Case study: PlayStation Network Hack
"In
April 2011, Sony revealed that the PlayStation Network, used by millions of
consumers worldwide, had been breached by hackers. The breach went unnoticed by
Sony for several days and ultimately resulted in the theft of up to 70 million
customer records. The records included customer names, addresses, emails, dates
of birth and account password details. Information which could have enabled
additional attacks or identity theft.
In order to assess the scale of the damage and repair the
vulnerabilities that led to the attack Sony took the PlayStation Network
offline, a move which cost the company, and merchants who offered services via
the network, significant amounts of revenue.
In addition to the cost of fixing the breach, Sony was fined
£250,000 by the Information Commissioner’s Office as a result of a ‘serious
breach’ of the Data Protection Act, stating that ‘The case is one of the most
serious ever reported to us. It directly affected a huge number of consumers,
and at the very least put them at risk of identity theft.’
The precise financial cost to Sony is unclear but estimates
place it at approximately £105 million, excluding the revenue loss by partner
companies, damage to its reputation and potential damage to its
customers."
So how do
the principles of CIA apply to the PlayStation case? Quite obviously,
confidentiality was violated: there was a chance that unauthorised people could
read the data. However, authorized users still had full access to the data, so
it remained available; and the data was not changed, so its integrity was
preserved.
The Sony
Play Station Network (PSN) hack highlights the grave threat faced by
individuals and organisations from malware and
online hackers . In Sony's case this attack on the PSN led to a breach
of Confidentiality as personal data of millions of customers was leaked. The
data leaked include names, birthdays, email addresses, passwords, security
questions, and maybe credit card details. This could also lead to identity
theft because of the type of data leaked. Integrity could have been affected if
the hackers changed passwords and other data of users. There were reports that
Sony discovered an exploit which allowed users to reset other users passwords
which is clearly a case of breach of Integrity. The biggest setback to Sony was
affect on Availability as the PSN had to
be taken offline to secure and recover from the breech. Despite Sony having been fined a hefty sum of
money due to its poor security mechanisms it did not learn much from the attack
as the PSN network was again hacked in 2014. Despite the knowledge that such
threats pose to privacy and data security organisations continue to be lax
about security.
As we move to
digitised world such attacks will continue to take place and we need not assume
that big organisations are prepared to ensure the security of data. Basic
measures like keeping different passwords for different services and not
sharing credit card info is required to be taken by all of us. Similarly government
need to be more strict with companies and penalise them severely for such
breeches. Also the requirement of sharing credit card details by companies like
Apple and Sony should be removed. It is imperative that we learn from these
mistakes to have a safer digital world.
Sources
https://en.wikipedia.org/wiki/2011_PlayStation_Network_outage
http://fortune.com/2014/12/24/why-sony-didnt-learn-from-its-2011-hack/
www.futurelearn.com/courses/introduction-to-cyber-security/
- The case study is part of course on Cyber Security at Future learn.
Comments
Post a Comment