Data Breach Attacks And Management Strategies In Australia

Discussion

Australia has faced the raise in data breaches specifically in healthcare and finance industries. The issues with data breaches have affected the departments widely. To manage the situations and to overcome with the issues Australian government has decided to the change the cyber security system and frameworks including the polices. The polices are set to strengthen the security against the national level threats attacks. This paper discusses about the different data breach attacks faced by Australian citizens and responsible persons for the attacks. The paper also discusses about two different case studies and compares the case studies by discussing about the similarities and differences between the studies.

Section 1:

1. Australia faced different data breach attacks. One of the main data breaches incidents was Ubiquiti data breach¹. That occurred in December 2020. Ubiquiti networks are considered as one of the most effective and largest vendors for IoT devices. The main reason of the attack occurred when the company’s third-party provider compromised and stole the customer account credentials a started to misuse it. The breach occurred on December 2020 and the staffs were informed and got to know about it after January 11,2021.
2. The incident was first noticed by the customers when the individual discovered that there were sudden changes in the transition of the organization’s authentication and it was followed by the local networks and it got connected with Ubiquiti’s cloud¹⁴. It was identified that the company did not have proper security intelligence which made it easy for the attackers to attack the data log of the company. Another vulnerability that was identified was lack of secure passwords. The company asked the employees to secure the individual password several times. The third-party providers were accessed by the unauthorized user by using the weak passwords. The cyber criminals used vulnerability in AWS and stole the main credentials of the employees². One of the major vulnerabilities was that the company invalidated all the customer credentials details through the forced reset which allowed the attackers to access the cloud base of company¹⁵.
3. The company reported the attack first on December 2020 and it was investigated that the attack was worse than it was reported. It was identified that the attack was caused by the former employee of the company who was assigned as the IoT manager. The individual accessed the cloud by using the authorized access¹⁴. The individuals attacked the systems and got access of all the important information of the company in that way that the authorized employees were declined to use the information. The individual then contacted the employer with the aim of demanding the payment of 50 bitcoin that was close to 2 million dollars at that time. The main aim of the individual was to get the capital of Bitcoins by using the weak credentials and blackmailing the company. It was identified when the individual offered the safety of the personal information in exchange of 50 bitcoin 2.8 million dollars¹⁶.
4. The investigator also confirms that it was avoidable as the attack was based on simple vulnerabilities. The attack could have been easily prevented. The staffs were informed about changing the security password several times³. As per the investigation the main cause of the incidents was the weak password and weak security the systems. The incident could have been prevented if the company was more active about identifying the insider threats. The manager of IoT department was authorized to access all the information of the individual and the individual used the accessibility to get the desired information. The motivate can be prevented by improving the database security, improving source codes and application logs of the company. The company train the employees to protect the individual data and by making new audits everyday about data this could have been prevented. The major flaw of the company is that it did not invalidate the employee information immediately. The company could save the organization by regularly checking the employee details and updating it.
5. Cyber security threats have become common between companies. There are several management strategies that an organization use to mitigate the security risks. Having the security insurance is one of the main strategies.
   • The cyber security insurance provides the new type of requirement and policies to manage the risks. It will help the company to protect form the random data breach attacks.
   • The insurance will cover the data breach attacks by notifying the customers about the affected parties.
   • A company faces huge loss and interruption when a data beach attacks hits. Cyber security polices helps an organisation to cover the threats and controls the cost of the business.
   • It provides the defence to cyber extortion defence. Having the defence will increase the severity and frequency of the organisation. The policies also help the organisation to cope up with the losses related to cyber extortion.

