Data Privacy Attacks

Introduction
 Advancements in information technology (IT) have raised
concerns about the risks to data associated with weak IT
security.

 Inadequate IT security may result in compromised

confidentiality, integrity, and availability of the data due to
unauthorized access.

 To ensure that individual privacy remains carefully

protected, local and state education agencies should
implement state-of-the-art information security practices.

 Staying ahead of the ever-evolving threat of a data breach

requires diligence on the part of the education community in
understanding and anticipating the risks.
Technical Threats
 Non-existent Security Architecture

 Some organizations do not have an established

security architecture in place, leaving their
networks vulnerable to exploitation and the loss of
personally identifiable information (PII).

 Inadequate network protection results in

increased vulnerability of the data, hardware, and
software, including susceptibility to malicious
software.
 Non-existent Security Architecture

 If the network contains sensitive information or

PII, it is critical that even in a very limited
resource environment, minimal user, network and
perimeter security protection mechanisms (such
as anti-virus) are implemented.

 Mitigation: If an organization does not have the

appropriate personnel to design a security
architecture, it is recommended that a third party
be brought in to consult with the IT team.
 Un-patched Client Side Software and
Applications

 Computers run a variety of software applications,

including older versions of that may sometimes
contain vulnerabilities that can be exploited by
malicious actors.

 Mitigation: To reduce the ability of malicious actors to

compromise or destroy an organization’s security
system, implement a robust patch management
program that identifies vulnerable software
applications and regularly updates the software
security to ensure ongoing protection from known
threats.
 Phishing and Targeted Attacks
(“Spear Phishing”)

 One way malicious individuals or criminals (e.g.,

hackers) target individuals and organizations to gain
access to personal information is through emails
containing malicious code this is referred to as
phishing. Once infected emails are opened, the
user’s machine can be compromised.

Mitigation:

 To reduce vulnerability to phishing and other e-mail

security scams, organizations should install
professional enterprise-level e-mail security software.
 Stage 6 Stage 7
Stage 1 Stage 2 Stage 3 stage 4 Stage 5
Command & Action on
Reconaissance Weaponization Delivery Exploitation Installation
Control Objectives

TARGET
NETWORK
INTERNET

3
6

4
5
ATTACKER

Figure I. Stages in Spear Phishing Attacks

 Phishing and Targeted Attacks
(“Spear Phishing”)

 It is recommended that this software check both

incoming and outgoing messages to ensure that
spam messages are not being transmitted if a
system becomes compromised.

 In addition, organizations should provide regular

internet security training to staff to ensure user-
awareness about e-mail scams.
 Internet Websites

 Malicious code can be transferred to a computer

through browsing webpages that have not undergone
security updates.

 Simply browsing the internet and visiting

compromised or unsecured websites could result in
malicious software being downloaded to an
organization’s computers and network.

 Mitigation: To prevent threats from compromised

websites, employ firewalls and antivirus software to
help identify and block potentially risky web pages.
 Poor Configuration Management

 Any computer connected to the network, whether at

work or at home, that does not follow configuration
management policy, is vulnerable to an attack.

 Weak data security protection measures that do not

restrict which machines can connect to the
organization’s network make it vulnerable to this
type of threat.
 Poor Configuration Management
Mitigation:

 Establish a configuration management policy for

connecting any hardware to the network.

 The policy should specify security mechanisms and

procedures for various types of hardware, including
computers, printers, and networking devices.

 It is also recommended to implement a Network

Access Control solution to enforce configuration
policy requirements.
 Mobile Devices

 Use of mobile devices, such as laptops or handheld

devices, including smartphones, is exploding; however,
the ability to secure them is lagging behind.

 Data breaches can occur in a number of ways: devices

can be lost, stolen, or their security can be
compromised by malicious code invading the operating
system and applications.
 Mobile Devices
Mitigation:

 To promote data security in case a device is lost or

stolen, encrypt data on all mobile devices storing
sensitive information.

 Until more data encryption, user authentication,

and anti-malware solutions become available for
mobile devices, the best protection strategy is to
implement a strict mobile device usage policy and
monitor the network for malicious activity.
 Cloud Computing
 In cloud computing large amounts of customer data are
stored in shared resources, which raises a variety of data
encryption and availability issues.

 Further, the cloud provider faces the same data security

responsibilities and challenges as the organization that
owns the data, including patching and managing their
applications against malicious code.

Mitigation:

 Conduct an assessment to compare benefits from adopting

cloud computing, including cost savings and increased
efficiency, against associated security risks.
 Cloud Computing
 It is critical to ensure that solutions offered by the
cloud provider effectively comply with the
organization’s information system security
requirements, including operational and risk
management policies.
 Removable media

 The use of removable media on an organization’s

network poses a significant security threat.

 Without proper protection, these types of media

provide a pathway for malware to move between
networks or hosts.

 Following proper security measures when using

removable media devices is necessary to
decrease the risk of infecting organization’s
machines or the entire network.
 Removable media
Mitigation:

 To minimize the security risks, apply simple

preventative steps. These include disabling the
“auto run” feature of the operating system on the
organization’s machines and training users to
scan removable media for viruses before opening
the files.
 Botnets

 Botnets are networks of compromised computers

used by hackers for malicious purposes, usually
criminal in nature.
 Clean up efforts resulting from botnet infestation
may be costly and damaging to an organization’s
reputation.

