|payless casestudy | |
Summary : The objective of writing the report is to address the issues that has been raised on 24th February,2015 in Payless , due to which company has been gone through various problems . The report states all the primary reasons for the occurrence of the issues and all the possible measures which can be taken in order to recover all the problems and stop the issues from happening again in the future .
All the appropriate solutions will help the company from facing these issues again .

Issues and causes:

1 Network Problem :
On Monday at 9:30am organization was facing the problem of downtime of the network , no one in the organization was able to access the network . IDMS that were implemented last year are not working properly , due to which downtime in network was faced by all the people as they were not able to access the network which ends up in the result of high burden on the help desk as help desk is getting more and more calls of the frantic(panic) and angry users .As due to some extra burden on the ticketing system it got crashed and need to rebooted , as in result some of cases which needs assistance got blocked . Every user related to the Organization was going through same problem .CEO of the organization was also going through same situation , he was also not able to access the network and getting complaints of third party business partners that they are not able get connected as no network was available of payless foods. At early stage it was hard to say what is the actual cause of the problem and after full analysis IDMS was reported to be the cause of the problem of downtime of network .
The COO of the company got an urgent call for setting up an important meeting between himself ,operation staff , some members of help desk and head of the network operations .Support team of IDMS is contacted and addressed to be responsible for all the problem that has been occurred in the organization , as Payless Foods got pause for a moment because of some certain issue . The company was under a great problem that an attacker can set up a base for attacking the company in meanwhile when company was trying to resolve the problem.
SOLUTION : As I am CISO of Payless foods so it is my responsibility to detect the problem that has been occurred in the company due to which there was downtime in network . By doing full analysis it is concluded that IDMS were not installed properly due to which this all problem has been raised . There was talk with Support team of IDMS that why that they have perform their task so carelessly . As per solution to this problem is to install IDS and IPS i.e. intrusion detection system s and Intrusion Prevention systems , both are inter related to each other in a way that when there is any unauthorized activity performed by any intruder to get access into the system , Intrusion Detection systems detects the presence of intruder and inform all the authorized Users through notifications or through alarms for having any malicious activity so they get alert , at the same time Intrusion Prevention system also gets alert and try to prevent the intruder from getting into the system , if intruder is getting into through wires or network then Firewall or antivirus system act as intrusion Prevention system and if intruder is Physical then Biometric locks , Retina checking locks act as Intrusion prevention systems
All the activities performed on the network are audited in the logs and network traffic is captured through Wire shark and stateful firewall should be implemented for doing deep packet inspection and if malicious content is founded , drop packets and prevent from entering the network of company .All IDMS are being updated with snort like tools .Best topology is used to control the traffic of the network and keep everything under control.

2.Unauthorized Transactions: On the same day at 10:00 am , Margaret Chu (head of payless Food's financial operations) called up to inform that some transaction were taken place in company's payment disbursement system . Three transactions were recorded , from which one was of $300,000 to a bank account in Buenos Aries as this transaction was already cleared whereas other two transactions of CAD $500,000 in Zurich ,Switzerland and $150,000 in Cayman Islands were caught before getting cleared . It was so sure that this was fraud activity and question was raised that although IDMS was there in the company then how this could happen in the organization
SOLUTION: : There should be always a secure and different criteria for transferring the money or doing large transactions . Always there will be installation of stateful firewall on the network for doing proper inspection of packets that are entering in the network of the company as well as the packets leaving from the company's network to ensure that someone in the company will not do any malicious activity . A proper criteria will be implemented for transferring large amount of money as limit will get set that if customer needs to transfer more than particular set amount of money then there will be proper authentication and authorization way to grant the permission . If the server gets down then automatically financial server also gets stop so that there is no fraudulent activity can take place. Each and every transaction even it is large or small gets recorded and monitored . Biometric locks to the area of financial department so there will be no use Sharing password or social engineering .
All the Databases get monitored by the Database Administrator for the company's better survive . No click on the spam e-mails as attacker trying to get access of the server.

3.Budget Issue : At 11:15 am an e-mail was received by me which was sent by Frank Kinderbaum ,the deputy CFO . As in the e-mail it was stated that company is going to have another budget cut. Budget states that not to put more money for the security training of the employees, it describes that according to the upper management , CAD $600,000 was set for security training that should cover areas like choosing best password and which attachments employees are suppose to open and which are not . Kinderbaum has invited me(CISO) ,CFO and few manager to discuss the actual budget which is going to be set for training , as this budget is not surely allocated
SOLUTION: : As it was informed by deputy CFO for reducing cost for training employee in security concern then the stability of the company goes into danger , so for this solution is provided as training is provided to the top most senior employee of the company who can adapt it sincerely and can further gives training to his fellows and lower management fellows. Or other solution can be there will be on line classes for the employees of the company for their better understanding in perspective of security concerns . and an online test should be conducted within the company for testing the skills of the employees . and their concern in security of the organization .The organization can arrange all the security equipments that are required for their better understanding .It is not important that every employee should be from technical background as there are different field in the organization , so it will become an important issue to train people who are not having even basic information about the security so they can understand that which link is real and which is a phishing attack . So for them security seminars should be arranged in the company for providing them appropriate security concern for protection of the company

4.Compromisation of Web Application: Later on at 2:30 pm , things got more messed up . It was claimed by Webmaster that within our enterprises an undeveloped application which was developed by major business unit got compromised as it was got hacked by some attacker because of some loopholes within the application, this application helped perpetrator for collecting all the names and credit card numbers of nearly tens of thousands of customers
SOLUTION:
The problem of web application being compromised can be solved if there is proper inspection of the application before its implementation of within the network of company . If vulnerabilities are already known by the developer then appropriate solutions will be given related to it , as patches should be installed on regular interval of time so that system remain safe from being compromised . All the application should have automatic updates so that it will be always upgraded with new preventions and new features . Before actual implementation of application , it should be implemented on other system so its vulnerabilities can be checked and it can be determined that what will be the risk level of installing the application.

CONCLUSION: All the above solutions will be helpful for the company for protecting itself from the reoccurrence of the issues .As I have put forward my best knowledge for leading the company in a right direction . I as CISO of the company ensure you this will not happen in the future and at same time I gives you surety that everything is over control and under my supervision .All the problems will get solved with appropriate and satisfactory solutions .