Below is a summary of a security incident at some police department, as told by a...

  

Transcribed Image Text:

Below is a summary of a security incident at some police department, as told by a security researcher in a podcast. A. Incident 1 and Response A police department in some US city (about 28,000 residents) was hit with ransomware: all the computers in the police department were no longer functioning. The ransomware affected the entire network: the patrol vehicles, the police department, and also some of the city laptops that were connected to the network during the incident. Ultimately, the entire police department was affected. The outage affected the network printers first, and then brought down the computers. A security researcher, Nicole, who works for the Secret Service, becomes aware of the breach and offers assistance; however, the department declines. The IT team at this police department were doing daily backups of all their systems in the network, so they never even considered paying the ransom. Thus, they proceed to initiate the restoration from backup. However, something happened months earlier which meant their backups weren't actually working. The latest backup they had was from ten months ago. By the time they figure that out, they had already restored a bunch of their systems, and the network was back up and online. This allows people to get up and working fairly quickly. However, the staff has to re-enter all the data from the last ten months back into the systems. No further actions are performed at this point. B. Incident 2 and Investigation One week later, a similar situation happens: the printers stop working. Nicole attends the location this time. The IT department consists of only one person. The server is located at the back of the building, in a garage or a storage place-like area. The wires are scattered on the floor, surrounded with boxes of documents and other non-IT objects. Some of the computer management is outsourced, another company was performing updates to the computers and security monitoring. However, they were more reactive, and not very proactive at handling security incidents. The server also houses some of the city's other departments, not just the police. Nicole records some network traffic (using Wireshark), dumps the memory contents (using Volatility), and some other data onto a USB drive. While performing this, she notices another active logged-in system-admin account, and it was neither the department's IT person, nor any of the contracted companies. Then she notices more accounts active. Although it is suspected the active accounts are malicious, Nicole permits them to continue to be connected for just as long as she needs to wait for her tools to complete their work. Immediately after, she disconnects the other connections, changes all the passwords and grabs some other content from the server. After that, Nicole contacts the company to which the department outsourced security monitoring and asks them to turn over the logs they had captured, and if possible - a copy of the malware file from the previous incident, as well as the ransom letter, or any other details. They refuse, stating that their internal team is working on this, yet state they had a malware sample and the ransom note. She later insists that they disable remote access to the domain controller. The IP address from which the logins were made was from within the city the department was located in, and the user was able to upload the malware to the server again, but not to activate it. Shortly after, it is discovered the IP address belonged to the mayor of the city. After further investigation, it's discovered that the way the city staff checked their email was by logging in into the main server via Remote Desktop connection, using administrative credentials. Ultimately, someone sent the mayor a phishing email, managed to install a keylogger and later used the mayor's computer to attack the police station's computer. Q1: Briefly discuss TWO (2) security controls covered in the ITEC 3210 that would have helped prevent these security incidents. Use for EACH security control the format below: • Security control #1 (list name): Explain how Security control #1 helps prevent the incident (3 lines MAX) Q2: Discuss TWO (2) security controls covered in the ITEC 3210 that would not have helped prevent these security incidents. Use for EACH security control the format below: Security control #1 (list name): Explain why Security control #1 does NOT help prevent the incident (3 lines MAX) Q3: Briefly discuss TWO (2) security controls covered in the ITEC 3210 that would have enabled easier threat eradication and recovery after these security incidents. Use for EACH security control the format below: Security control #1 (list name): Explain how Security control #1 helps in recovery (3 lines MAX) Q4: Discuss TWO (2) security controls covered in the ITEC 3210 that would not have had benefit in eradication and recovery in these security incidents. Use for EACH security control the format below: • Security control #1 (list name): Explain why Security control #1 does NOT help in recovery the incident (3 lines MAX) Below is a summary of a security incident at some police department, as told by a security researcher in a podcast. A. Incident 1 and Response A police department in some US city (about 28,000 residents) was hit with ransomware: all the computers in the police department were no longer functioning. The ransomware affected the entire network: the patrol vehicles, the police department, and also some of the city laptops that were connected to the network during the incident. Ultimately, the entire police department was affected. The outage affected the network printers first, and then brought down the computers. A security researcher, Nicole, who works for the Secret Service, becomes aware of the breach and offers assistance; however, the department declines. The IT team at this police department were doing daily backups of all their systems in the network, so they never even considered paying the ransom. Thus, they proceed to initiate the restoration from backup. However, something happened months earlier which meant their backups weren't actually working. The latest backup they had was from ten months ago. By the time they figure that out, they had already restored a bunch of their systems, and the network was back up and online. This allows people to get up and working fairly quickly. However, the staff has to re-enter all the data from the last ten months back into the systems. No further actions are performed at this point. B. Incident 2 and Investigation One week later, a similar situation happens: the printers stop working. Nicole attends the location this time. The IT department consists of only one person. The server is located at the back of the building, in a garage or a storage place-like area. The wires are scattered on the floor, surrounded with boxes of documents and other non-IT objects. Some of the computer management is outsourced, another company was performing updates to the computers and security monitoring. However, they were more reactive, and not very proactive at handling security incidents. The server also houses some of the city's other departments, not just the police. Nicole records some network traffic (using Wireshark), dumps the memory contents (using Volatility), and some other data onto a USB drive. While performing this, she notices another active logged-in system-admin account, and it was neither the department's IT person, nor any of the contracted companies. Then she notices more accounts active. Although it is suspected the active accounts are malicious, Nicole permits them to continue to be connected for just as long as she needs to wait for her tools to complete their work. Immediately after, she disconnects the other connections, changes all the passwords and grabs some other content from the server. After that, Nicole contacts the company to which the department outsourced security monitoring and asks them to turn over the logs they had captured, and if possible - a copy of the malware file from the previous incident, as well as the ransom letter, or any other details. They refuse, stating that their internal team is working on this, yet state they had a malware sample and the ransom note. She later insists that they disable remote access to the domain controller. The IP address from which the logins were made was from within the city the department was located in, and the user was able to upload the malware to the server again, but not to activate it. Shortly after, it is discovered the IP address belonged to the mayor of the city. After further investigation, it's discovered that the way the city staff checked their email was by logging in into the main server via Remote Desktop connection, using administrative credentials. Ultimately, someone sent the mayor a phishing email, managed to install a keylogger and later used the mayor's computer to attack the police station's computer. Q1: Briefly discuss TWO (2) security controls covered in the ITEC 3210 that would have helped prevent these security incidents. Use for EACH security control the format below: • Security control #1 (list name): Explain how Security control #1 helps prevent the incident (3 lines MAX) Q2: Discuss TWO (2) security controls covered in the ITEC 3210 that would not have helped prevent these security incidents. Use for EACH security control the format below: Security control #1 (list name): Explain why Security control #1 does NOT help prevent the incident (3 lines MAX) Q3: Briefly discuss TWO (2) security controls covered in the ITEC 3210 that would have enabled easier threat eradication and recovery after these security incidents. Use for EACH security control the format below: Security control #1 (list name): Explain how Security control #1 helps in recovery (3 lines MAX) Q4: Discuss TWO (2) security controls covered in the ITEC 3210 that would not have had benefit in eradication and recovery in these security incidents. Use for EACH security control the format below: • Security control #1 (list name): Explain why Security control #1 does NOT help in recovery the incident (3 lines MAX)

Answer rating: 100% (QA)

Question 1 Security Control 1 Firewall A robust firewall would have acted as a digital sentinel warding off unauthorized access and preventing the ini... View the full answer