Detection of data breaches
It is difficult to tell sometimes in a business organization, if there has been a cyber security breach within the business process. Security breaches are mainly the procedures that are adopted by individual attackers or a group of attackers that are trying to avail access to unauthorized areas within an IT system. Breaches depend on vulnerabilities within an IT system and it is also found that in some cases they represent the probation of openings within an IT system of an organization.
In any case, cyber security breaches claim a significant amount of sensitive data from an individual or an organization. Security data breaches are the strikes in a business organization that makes the entire organization realize the importance of a security breach and the adjacent need of a security system that is required to detect the breaches before they even appear within the organization.
This essay would thus present the analytical skills about the ways by which an organization can detect the data breaches within an organization, which in turn would help the organization to prevent further attacks on the security systems of the organization. The essay would further analyze the strengths and weaknesses followed by a summary of the mandatory data breach laws that are viable in Australia.
A technical overview about the data breach detection would further be explained in the essay. The essay would also explain a detailed and empirical example of signature-based detection of data exfiltration. The essay would lastly explain the implications of notifiable Data Breach Scheme for Australian cyber security and the General Data Protection Regulation in the context of international anarchy.
In a business organization, or even within the internet server system, it sometimes takes a lot of time to detect a cyber security breach. The time, during which the business organization finally detects that there has been a serious claim of the intricate data about the business organization, it could also happen that the business organization might have already suffered a huge loss with the security attacks that have been caused by the malicious hackers. There are various ways by which a cyber security attack can be detected but sometimes it becomes too hard to detect, even for the experts dedicated to detect the cyber security breaches.
However, there are certain indications in the day to day activity within an organization that would help in the detection of a security attack that is in progress. The ways by which these can be detected are listed as follows:
- Suspicious transfer of files of detections of several failed log in attempts found in the network activities.
- Abrupt changes in the critical infrastructures in the system or the sudden changes in the system accounts and passwords.
- Detection of suspicious files within the IT system, that may or may not have been encrypted.
- Banking activities or transactions that have no record within the known system of the organization.
- Unexplained loss of the access to the network, social media networks or even the email ids.
- Sudden leakage of the intricate details about the customers, the list of clients or even the confidential data about the organization.
- Unexplainable conditions where the internet services and connections become unusually slow or there is an intermittent access of network takes place.
- Detection can also occur if careful attention is given to the rapid error or warning signs are displayed by the browsers, antivirus tools or anti malware tools that warns the entire system about an impending infection.
There are also detection methods in the system of a business organization that would help in detection or the monitoring of any anomalies within the system that might provide a warning sign about an attack in progress. The following examples might be able to shed light on these detecting techniques:
- Questionable extras in the developed codes or occurrences of unexplained inconsistencies within the network.
- Problems associated with the logins from the administrative side or problems the access of the management functions.
- Drastic drop recognized suddenly within the traffic volumes in the company website.
- Sudden changes detected within the layout and design of the company website.
- Detected issues in the performance of the website that further affects the availability and the accessibility of the company website.
There are also way to detect the impending attacks on the company through internet, or the cyber security attacks led through virus attack, spam and malware. These attacks can have immense damaging effect on the business and thus it would be quite obvious to have systems dedicated to detect these kinds of attacks and recover the systems when an attack incident occurs. The following are the ways by which these kinds of attacks can be detected within the internet networks:
Strengths and Weaknesses of mandatory data breach notification laws in Australia
Detecting Spam attacks: Spam can be defined as an unsolicited communication which makes up the majority of the traffic in emails. Every internet service provider should offer the customers with a default spam filtering feature that would help the customer with their dedicated email services. The spam filtering services helps in the detection of the impending spam attacks present within a suspicious email with the detection of word pattern and other clues within the received email. Furthermore, these spam filters diverts these received messages into a separate folder or a separate mailbox depending upon the spam content in them and these separated messages are kept within a specific folder to classify them as spam. A user can opt for buying a separate spam filter that would help them in reducing the received spam mails and then manage the inbox in a secured manner. Network phishing is also a substrate of spam mails where them spam mails are used as a bait to attack a user or further an organization. A spam containing email can be accidentally clicked or can drag a person to click on them spreading the attack further. Proper training should be provided to the users within an organization or while accessing personal computers so that they do not fall prey to these attacks and make phishing attacks happen.
Detecting Virus or Malware: Virus or Malware attacks are also very frequent in the recent times spanning around various industries and organizations. There are very common signs that make notice of an individual about an impending attack of virus or malware. The ways by which virus or malware attacks can be detected are listed as follows:
- Slowing down of the system
- Unwanted pop-up messages or the detection of unexpected activities on the machines.
