As the Security Engineer of my employer I have been asked to analyze some potential malicious threats that are arising in our organization and explain the possible impacts. Therefore, I start to monitor the incoming and outgoing traffic in the network. It didn’t take too long to come across a active attack. Someone was trying to bypass or break into our secured system. The intruder was able to bypass our first layer firewall and then was stuck trying to access a specific IP range specific to our servers which hold hundreds of credit card information. We have been investigating and back tracking this threat with some forensic tools. It is difficult to back trace the intruder now that the connection has been broken. A few days passed when then someone brought to my attention that he received a phone call from someone stating they were from Microsoft and needed to run some updates on the employees workstation. The employee gave out his IP address so that the person from Microsoft can remote into the workstation. The employees workstation was compromised therefore the Desktop team has retrieved the workstation and started to trace anything that the person might have done while connected remotely.
After the desktop support team did intense scans they did not find any malicious software installed or running the machine. They are checking on any possible data they might have viewed or accessed that will make them attack again or provide them with the information to cause the company a threat. We are now up to two threats and in a matter of several days apart. A lot of companies don’t think this happens on a day to day basis. However this is why there wrong, there’s people out there that live to hack peoples networks and steal peoples identity.
With that said, our current company has a EMS (Energy Management System) which is installed on our network. These systems