Section 2:

1. Every year Australia face the different types data breaches. Most of the data breaches are faced by organizations. The type of the breach can be defined by measuring the number individuals getting effected with. This study shows the complete list of data breaches that has taken place in Australia⁵. This study describes that a data breach occurs when the private information are added without any permission. The study shows and provides details of all the different types of breach that has occurred in recent times specifically the risks caused by human error. The report shows that businesses with revenue more than 3 million dollars are mostly attacked this it requires a proper strategy to plan.
2. The biggest similarities between the two case studies are that both of the studies provide the information about data breach incident that has occurred in Australia over the time⁹. Both of the studies are based on the detailed information of the incidents like how and when the attack hit, the responsible persons for the attacks and what was the total loss that the companies or the organization faced. In both the studies it is stated that data breach occurs when the attackers find the common vulnerabilities that have not even solved yet⁹. In the second case study the company Regis healthcare faced the different cyber-attacks that were also caused by the third parties similarly to the incident of Ubiquiti. The attackers used the vulnerability in different ways to steal the useful information in both the cases and the caused the huge loss for the organizations.
3. The main difference of the study is that the second study provides the featured information about the data breach incidents that occurred in 2020. The study also provides the information about how businesses can reduce the data breach chances. Whereas the first article shows the top 11 data breach attacks of Australia that happened till now. The study also shows the different global and Australia data breach examples. As per¹⁷Regis healthcare responses to the cyber incident that happened by third party. The company manages and operates healthcare products and one of the biggest care operations in Australia. The study shows the ways the company took to mitigate the future risks like regularly backing up data; the company used the IT system to store the data by creating the copies. In the second chosen case study also provides the vision of the company. Not only the vision the possible ways to mitigate the task are mentioned in this case study whereas in the first case study Ubiquiti’s taken actions regarding the incidents were not listed properly and mostly the information about the incident was listed like the main cause of the incident was the lack of secure password and vulnerabilities in the systems.
4. From both the case studies it can be ensured that both of the companies faced the similar types of attacks in partially similar way. The Regis healthcare company faced the different cyber-attacks by third parties involvement. The company is one of the largest healthcare service providers in Australia in order to keep the position and to provide the good service the company took immediate action to prevent and mitigate the risks related to cyber-attacks and data breaches⁸. Having the record of all the consumers is important especially in healthcare so that company used the regular back up process for the individual data. In order to overcome and manage the sudden risks the company Ubiquiti can focus on taking regular and immediate actions for managing the risks and for avoiding data breaches. Both the companies can take this into consideration that having vulnerable system leads to data theft and data loss. Regis healthcare can take the incident of data breach and can focus on checking for the insider threats that Ubiquity faced in order to avoid the future possibility of having the insider treats.

Question 4

While working and operating my system i faced the ransom ware attack name Petya including some of my colleagues. I was surfing one of the shopping websites and after accessing the site for few minutes the system was shut down and my operating system was blocked and i was unable to access it and to access the system i was asked to share my credentials and pay a specific amount. The ransom ware attacks usually hit when the cybercriminals find out some vulnerabilities I’m system and figures out a way to utilize it for making money¹¹. The virus created multiple copy of database informed. We all know that there are different types malware tay attacks are Wannacry software, crypto locker, endpoint production and Grandcrab. All these attacks are categorized by different sectors.

The type of attack that we have faced is categorized as Petya ransom ware attacks. Then cybercriminals scanned and checked all the files to find the vulnerability. The attackers used MFT that is referred as the quick reference guide for the every user with the access of single and more than one takes. The attackers used MFT to affect the MBR systems. MBR systems are usually responsible for booting up the devices. We cannot start or boot devices without MBR access and MFT permissions. Data breaches can be prevented. I have come across of some factors that we can implement to mitigate the risks like backing up data and information every day, reviewing the policies for breaches for preventing the future attacks. The main purpose of breaching data is that it has understood is fine morning out the main vulnerabilities and using it against the individual with the aim of getting money¹³. The data vulnerability in log in or personal credentials is one of the main vulnerabilities that can affect us directly.