- Intermittent activities or overload detection in email servers.
- Corrupted or missing data files.
- Sudden and unexpected changes detected within the content of the files created within the machines.
Whenever these signs are detected, it should be readily accepted that there has been a virus or malware attack within the system which needs to be immediately eradicated from the system. It is required that these virus and malware must be deleted from the entire IT system of the business process. These eradication processes must be done by spreading awareness of the attacks and making everyone alert about the situation. The infected machines also would need to be quarantined and a thorough cleanup process must also be followed, making sure that there are no further room for a re-infection process. The management of the outgoing email traffic should also be taken notice of during the crisis processes. A proper cyber security incident response plan should also be devised by the organization to make sure that whenever these problems arise, the organization would be ready to eradicate them entirely from the system so that they might never be able to cause harm to the IT system claiming confidential and intricate data from the system.
Data breach detection systems: There are several tools available that help in the detection of data breaches within the network of an organization or a service provider. Both software and hardware products are available to detect these issues within the system and even detect the active threats present within the system. These products are capable of detecting the threats and alerting the people in charge of protecting the integrity of the security within the organization to make sure that they take relevant steps in order to protect the dignity of the cyber security systems. These tools help in the monitoring the entire network and send alerts for the suspected breach. They monitor the suspicious user behavior, the vulnerability in the network and even the threats that are present within the applications and the programs. These tools help in the detection of relevant threats and focuses on the identified intrusions when they occur. The controlling and containing of the breaches are also devised by these tools including the mitigation of the damages in the system done by the data breaches.
These attacks deal with the gaining of unauthorized access over the system and they start disclosing the protected, confidential and sensitive data within an organization or the system providing internet to individuals or business organizations. Various kinds of data are at constant threat because of this, including the confidential health information of individuals, the personal identifiable information about an individual or a group, the trade secrets as well as the intellectual properties. Further would be a discussion on how the continental country of Australia deals with the mandatory data breach notifications and what are the strengths and weaknesses regarding the cyber attacks about the mandatory data breach notifications.
The notifiable data breaches or the NDB has entered into the legislative systems of Australia under the Privacy Act 1988 (Cth) (The Privacy Act) and has imposed a mandatory obligation, that would require that the eligible data breaches be immediately reported to both the Office of the Australian Information Commissioner (OAIC) and any individuals who may be potentially affected by a data breach. There have been several changes brought about in the law about mandatory data breach notification that had gone through several modifications to come about to the final written legislative impact.
The latest changes that have been brought about have made it mandatory to report a data breach activity that has been detected and under the Privacy Act, this notification needs to be sent to both the concerned individual and the agency. The eligible data breach also needs to be justified as per the law to make it feasible for the notification to be sent. However, this law has some distinct identifiable merits and demerits or strengths and weaknesses related to them. These can be identified in the descriptions as below:
Strengths of the law: The mandatory data breach notification law would definitely encourage the business organization to take note about the significant financial losses that they have been dealing with the entire time and respond to the slow and steady data breaches that have been occurring all around the organizations in Australia that has the potential to bring down the entire Australian economy if not treated. There are policies generated in organizations that makes them essential in having a secured cyber system within the organization to protect the confidential data, but making it mandatory ensures that the entire organization works at pace for making even the personal information secure, not just the information generated for the purpose of business propagation.
Weakness of the law: It is hard to find much weaknesses in the mandatory data breach notification in Australia, but there is indeed a weakness pointed out in the law that it is somewhat time consuming and claims a lot of useful time in the business process. Another point of weakness that can be detected within the law is that the law does not respond to the disclosure disincentive, envelope triviality, or content triviality. The companies can try to avoid the data breach notification that they receive from the customer end. This would in turn make the consumers keen on not opening the letter of notification as they would already be overwhelmed enough from the commercial entities. Mostly, the consumers, who are bad at making the relevant data security choices, would consider such information as irrelevant.
Thus, it can be said that there has been an impending debate over the mandatory data breach notification law in Australia as the law has both relevant strengths and weaknesses related to the entire law being imposed on the business organizations all over Australia. The business organizations are now obligated to make the customers or consumers aware of the impending cyber security threat that has the potential to claim their personal and intricate data. The law has indeed made the positive move by making the reporting of the data breaches mandatory ensuring that the entire organization works at pace for making even the personal information secure, not just the information generated for the purpose of business propagation.
However, there are also negativities of the law as they require necessary time that would have otherwise helped the business propagation. Additionally, the companies can try to avoid the data breach notification that they receive from the customer end and also the consumers, who are bad at making the relevant data security choices, would consider such information as irrelevant. Therefore, it can be said that there is lack of awareness in the people about the severity of the law or even the severity of the data breaches that has the potential to ruin an entire organization or gain access over all the unauthorized data of an individual or a group of organization.
