Question

Case Study Exercise: The next day at SLS found everyone in technical support busy restoring computer systems to their former state and installing new virus and worm control software. Amy found herself learning how to install desktop computer operating systems and applications as SLS made a heroic effort to recover from the attack of the previous day. Questions:

1. Do you think this event was caused by an insider or outsider?Why do you think this?
2. Other than installing virus and worm control software, what can SLS do to prepare for the next incident?
3. Do you think this attack was the result of a virus, or a worm? Why do you think this?

Answer 1

a) the reason can be both, the attack is definitely not carried and performed by an insider but the insider may help the attack to carry out the attack. If the infrastructure of SLS is properly secured, it would not be easy for an attacker to carry out an attack that easy but if the attacker is efficient with these type of stuffs, he can do it. It will always easy for attackers to carry out the attack if they get hold of a insider's credentials.

b) here are few steps that SLS can do:

• Implementing firewalls: implementation of firewall must always be the basic step that need to be done while implementing security. Firewalls will block unwanted traffic from entering into the network and thus the chances of an attack is minimised.
• Encryption: Implementing encryption tool will help to encrypt valuable data. Decryption of data is not an easy task for the attacker to perform. Getting hold of the original data will always be difficult if the encryption is done using a powerful algorithm.
• Backups: This is actually important for any business to have, backing up of data and then restoration of the data in these type of situations is good for business. If the business has proper backup, then whatever happens to the infrastructure, they can easily restore it and ensure business continuity.

c) If we look at the intensity of the attack, this attack is caused by a virus. Actually virus can damage the whole data easily and effectively. Moreover, killing and detecting a virus is always difficult. Moreover, virus can multiply themselves easily and damage done is increased.