Conclusion

With the growing digitalized generation Australia has faced the different types of data breach attack over the years. This study presents the different types of attacks of faced by the company Ubiquiti. It can be concluded in this paper that Cyber security threats have become common between companies. There are several management strategies that an organization uses to mitigate the security risks and Australia faced different data breach attacks⁶. One of the main data breaches incidents was Ubiquiti data breach. That occurred in December 2020. Ubiquiti networks are considered as one of the most effective and largest vendors for IoT devices⁷. The study also described another case study of Australia based on the data breaches incidents.  The study presents that every year Australia face the different types data breaches. Most of the data breaches are faced by organizations. The type of the breach can be defined by measuring the number individuals getting effected with. This study shows the complete list of data breaches that has taken place in Australia. In conclusion it can be state that in order to avoid future risks immediate measurements and actions should be taken.

References: 

• Rutherford, R. The Changing Face Of Phishing. Computer Fraud & Security2018, 2018 (11), 6-8.
• Chen, C.L., Yang, J., Tsaur, W.J., Weng, W., Wu, C.M. and Wei, X., 2022. Enterprise Data Sharing with Privacy-Preserved Based on Hyperledger Fabric Blockchain in IIOT’s Application. Sensors, 22(3), p.1146.
• Chen, C.L., Yang, J., Tsaur, W.J., Weng, W., Wu, C.M. and Wei, X., 2022. Enterprise Data Sharing with Privacy-Preserved Based on Hyperledger Fabric Blockchain in IIOT’s Application. Sensors, 22(3), p.1146.
• Gibson, D. and Harfield, C., 2021. Contradictions and inconsistencies in Australia’s mandatory data breach notification laws. Computer Law & Security Review, 42, p.105600.
• Alazab, M., Hong, S.H. and Ng, J., 2021. Louder bark with no bite: Privacy protection through the regulation of mandatory data breach notification in Australia. Future Generation Computer Systems, 116, pp.22-29.
• Venkatesha, S., Reddy, K.R. and Chandavarkar, B.R., 2021. Social Engineering Attacks During the COVID-19 Pandemic. SN computer science, 2(2), pp.1-9.
• Gabriel, M.H., Noblin, A., Rutherford, A., Walden, A. and Cortelyou-Ward, K., 2018. Data breach locations, types, and associated characteristics among US hospitals. Am J Manag Care, 24(2), pp.78-84.
• Rasoulian, S., Grégoire, Y., Legoux, R. and Sénécal, S., 2021. The Effects of Service Crises and Recovery Resources on Market Reactions: An Event Study Analysis on Data Breach Announcements. Journal of Service Research, p.10946705211036944.
• Ibrahim, A., Thiruvady, D., Schneider, J.G. and Abdelrazek, M., 2020. The challenges of leveraging threat intelligence to stop data breaches. Frontiers in Computer Science, 2, p.36.
• McLeod, A. and Dolezel, D., 2018. Cyber-analytics: Modeling factors associated with healthcare data breaches. Decision Support Systems, 108, pp.57-68.
• Moore, E., Likarish, D., Bastian, B. and Brooks, M., 2020, September. An institutional risk reduction model for teaching cybersecurity. In IFIP World Conference on Information Security Education(pp. 18-31). Springer, Cham.
• Moore, E., Likarish, D., Bastian, B. and Brooks, M., 2020, September. An institutional risk reduction model for teaching cybersecurity. In IFIP World Conference on Information Security Education(pp. 18-31). Springer, Cham.
• Moore, E., 2020. Building cyber defense training capacity(Doctoral dissertation, University of Plymouth).
• Khan, F., Kim, J.H., Mathiassen, L. and Moore, R., 2021. Data breach ma
• Chen, H.S. and Jai, T.M.C., 2019. Cyber alarm: Determining the impacts of hotel’s data breach messages. International Journal of Hospitality Management, 82, pp.326-334.
• Daly, A., 2018. The introduction of data breach notification legislation in Australia: A comparative view. Computer Law & Security Review, 34(3), pp.477-495.
• List of major Data Breaches in Australia and Overseas. https://www.insurancespecialists.com.au/data-breach-list/ (accessed Apr 5, 2022).

Order an Essay Now & Get These Features For Free:

Turnitin Report

Formatting

Title Page

Citation

Outline

Place an Order