The ways by which data breach can be detected follows a lot of technicalities that can be described in this part of the essay. The data breach can be detected by the potential discrepancies within an organization or a network provider as well.
The data breaches can be detected if there is proper attention paid on the suspicious transfer of files or detections of several failed log in attempts found in the network activities. Again, the abrupt changes in the critical infrastructures in the system or the sudden changes in the system accounts and passwords make the situation susceptible to data breaches. Detection of suspicious files within the IT system, that may or may not have been encrypted are also a way by which data breach can be suspected. Other methods would be the monitoring of the banking activities or transactions that have no record within the known system of the organization, unexplained loss of the access to the network, social media networks or even the email ids, sudden leakage of the intricate details about the customers, the list of clients or even the confidential data about the organization, or unexplainable conditions where the internet services and connections become unusually slow or there is an intermittent access of network takes place. Detection can also occur if careful attention is given to the rapid error or warning signs are displayed by the browsers, antivirus tools or anti malware tools that warns the entire system about an impending infection. There are various tools available for the detection of data breaches as well that prepares an organization or a network system before there is an occurrence of a data breach.
Data Exfiltration is a method by which an authorized access over a confidential data and data theft can be regarded as an unauthorized transfer of data from a computer. These are threats to both commercial organizations and the government equally. However, there are also ways by which these data exfiltration can be detected with the help of signature based detection methods. One of such a detection method is the Content Signature Generator, which is used to generate the content signatures of sensitive content. Just like the SIDD system, it also matches the content of the confidential encrypted files within a system and while doing so, it might suddenly make an exit and take a responsive action. The spontaneous analogy of the process makes the signature-based detection method identify the covert communications and statistical features that are able to capture the natural correlation inherent in media.
Implication of notifiable Data Breach Scheme and General Data Protection Regulation for Australian cyber security in the context of international anarchy
International anarchy in the context of cyber security law is a state where there is lack of authority and sovereignty in accession of authorized data and information. The way, by which data breaches occur, indeed there is a state of international anarchy where random data breaches occur at a drop of hat and the notifiable Data Breach Scheme in Australia would help in the accession of reducing the international state of anarchy in this matter. The way by which the law states that it would require by an organization that the eligible data breaches be immediately reported to both the Office of the Australian Information Commissioner (OAIC) and any individuals who may be potentially affected by a data breach would surely make sure that there are necessary steps taken to make people aware of the cyber security threats and adopt relevant steps to prevent it.
In the same way that the notifiable Data Breach Scheme in Australia would help in the curbing of the international anarchy in cyber security, the General data Protection Scheme also helps in the same way. This makes every individual as well as organizations to make sure that they have applied relevant measures to make sure that there are no cyber security threats detected within the system they have been using. In this way, the awareness of data protection and their importance would spread to the entire population around Australia and the significant breaches of data including the confidential user data would be secured. This would in turn help raising the economy of the country in future as data breaches are able to ruin the entire economy of the country, as well as the world further.
Conclusion
Thus, it can be said that the cyber security systems and data breaches that occur within network system, or in turn within an organization needs to be taken care of with all the technical amendments possible. This is because; the time, during which the business organization finally detects that there has been a serious claim of the intricate data about the business organization, it could also happen that the business organization might have already suffered a huge loss with the security attacks that have been caused by the malicious hackers. Thus, the essay talks about all the possible technical ways by which the data breaches can be mitigated. This has been analyzed with the help the analytical skills about the ways by which an organization can detect the data breaches within an organization, which in turn would help the organization to prevent further attacks on the security systems of the organization. The essay has further analyzed the strengths and weaknesses followed by a summary of the mandatory data breach laws that are viable in Australia. The analysis explains why these measured should be made mandatory with every user accessing the internet.
A technical overview about the data breach detection has further been explained in the essay. The essay has also put forward a detailed and empirical example of signature-based detection of data exfiltration, called the Content Signature Generator, which is used to generate the content signatures of sensitive content. The essay has lastly explained the implications of notifiable Data Breach Scheme for Australian cyber security and the General Data Protection Regulation in the context of international anarchy.
References
Ahmed, Mohiuddin, Abdun Naser Mahmood, and Jiankun Hu. “A survey of network anomaly detection techniques.” Journal of Network and Computer Applications 60 (2016): 19-31.
Tschuggnall, Michael, Efstthios Stamatatos, Ben Verhoeven, Walter Daelemans, Günther Specht, Benno Stein, and Martin Potthast. “Overview of the author identification task at PAN-2017: style breach detection and author clustering.” In Working Notes Papers of the CLEF 2017 Evaluation Labs/Cappellato, Linda [edit.]; et al., pp. 1-22. 2017.
