Computer Security Breach and Hack

Question: Discuss about the Computer Security Breach and Hack. Answer: Computer Security Breach Security breaches are common occurrences in the present day scenario. There are numerous security violations that take place during the information exchange and transmission. One of the examples of such security breaches is the security attack at a Chinese firm named as VTech. The firm had to go through a devastating breach of its information security. Overview of the Problem It was in the year 2015 in November that security breach took place at VTech. The attackers in this security breach succeeded in the illegal stealing of more than 4.8 million users that were engaged with the firm. These records were associated with the personal data of the VTech users and customers that included kids and their parents. The more critical and sensitive information such as login data, credit card details and likewise however were kept secure (Carolina, 2015). Attack Mode and Attack Type The mode of attack that led to the breaching and stealing of data at VTech was SQL injection. It is a breach of security in which the attack is performed through the means of damage causing SQL statements. These are written by the attackers and the experts and are written with an aim to hamper the security of the information and the database in which the information is stored. In case of the VTech, this same attack and the ill-natured queries were used for access to the database and its contents. There are a number of properties of information such as information availability, information integrity, and information confidentiality and information privacy. The attack that took place at VTech was primarily due to the inadequate and inefficient security measures and mechanisms that were adopted. Also, there were certain entry and access points that could easily be manipulated by the attackers with the means of SQL injection attack. Brief of Possible Solutions With the expansion of information technology and information systems, there are numerous information security attacks that have been developed by the attackers. These attacks may have a low to extremely severe impact on the information and the users that are associated with it. It is because of this reason that the system experts came up with detection, prevention and control measures. There are various steps and actions that VTech could have performed for avoiding the security breach that took place. Access management and identity management through advanced authentication techniques and artificial intelligent mechanisms could have prevented the attack from taking place. One of the prime reasons behind the occurrence of SQL injection attacks is the use of dynamic SQL. The database experts should have avoided the usage of the same and should have also promoted the use of parameterized queries (Tajpour, Ibrahim, Masrom, 2011). Many of the security attacks along with SQL injection attacks are often created for a particular system or database version. It should be made sure that the versions are frequently updated to avoid any such cases. Also, it is of utmost importance to set the user roles and privileges correctly, failing which the access and authentication mechanisms will be of no use (Dehariya, Kumar, Ahirwar, 2016). There are other measures that may also be u sed such as installation of firewalls, use of proxy server, installation of anti-malware packages and likewise (Kolhe Adhikari, 2015). With the advancement of technology, there are also a number of different automated tools that have been developed in order to put a check on the security attacks and the state of security associated with a system or the organization. These tools such as intrusion detection and prevention systems shall also be installed in the organizations to avoid the security risks from taking place (Zhang, 2011). JPMorgan Chase Hack Case Hacking of the information is a common practice that is given shape by the attackers and hackers all across the globe. These hack cases may have low to devastating impacts based on the information volume and category that is impacted. One such extremely severe case is associated with the security breach that took place at JPMorgan in the year 2014. Overview of the Problem The hackers succeeded in acquiring of the records of the users at JPMorgan that comprised of over 83 million user files and records. This data included the information of the households and also the small-scale organizations and businesses. The case was revealed in the year 2014 and it took a period of around one year to fully recover from the damage that it caused. The data that was stolen comprised of the personal information of the customers and also their demographic details (Leyden, 2014). Affected Banks and Parties It was not only JPMorgan that suffered adversely because of the hack case that took place. However, another eleven banks also had to face some serious troubles because of their association with the organization and the information of their users was also exposed. Some of these firms included Citibank, HSBC Holdings, Fidelity Group and many others (Kitten, 2015). Mode and Type of Attack Every organization believes to advance in terms of the technology that is implemented in its architecture. JPMorgan attempted to achieve the same by implementing multi-step authentication in its architecture for the enhancement of security. However, due to technical and operation defects by the network engineers and workers, there was one network server that was mistakenly left open-ended. This became the prime reasons of the breach that took place at the organization which was later revealed after much analysis. List of Applicable Countermeasures With the expansion of information technology and information systems, there are numerous information security attacks that have been developed by the attackers. These attacks may have a low to extremely severe impact on the information and the users that are associated with it. It is because of this reason that the system experts came up with detection, prevention and control measures. It was required by the top-level managers and network experts at JPMorgan to carry out parallel testing and verification activities to ensure that no such operational and technical error was present. Also, the employees must have been provided with the trainings to carry out validation and verification activities on their own during the development and implementation tasks. Also, it is of utmost importance to set the user roles and privileges correctly, failing which the access and authentication mechanisms will be of no use. There are other measures that may also be used such as installation of firewalls, use of proxy server, installation of anti-malware packages and likewise (Bella, Bistarelli, 2005). With the advancement of technology, there are also a number of different automated tools that have been developed in order to put a check on the security attacks and the state of security associated with a system or the organization. These tools such as intrusion detection and prevention systems shall also be installed in the organizations to avoid the security risks from taking place. It is essential for the organization to update and bring innovation in the security mechanisms that are adopted in their architecture and frameworks. The practice will ensure that the cases of hacking and other security breaches are avoided and prevented and would result in the enhancement of the security. References Bella, G., Bistarelli, S. (2005). Information Assurance for security protocols. Computers Security, 24(4), 322-333. https://dx.doi.org/10.1016/j.cose.2004.10.004 Carolina,. (2015). Hackers Steal Parents, Kids Data in a Massive Data Breach on Toy Manufacture. HackRead. Retrieved 05 April 2017, from https://www.hackread.com/hackers-steal-toy-store-parents-kids-data/ Dehariya, H., Kumar, P., Ahirwar, M. (2016). A Survey on Detection and Prevention Techniques of SQL Injection Attacks. International Journal Of Computer Applications, 137(5), 9-15. https://dx.doi.org/10.5120/ijca2016908672 Kitten, T. (2015). Charges Announced in JPMorgan Chase Hack. Bankinfosecurity.com. Retrieved 05 April 2017, from https://www.bankinfosecurity.com/chase-hackers-indicted-a-8673 Kolhe, A., Adhikari, P. (2014). Injection, Detection, Prevention of SQL Injection Attacks. International Journal Of Computer Applications, 87(7), 40-43. https://dx.doi.org/10.5120/15224-3739 Leyden, J. (2014). JPMorgan Chase mega-hack was a simple two-factor auth fail. Theregister.co.uk. Retrieved 05 April 2017, from https://www.theregister.co.uk/2014/12/23/jpmorgan_breach_probe_latest/ Tajpour, A., Ibrahim, S., Masrom, M. (2011). SQL Injection Detection and Prevention Techniques. International Journal Of Advancements In Computing Technology, 3(7), 82-91. https://dx.doi.org/10.4156/ijact.vol3.issue7.11 Zhang, X. (2011). Discussion on the Detection and Prevention of SQL Injection. Advanced Materials Research, 287-290, 3047-3050. https://dx.doi.org/10.4028/www.scientific.net/amr.287-290.3047