Managing Data and Network Security: Takeaways from the Sony Hack
Managing Data and Network Security: Takeaways from the Sony Hack
The massive breach of Sony Pictures network security not only lead to the loss of numerous terabytes of sensitive employee and corporate information, but also contributed to an international diplomatic incident between the United States and North Korea. What have network security experts learned from the Sony hack and how can you use this information to keep your data secure?
The massive data breach incurred by Sony Pictures Entertainment disclosed at the end of 2014 is considered by many security experts to be unprecedented in its scale, scope, and consequences. For example, some of the sensitive information within the many terabytes of stolen data from Sony Pictures included:
- Employee personnel, financial, and health information
- Proprietary corporate documents and internal communications
- Unreleased scripts, which included The Interview
One of the significant consequences of the data breach was the threats made by the hackers, allegedly linked to North Korea, against the theatres planning to show The Interview that led to a diplomatic dispute between the United States and North Korea. While security experts are skeptical of North Korea’s involvement, the fallout from this hack has businesses of all sizes reviewing their policies, procedures, and protocols concerning network and data security. What mistakes do experts think Sony made and how can you avoid them?
Robust Data and Network Security Requires More than Firewalls and Anti-Virus Programs
According to a study of the massive Sony data breach, one of the mistakes Sony made, which is common among large corporations as well as small and medium sized businesses, is relying upon firewalls and antimalware programs to keep their sensitive data safe. While these security software programs provide a first line of defense and threat detection, according to Fengmin Gong, in an interview published by IEEE Spectrum, a comprehensive data and network security strategy includes constant monitoring of the flow of sensitive data to identify any suspicious movements. By tracking who is accessing, downloading, or sharing information, it is possible to identify an attack, possibly in real time. Additionally, this focus allows a business’s IT security team assess the potential consequences of an attack in order to take defensive action as quickly as possible.
The Cyphort investigation of the trojan used in the Sony attack also found that the program had the user names and passwords of Sony employees “hardcoded” into the malware program. The two essential lessons from this finding include:
- A previous breach occurred in which the hackers gained access to the user names and passwords. It is possible if Sony Picture’s cybersecurity team detected the initial breach, employee user ids and passwords could have been changed to mitigate the risk.
- Periodic changes to network access credentials are an essential part of a business’s IT security protocol.
Applying the Lessons of the Sony Hack to Protect Your Sensitive Data
Given the fact that even small businesses store, transmit, and receive a significant amount of information through their networks, real time monitoring of all data traffic is not possible. According to IEEE Spectrum Fengmin Gong recommends identifying the most sensitive data and digital assets in your network. Some examples might include employee identification information or customer credit card information. Once the IT security team pinpoints the data requiring the highest level of security, they need to ensure:
- Access to this data is curtailed to the fewest number of users as possible
- Robust threat detection and defenses are employed to protect this data
- Implement a continuous data traffic monitoring protocol
About Natural Wireless
Natural Wireless owns and operates its broadband network to provide businesses dedicated, secured, and symmetrical Internet connection with guaranteed reliability and speed. Contact us to learn more about Better Internet…Naturally!