Baesens, Bart, Veronique Van Vlasselaer, and Wouter Verbeke. Fraud analytics using descriptive, predictive, and social network techniques: a guide to data science for fraud detection. John Wiley & Sons, 2015.
Shu, Xiaokui, Danfeng Yao, and Elisa Bertino. “Privacy-preserving detection of sensitive data exposure.” IEEE transactions on information forensics and security 10, no. 5 (2015): 1092-1103.
Costante, Elisa, Davide Fauri, Sandro Etalle, Jerry Den Hartog, and Nicola Zannone. “A hybrid framework for data loss prevention and detection.” In 2016 IEEE Security and Privacy Workshops (SPW), pp. 324-333. IEEE, 2016.
Ye, Yanfang, Tao Li, Donald Adjeroh, and S. Sitharama Iyengar. “A survey on malware detection using data mining techniques.” ACM Computing Surveys (CSUR) 50, no. 3 (2017): 41.
Shu, Xiaokui, Danfeng Yao, and Elisa Bertino. “Privacy-preserving detection of sensitive data exposure.” IEEE transactions on information forensics and security 10, no. 5 (2015): 1092-1103.
Sarabi, Armin, Parinaz Naghizadeh, Yang Liu, and Mingyan Liu. “Risky business: Fine-grained data breach prediction using business profiles.” Journal of Cybersecurity 2, no. 1 (2016): 15-28.
Choi, Young B., and Gregory D. Allison. “Intrusion Prevention And Detection in Small to Medium-Sized Enterprises.” (2017).
Carrigan, Dean, John Gallagher, and Ben Di Marco. “Australia’s new mandatory data breach notification regime: How to prepare your business.” Governance Directions 69, no. 5 (2017): 280.
Solomon, Andrew. “New mandatory data breach notification laws.” Superfunds Magazine 428 (2017): 16.
Leonard, Peter, and Data Synergies Principal. “The new Australian Notifiable Data Breach Scheme.” (2018).
Solomon, Andrew. “Time to prepare for mandatory data breach notification.” Governance Directions 69, no. 10 (2017): 593.
Do, Quang, Ben Martini, and Kim-Kwang Raymond Choo. “Exfiltrating data from Android devices.” Computers & Security48 (2015): 74-91.
Blumbergs, Bernhards, Mauno Pihelgas, Markus Kont, Olaf Maennel, and Risto Vaarandi. “Creating and detecting IPv6 transition mechanism-based information exfiltration covert channels.” In Nordic Conference on Secure IT Systems, pp. 85-100. Springer, Cham, 2016.
Djanali, Supeno, ADI P. BASKORO, Hudan Studiawan, Radityo Anggoro, and T. C. Henning. “CORO: GRAPH-BASED AUTOMATIC INTRUSION DETECTION SYSTEM SIGNATURE GENERATOR FOR E-VOTING PROTECTION.” Journal of Theoretical & Applied Information Technology 81, no. 3 (2015).
Shim, Kyu-Seok, Sung-Ho Yoon, Su-Kang Lee, and Myung-Sup Kim. “SigBox: Automatic Signature Generation Method for Fine-Grained Traffic Identification.” J. Inf. Sci. Eng. 33, no. 2 (2017): 537-569.
Eesa, Adel Sabry, Zeynep Orman, and Adnan Mohsin Abdulazeez Brifcani. “A novel feature-selection approach based on the cuttlefish optimization algorithm for intrusion detection systems.” Expert Systems with Applications 42, no. 5 (2015): 2670-2679.
Bird, Sara. “Mandatory notifiable data breaches.” Good Practice 12 (2017): 26.
Abrahams, Nick, and Jamie Griffin. “Privacy law: The end of a long road: Mandatory data breach notification becomes law.” LSJ: Law Society of NSW Journal 32 (2017): 76.
Daly, Angela. “The introduction of data breach notification legislation in Australia: a comparative view.” Computer Law & Security Review 34, no. 3 (2018): 477-495.
Johnston, Anna. “2018: A year of significant changes to privacy law.” LSJ: Law Society of NSW Journal 41 (2018): 84.
Selvadurai, Niloufer, Nazzal Kisswani, and Yaser Khalaileh. “Strengthening data privacy: the obligation of organisations to notify affected individuals of data breaches.” International Review of Law, Computers & Technology (2017): 1-14.
Mann, Monique. “Privacy in Australia: Brief to UN Special Rapporteur on Right to Privacy.” (2018).
Order an Essay Now & Get These Features For Free:
Turnitin Report
Formatting
Title Page
Citation
Outline