Mitigation:
 Since there are many ways computers can
become compromised, having a strong security
architecture is critical to defending against a
malicious botnet attack.
Figure II. Botnet Attack [2]
 Botnets

 Strategies for botnet detection involve analyzing

patterns of data sent over the network, and
monitoring computer resources usage and
external connections.
 Zero-day Attacks

 A zero-day attack is a threat aimed at exploiting

a software application vulnerability before the
application vendor becomes aware of it and
before the vulnerability becomes widely known
to the internet security community.

 These attacks are among the hardest to mitigate

and leave computers and networks extremely
vulnerable.
Figure III. Timeline of a Zero-day
attack [3]
Figure IV. Zero-day Malware Attack on Adobe Flash
Player [4]
 Zero-day Attacks
Mitigation:

 Unless an organization has access to IT analysts

who are highly experienced in technical
vulnerability assessment, a frequently
recommended approach to mitigation is to wait
for the vendor to release a patch that fixes the
vulnerability.

 The organization should keep abreast of the latest

software patches and deploy the fix as soon as it
is distributed by the developer.
 Non-technical Cyber Security
Threats to Information Systems
 Insider Threats

 An insider is defined as someone with legitimate

access to the network.

 Because information accessed by insiders can be

easily stolen, copied, deleted, misfiled, or
changed, insider threats can be some of the most
damaging, regardless of whether they occur due
to user carelessness or malicious attempts.
 Insider Threats

Mitigation:

 To mitigate this type of threat, establish and

enforce a well-defined privilege rights
management system.

 Audit programs are useful in enforcing access

controls and monitoring suspicious activity.
 Poor Passwords

 Implementing a policy on strong user passwords is

critical to data protection.

 Modern password-cracking programs can easily

break weak passwords, such as those containing
common words or word groups found in a dictionary.

 For this reason, user-selected passwords are

generally considered to be weaker than randomly-
generated passwords.
 Poor Passwords
Mitigation:

 Use a professional password-generating program

as an enterprise-level solution.

 In addition to implementing procedures for

generating strong passwords, train users on how
to maintain the security of their passwords.

 For enhanced security, consider implementing

more advanced authentication capabilities, such
as multi-factor authentication.
 Physical Security

 Physical security is essential to preventing

unauthorized access to sensitive data as well as
protecting an organization’s personnel and
resources.

 A Physical safety measures include securing

access to dedicated computers, server rooms,
routers, printers, and any areas that process or
store sensitive data.
 Physical Security
Mitigation:

 Establish and enforce a physical security

system.

 Strong physical security includes access

control policies and procedures; physical
barriers surveillance and alarm systems; and
security breach notification, response, and
system recovery procedures.
 Insufficient Backup and Recovery

 Lack of a robust data backup and recovery

solution puts an organization’s data at risk
and undermines the effectiveness of its IT
operations.

 Data and system recovery capabilities allow

an organization to reduce the risk of damage
associated with a data breach.
 Insufficient Backup and Recovery
Mitigation:

 Establish an organizational policy and specify

procedures for data backup, storage, and
retrieval.

 Many advanced data and system backup and

recovery tools are available on the market.
 Improper Destruction

 Discarded electronic devices, such as

computers or portable drives, that have been
used in processing and storing sensitive data,
remain vulnerable unless the data are erased
properly.

 A data breach can occur if recovery tools are

used to extract improperly erased or
overwritten data.
 Improper Destruction
Mitigation:

 Establish a policy for protecting or destroying no

longer needed IT assets and media that may
contain sensitive data.

 Several standards organizations offer guidelines

that outline best practices for ensuring data are
discarded properly, including recommendations
published by the National Institute of Standards
and Technology (NIST) titled NIST SP 800-88,
“Guidelines for Media Sanitization.”
 Social Media

 Using organization’s devices and network resources

to access social media websites poses a high data
security threat.

 Social networking sites are often targeted by

malware, receive a high degree of spam, and are
frequently used to gain information for identity theft.

Mitigation:
 Introduce and reinforce a policy forbidding access to
some social media websites while using an
organization’s resources and equipment.
Social Media

 Train users about the security threats generated

by visiting these sites.

 Organizations that allow access to social media

websites should deploy a strong anti-virus and
spam filtering solution.
 Conclusion
 Understanding the vast array of threats is the first step in
ensuring adequate protection of sensitive data.

 All networks are vulnerable to cyber security threats.

 A comprehensive data security program is essential for

mitigating these threats and preventing a data breach.

 A holistic approach to data security begins with

understanding the network, its architecture, user population,
and mission requirements.

 Consistent implementation of the security plan will reduce

susceptibility to cyber threats and increase the overall
security of an organization’s data.
 References
[1] Privacy Technical Assistance Center USA, “Data Security: Top Threats to Data
Protection ”, pdf available at: http://ptac.ed.gov/sites/default/files/issue-brief-
threats-to-your-data.pdf, Last accesssed: August 2016.
[2] HelpSec, “Malware-infected home routers used to launch DDoS attacks”, available
at: http://www.helpsec.net/malware-infected-home-routers-used-to-launch-ddos-
attacks, Last accesssed: August 2016.
[3] InfoSec, “Wrong response to zero day attacks exposes serious risks”, available at:
http://www.infosecisland.com/blogview/22600-Wrong-response-to-zero-day-attacks-
exposes-serious-risks.html, Last accesssed: August 2016.
[4] Trend Micro, “Malicious Ads Redirect to Flash Zero-Day Exploit, Affects Top Video-
Sharing Site”, available at:
http://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/
malicious-ads-redirect-to-flash-zero-day-exploit-affects-top-video-sharing, Last
accesssed: August 2016.
[5] BCS, “Top 10 database attacks”,available at:
http://www.bcs.org/content/ConWebDoc/8852, Last accesssed: August 2016.