Case No. 61 .Epsilon 2011
Name : Kartik Kapoor
Roll No. 32
Question 1: Study the incident and prepare a write up in your own words describing the incident with focus on the specific information security failure (Maximum of 150 words).
Answer 1:
The breach occurred on March 30 ‘2011 at Epsilon, a Texas-based firm that handles email communications for more than 2,500 clients worldwide, including seven of the Fortune 10 companies. Epsilon sends 40 billion emails annually. Epsilon is the largest e-mail marketing company in America. Two and a half thousand companies use its services and entrust their customer e-mails to it. At least 50 companies, including Target, Best Buy, Walgreens and JP Morgan Chase, had their client e-mail addresses stolen So far, 26 companies have come forward as affected by the breach.
The first company to report the data breach was the grocery chain Kroger. From there, it quickly spiraled, as a barrage of companies came forward over the weekend to report their email databases had been accessed without permission
The list currently includes: TiVo, Barclays Bank of Delaware, McKinsey & Company, Marriott Rewards, Ritz-Carlton Rewards, New York & Company, Brookstone, L.L. Bean, Ameriprise Financial, The College Board, The Home Shopping Network, Lacoste, Disney Destinations, Ralphs, Food 4 Less, Fred Meyer, Fry’s, King Soopers, U.S. Bank and City Market.
Fortunately for those affected, the stolen email lists included only customers’ names and email addresses; no financial information was accessed.
A rigorous assessment determined that no other personal identifiable information associated with those names was at risk,” Epsilon said in a press release.
Some may dismiss the type of data harvested as a minor threat, but having access to customer lists opens the opportunity for targeted phishing attacks to customers who expect communications from these brands. Being able to send a targeted phishing message to a bank customer and personally address them by name will certainly result in a much higher “hit rate” than a typical “blind” spamming campaign would yield. So having access to this information will just help phishing attacks achieve a higher success rate.

Question 2: Identify and describe in brief the tools and technologies used for the attack.
Answer 2: They learn from those email notifications that the excessive attempts that end up getting 404 errors are searching for admin scripts, sql database scripts, and php setup code. This activity indicates to me an attempt to gain access to our server by hunting for a back door.

I'm noticing that these attempts always have IP addresses from foreign countries such as China, Japan, Bangladesh, India, Russia, Brazil, Ukraine, Lithuania, and Jordan. It’s very rare for me to catch a hacker from the U.S.

Some of these attacks are so vicious they take up a lot of bandwidth, hitting hundreds of non-existence pages in a matter of seconds. Obviously hoping to find one that is a back door entry to log in and get vital information from the rest of the server.

Some back doors they are searching for allow them to plant executable code to search for things like customer records. In my case, I don't have any scripts online that would allow access to my data. But the hackers don't know that and they are actually just using bots to scan every computer in the world, or in a selected country. Anyway, I keep my customer records off line. No connection to the Internet in any way whatsoever. And credit card info is not kept at all.

The hackers are doing this across the web and eventually they find a computer server where they can get in and sometimes they actually find something useful.
Question 3: Describe the year of Occurrence and the nation(s) involved.
Answer 3: March ‘2011 and USA the nation of occurrence.
Question 4: Describe the estimated damage/loss (tangible/intangible)—50 words.
Answer 4: Estimated at having a potential cost that ranges from $225m to $4bn, the March 2011 hack of e-mail handler Epsilon is another as of yet undetermined candidate for the costliest cyber-heist of all time. The Dallas-based firm provides marketing and email-handling services to organizations as large as Best Buy and JP Morgan Chase. However, as the stolen information was mostly email addresses, the various possible criminal applications of this information mean that the estimated cost is extremely variable
Question 5 : How do you think the incident could have been prevented –50 words.
Answer 5: Lesson One – Take Security Seriously
Of course, no one should find this surprising. After all, if an e-commerce site or CRM portal goes down, business can come to a halt. No business means no income so by all means this is going to take precedence. Besides, anyone who has been tasked with securing any type of technology doesn’t have the ROI that upper management is looking for when giving a project the go ahead.
In order to prevent another incident like Epsilon from happening, cyber security needs to be at the forefront of IT and management’s agendas. With the increasing problem of Advanced Persistent Threats, email security needs to be looked at and any weaknesses shored up.
Lesson Two – React Appropriately
The breach of Epsilon happened on March 30th. By April 1st it was disclosed to the public. This gave Epsilon, and their clients, ample time to put together a response based on the details of the data breach. For this, they should be applauded.
Far too often companies who are victims of this type of cyber crime spend so much time spinning their wheels deciding how to soften the blow of negative press that they forget the ramifications it can have on individual customers.
By making the details known from the beginning, the customers of Epsilon’s corporate clients were able to receive fair warning about phishing scams and other illicit activity that would certainly be a result of their email being exposed.
Lesson Three – Heed the Warning Signs
Another thing Epsilon did right was that they discovered the breach quickly. Had they not recognized that there was unusual activity going on, the breach would have yielded much more than the 2 percent of the customer base that had be compromised.
Epsilon was warned, along with other companies, that there was a high likelihood of a malicious hacking attack that would take place against email distributors. To mitigate this threat Epsilon beefed up its monitoring capabilities to watch for anomalies.
Lesson Four – Segment Your Data
Security professionals who have analyzed the data breach, such as Anup Ghosh, Founder and Chief Scientist for Invincea, think that this may be the work of a single attack.
“As we learn more about this breach, it could be very possible that a single intrusion was utilized to gain access to the data across all of these brands. Is this indicative of a potentially broader threat from a cloud perspective? Maybe yes, maybe no – only time will tell as we learn more and pull back more layers of both onions,” he went on to say. It is a common suggestion in the security world that data should be segmented. For example, Client A’s data should be kept apart from Client B and Client C, or data should not be stored on the same server as web applications (which is common when it comes to default installations). Yet while this is often suggested, it is hardly ever practiced.Segmenting data protects you because in the event one data set, application, network segment, etc. is compromised, all of your stored is not exposed as a result. It basically makes the attacker work harder for a big pay day. Of course if you are monitoring appropriately you will be able to spot the intrusion before more data is stolen.