breaking news that could affect your pocketbook. J. P. Morgan Just revealing on August data breach could affect 76 million household contact information like dresses from customers, but claims they have.
We didn't take a broad enough you of our responsibility. Mason. That wasn't an investigator break,
and it was my mistake of fact. And I'm sorry.
More than 21 million Information. US. Stolen Taking Data Thio six. Secret Service Major way more break troubling news. More trouble for you says it is just completed its investigation. Remember the recent reports of some sort.
This course is called preventing data breaches with a one logic.
This course covers the basic security concept needed to prevent data breaches.
It goes through the fundamental security concepts of information security and covers what the industry is doing not doing and should be doing to protect data.
Then it gives an overview of the information security market landscape today,
followed by recommending new concepts that information security professionals should keep in mind when designing in organizations Information Security program.
In Part one, we will discuss what a data breach is
and then go over some of the history of data breaches as it applies to the industry
and show why the industry is failing
and finally talk about attacker motivation.
A data breach is when private information is visible. Toe unauthorized parties.
Data breaches are so common that Europe's new GDP, our data privacy law, now directly address is it.
A data breach must be at a scale that is larger than what a human can remember. Type up right on paper or otherwise, manually reproduce.
For example, a top executive telling a secret to somebody else is not a data breach. But losing millions of credit card numbers or files is a data breach. Data breaches, hurt brands and erode customer trust.
For example, Yahoos data breach costed them $350 million in their evaluation. When they were being acquired by Horizon.
Over the last few years, the magnitude and frequency of data breaches have increased, making it a regular news headline
In the US we have heard about major brands getting breached, but these bridges are small and compares into the Yahoo Data Breach and the Indian government's At our Citizen Database data breach,
which lost about 2.1 billion records.
The other data breach is one of the biggest data breaches recorded in history.
Data breaches threatened all organizations,
from finance companies to retailers to governments, tech companies.
They threaten any organization that has private data that it wants to keep confidential.
The industry today is failing, and Attackers are winning due to many factors.
First of all, security products assume trust in user's devices and networks, which is rarely the case.
Also, the software and networks in today's enterprises are extremely large and complex, and there is rarely one person who has entered and knowledge of an organization's topology.
Additionally, it is difficult for enterprises to track what data is dares and where distort and when it is used.
Also, as the world just saw in the case of Facebook in Cambridge, Analytica, with today's technology sharing data, implies giving up control over the data.
Finally, security goes against usability of a system where users want usability and I T administrators want security.
Malicious insiders are members of an organization who violate the trust that the organization hasn't them
as faras cybersecurity. This trust could involve protecting the confidentiality of sensitive data such as intellectual property or other secrets.
Malicious insiders are still unsolved problem in the cybersecurity industry today.
A prime example of a malicious insider, regardless of political beliefs, is Edward Snowden at the US National Security Agency.
He was trusted by ESA toe work with sensitive data and held a security clearance.
He became famous for becoming a whistleblower and causing a massive data breach of NSA's classified information by stealing up to one million documents from ESA on a USB drive. Let's hear what Edward Snowden has to say in his own words.
Uh, my name is Ed Snowden. I'm 29 years old. I work for Booz Allen Hamilton as an infrastructure analyst for En ESA in Hawaii.
One of the things people are gonna be most interested in in trying to understand what who you are and what you're thinking
is there came some point in time when you cross this line of thinking about being a whistle blower to making the choice to actually become a whistleblower,
what people through that decision making process,
when you're in positions off of privileged access, like a systems administrator for these sort of intelligence community agencies, you're exposed to a lot more information on a broader scale than the average employee, and because of that, you see things that may be disturbing.
But over the course of a normal person's career, you'd only see one or two of these instances.
When you see everything, you see them on a more frequent basis and you recognize that some of these things are actually abuses. And when you talk to people about them in a place like this, where
this is the normal state of business,
people tend not to take them very seriously and you move on from them. But over time, that awareness of wrongdoing sort of builds up and you feel compelled to talk about it. And the more you talk about it, the more you're ignored, the more you're told it's not a problem
until eventually realized that these things need to be determined by the public, not by somebody who was simply hired by the government.
We just saw an interview with Edward Snowden, who falls into the third category of a whistle blower
attacker. Motivation falls into three main categories.
Nation states, criminal gangs and activists.
Nation state adversaries are politically motivated
and are particularly dangerous because they have huge government backed budgets and look for both information to compromise national security and gain industrial advantages.
A prime example is when U. S defense contractor Lockheed Martin's F 35 fighter jet designs were stolen by China for use in the Chinese military through a cyber attack and a data breach that resulted.
Criminal gangs are usually financially motivated and are looking for information with financial value.
They can be demotivated by increasing the attacker cost.
Finally, activists are politically or ideologically motivated whistle blowers or groups that are trying to get attention or have some other agenda.