz.com/expert-comments/rail-europe-customer-data-breach/).
This amount of traffic should have been noticed on some level at some junction of time.

Bank Client's PII Valuable

            Banks have the privilege of collecting our data and storing this for their uses. As the banks store this data and information, the banks are acting as stewards of this data. Being a steward and responsible, there are certain aspects of InfoSec which a reasonably prudent bank would deploy to protect the bank, its assets, and customer’s data.

            Apparently, there was an issue with two banks which allowed an oversight to occur (https://www.ehackingnews.com/2018/05/two-financial-institutions.html, http://www.palada.net/index.php/2018/05/29/news-6184/, & http://www.cbc.ca/news/business/simplii-data-hack-1.4680575). In May 2018, the Bank of Montreal and Simplii Financial, owned by CIBC announced their alleged breach. Simplii Financial is CIBC’s direct banking brand. The affected clients number at approximately 90k people. These may have been accessed by the attacker or the people the data was sold to, as evidenced by the Bank of Montreal receiving a tip stating a limited number of people’s accounts had been accessed by unauthorized parties.

            After the breach was noted and analysis began, Simplii began to implement additional measures to improve their online cybersecurity. This included, but was not limited to, fraud monitoring and actions to monitor online banking to a greater measure.

            To make things worse, the attackers threatened to release the data from the compromise and exfiltration. The attackers would not release this if they were to happen to pay them $1M on or before May 28^th. The Bank of Montreal did not pay the attacker’s ransom but are however focusing their efforts on their clients.

            In this day and age, banks and other entities and institutions have to be more proactive in implementing a defense in depth to ensure, as much as possible, the security for the client’s data. At times, budgets, internal politics, and other timing issues slow these implementations. These, however, should be pushed more to the front of development and implementation. The alternative is to be breached, have the opportunity to publish the breach and claim only highly trained “hackers” could have done this, etc., and pay fees.