Breaches
Featuring 11 Papers as of September 10, 2018
-
Breach Avoidance: It Can Be Done, It Needs to Be Done Analyst Paper (requires membership in SANS.org community)
by John Pescatore - September 10, 2018- Associated Webcasts: Breach Avoidance: Yes, You Can!
- Sponsored By: Balbix
Almost every day it seems like the press is reporting on yet another security breach. Some breaches expose sensitive business and customer information, while others bring down business operations. But breaches are not inevitable. By implementing security processes and controls to proactively identify and remove or mitigate vulnerabilities, today’s companies, even those with limited staff and budgets, can avoid or limit business damage by prioritizing security efforts.
-
PCI DSS and Security Breaches: Preparing for a Security Breach that Affects Cardholder Data STI Graduate Student Research
by Christian J. Moldes - March 16, 2018Organizations that transmit, process or store cardholder data are contractually obligated to comply with the Payment Card Industry Data Security Standard (PCI DSS). They may be tempted to assume that once they are certified compliant, they are immune to security breaches, and as a result, may be inadequately prepared when such events occur. Regardless of their compliance status, organizations that fail to prepare could face long investigations, expensive forensic services, staff terminations, and loss of business and reputation. This research/paper provides detailed guidelines on how to prepare for a security breach, the documentation needed to facilitate forensic investigations and containment, and how to minimize the consequences and impact of a security breach.
-
Managing User Risk: A Review of LogRhythm CloudAI for User and Entity Behavior Analytics Analyst Paper (requires membership in SANS.org community)
by Dave Shackleford - February 26, 2018- Associated Webcasts: Why Insider Actions Matter: SANS Review of LogRhythm CloudAI for User and Entity Behavior Analytics
- Sponsored By: LogRhythm
In this product review, we explored the recently released LogRhythm CloudAI, which applies user and entity behaviour analytics (UEBA) capabilities to enhance traditional event management and security analytics toolsets to monitor behaviors tracked over time, alerting analysts to unusual events or patterns of events.
-
Enhance Your Investigations with Network Data Analyst Paper (requires membership in SANS.org community)
by Matt Bromiley - October 19, 2017- Associated Webcasts: Enhance Your Investigations with Network Data
- Sponsored By: Cisco Systems
Network forensics is its own specialized field that often introduces complex protocols, jargon, and analysis techniques that are potentially confusing to practitioners. But particular artifacts can be leveraged to determine the attack sequence and to offer a more complete picture of the breach. In this white paper, SANS analyst and instructor Matt Bromiley examines the power of network forensics and why it should be incorporated into all incident response investigations.
-
Zero-Touch Detection and Investigation of Cloud Breaches: A Review of Lacework's Cloud Workload Security Platform Analyst Paper (requires membership in SANS.org community)
by Matt Bromiley - June 27, 2017- Associated Webcasts: Effortless Detection and Investigation of Cloud Breaches: A Review of Lacework\'s Zero Touch Cloud Workload Security Platform
- Sponsored By: Lacework
Today's increasingly dynamic cloud environments present new challenges to security practitioners. With security talent in short supply, tailoring old policy-and-logs approaches to the needs of an organization can require time and resources it just doesn't have. In this review, SANS analyst and instructor Matt Bromiley shares his experience using Lacework's new Zero Touch Cloud Workload Security Platform to mitigate these challenges.
-
Simple Approach to Access Control: Port Control and MAC Filtering by Bill Knaffl - August 22, 2016
Many times businesses will spend time and money on "Magic Bullet" security and focus on a single technology or threat. This focus can lend itself more towards placing a "check in the box" for compliance rather than on actual security and facing today's threats. Frequently, missing controls can have a cascading effect where because one control was missing or inadequate, other failures occur turning a minor problem into a breach. This paper approaches one such incident, calls out which control was identified as the primary failure and offers an evaluation of a specific tool that could have helped prevent this attack. It covers not only the cost of the tool and the time to implement but discusses other costs such as training, monitoring, maintenance, user impact and offers a guide for a successful implementation.
-
An Approach to Reducing Federal Data Breaches STI Graduate Student Research
by David Thomas - May 17, 2016In July of 2015, The United States Office of Personnel Management (OPM) disclosed a series of data breaches, collectively referred to as the OPM data breach, that exposed the personally identifiable information (PII) of more than 20 million of American citizens (Bisson, 2015).
-
Case Study: How CIS Controls Can Limit the Cascading Failures During an Attack STI Graduate Student Research
by Bill Knaffl - May 3, 2016Every day it seems that new information becomes public about the latest data breach.
-
OPM vs. APT: How Proper Implementation of Key Controls Could Have Prevented a Disaster STI Graduate Student Research
by David Kennel - March 29, 2016On June 4th, 2015 U. S. Government officials announced a breach of data at the Office of Personnel Management (OPM).
-
United Airlines May 2015 Data Breach: Suggested Near, Mid and Long-Term Mitigating Actions Using the 20 Critical Security Controls by Philip G. Rynn - November 23, 2015
A series of highly-publicized data breaches in recent years have shed light on the growing threat and prevalence of private and public organizational loss of valuable online data at the hands of illegitimate sources.
-
Case Study: The Home Depot Data Breach STI Graduate Student Research
by Brett Hawkins - October 27, 2015The theft of payment card information has become a common issue in today's society. Even after the lessons learned from the Target data breach, Home Depot's Point of Sale systems were compromised by similar exploitation methods. The use of stolen third-party vendor credentials and RAM scraping malware were instrumental in the success of both data breaches. Home Depot has taken multiple steps to recover from its data breach, one of them being to enable the use of EMV Chip-and-PIN payment cards. Is the use of EMV payment cards necessary? If P2P (Point-to-Point) encryption is used, the only method available to steal payment card data is the installation of a payment card skimmer. RAM scraping malware grabbed the payment card data in the Home Depot breach, not payment card skimmers. However, the malware would have never been installed on the systems if the attackers did not possess third-party vendor credentials and if the payment network was segregated properly from the rest of the Home Depot network. The implementation of P2P encryption and proper network segregation would have prevented the Home Depot data breach.
Most of the computer security white papers in the Reading Room have been written by students seeking GIAC certification to fulfill part of their certification requirements and are provided by SANS as a resource to benefit the security community at large. SANS attempts to ensure the accuracy of information, but papers are published "as is". Errors or inconsistencies may exist or may be introduced over time as material becomes dated. If you suspect a serious error, please contact webmaster@sans.org.
All papers are copyrighted. No re-posting or distribution of papers is permitted.
STI Graduate Student Research - This paper was created by a SANS Technology Institute student as part of the graduate program curriculum.
