Extending the Information Security Incident Classification with Crisis Levels

Last week I tweaked my Information Security Incident Classification chart. Given recent events I might consider extending it to include Crisis 3, 2, and 1 levels.

Perhaps they would look like this. I previously alluded to "11" in my original post.

  • Crisis 3. 11 / Intruder has publicized data loss via online or mainstream media.

  • Crisis 2. 12 / Data loss prompts government or regulatory investigation with fines or other legal consequences.

  • Crisis 1. 13 / Data loss results in physical harm or loss of life.


I thought about these situations because of the latest Crisis 3, now affecting T-Mobile, as posted to Full-disclosure yesterday:

From: pwnmobile_at_Safe-mail.net
Date: Sat, 6 Jun 2009 15:18:06 -0400

Hello world,

The U.S. T-Mobile network predominately uses the GSM/GPRS/EDGE 1900 MHz frequency-band, making it the largest 1900 MHz network in the United States. Service is available in 98 of the 100 largest markets and 268 million potential customers.

Like Checkpoint[,] Tmobile [sic] has been owned for some time. We have everything, their databases, confidental documents, scripts and programs from their servers, financial documents up to 2009.

We already contacted with their competitors and they didn't show interest in buying their data -probably because the mails got to the wrong people- so now we are offering them for the highest bidder.

Please only serious offers, don't waste our time.

Contact: pwnmobile_at_safe-mail.net

Name Type Team Application Name ApplicationID Application Operating System IP Address Facility Blank Blank Blank Tier 1 Apps Tier 2 Apps ? Prod
protun03 Prod IHAP Caller Tunes 64 CallerTunes 10.1.16.185 HP-UX 11.11 BOTHELL_7 #N/A 64 1
protun04 Prod IHAP Caller Tunes 64 CallerTunes 10.1.16.186 HP-UX 11.11 BOTHELL_7 #N/A 64 1
protun05 Prod IHAP Caller Tunes 64 CallerTunes 10.1.16.187 HP-UX 11.11 BOTHELL_7 #N/A 64 1
protun06 Prod IHAP Caller Tunes 64 CallerTunes 10.1.16.188 HP-UX 11.11 BOTHELL_7 #N/A 64 1
...edited out 505 more server entries...
proxfr03 Prod Infra Connect Direct 106 Connect Direct 10.133.33.130 HP-UX 11.11 NEXUS #N/A #N/A 1
proxfr04 Prod Infra Connect Direct 106 Connect Direct 10.133.65.37 HP-UX 11.23 NEXUS #N/A #N/A 1
Talk about monetizing an intrusion. Can you imagine your company's data posted to a public forum like this?

This sort of incident is becoming more common. Remember the 8 million Virginian patient records from April?

ATTENTION VIRGINIA

I have your shit! In *my* possession, right now, are 8,257,378 patient records and a total of 35,548,087 prescriptions. Also, I made an encrypted backup and deleted the original. Unfortunately for Virginia, their backups seem to have gone missing, too. Uhoh :(

For $10 million, I will gladly send along the password. You have 7 days to decide. If by the end of 7 days, you decide not to pony up, I'll go ahead and put this baby out on the market and accept the highest bid. Now I don't know what all this shit is worth or who would pay for it, but I'm bettin' someone will. Hell, if I can't move the prescription data at the very least I can find a buyer for the personal data (name,age,address,social security #, driver's license #).
...truncated...

Something similar happened to Express Scripts last year.

If this isn't enough to convince management that every active remote command and control channel presents clear and present danger to the enterprise, I don't know what is. All of these incidents started with an intruder gaining access to at least one system. If the organization doesn't take these incidents seriously, the next step could be public humiliation. You might say "the Feds will grab these guys." True, but what is the cost to the reputation of the victim organization?

Richard Bejtlich is teaching new classes in Las Vegas in 2009. Regular Las Vegas registration ends 1 July.

Comments

Anonymous said…
# Crisis 1. 13 / Data loss results in physical harm or loss of life

While loss of data could certainly hurt a patient or patients, for example drug interactions could be missed or surgery performed on the wrong location. It's the data integrity portion of this equation that really scares me (and not just for health care).

Some of these intruders have been inside the systems longer than the administrators have been employed and certainly longer than our ability to detect the initial set of "anomalous" activity.

I agree these systems must be looked at, immediately and with a much greater scrutiny. If we don't know what data has left a compromised machine, we must assume everything.

Just like poker - if you don't know who the "sucker" is at the table, it's you.
12:15 AM
Anonymous said…
Is there a official/formal method to handle this ( other than payiing the ramsom), if so what is it ? is it involving some group in FEDS ?. If there is no official method what do you think is the best way to handle this kind of a situation ?
6:08 AM
Tome said…
Can't you just make up a list like this? Anyone dealing with any sort of corporate IT infrastructure planning, application architecture etc., can come up with a list like this. Then add some IP addresses and some scary cryptic stuff to it.
9:11 AM
Tyler said…
I might actually amend Crisis 3 to be "Intruder has publicized data last." IMO, if an intruder begins contacting your customers directly, that is just as harmful as them contacting the media.
9:15 AM
Anonymous said…
Any idea what the brief reference to Checkpoint being owned means? I saw this on the original post over the weekend and haven't seen any comments on it.
10:28 AM
Unknown said…
That reminds me, whatever happened with that Virginia PMP hack? I see the site is still down...
11:17 AM
Richard Bejtlich said…
I got my notification this week. :(
1:05 PM
Post a Comment

Popular posts from this blog

Zeek in Action Videos

Image
This is a quick note to point blog readers to my Zeek in Action YouTube video series for the Zeek network security monitoring project .  Each video addresses a topic that I think might be of interest to people trying to understand their network using Zeek and adjacent tools and approaches, like Suricata, Wireshark, and so on.  I am especially pleased with Video 6 on monitoring wireless networks . It took me several weeks to research material for this video. I had to buy new hardware and experiment with a Linux distro that I had not used before -- Parrot .  Please like and subscribe, and let me know if there is a topic you think might make a good video.
Read more

MITRE ATT&CK Tactics Are Not Tactics

Image
Just what are "tactics"? Introduction MITRE ATT&CK  is a great resource, but something about it has bothered me since I first heard about it several years ago. It's a minor point, but I wanted to document it in case it confuses anyone else. The MITRE ATT&CK Design and Philosophy document from March 2020 says the following: At a high-level, ATT&CK is a behavioral model that consists of the following core components: • Tactics, denoting short-term, tactical adversary goals during an attack; • Techniques, describing the means by which adversaries achieve tactical goals; • Sub-techniques, describing more specific means by which adversaries achieve tactical goals at a lower level than techniques; and • Documented adversary usage of techniques, their procedures, and other metadata. My concern is with MITRE's definition of "tactics" as "short-term, tactical adversary goals during an attack," which is oddly recursive. The key word in the tacti...
Read more

New Book! The Best of TaoSecurity Blog, Volume 4

Image
  I've completed the TaoSecurity Blog book series . The new book is  The Best of TaoSecurity Blog, Volume 4: Beyond the Blog with Articles, Testimony, and Scholarship .  It's available now for Kindle , and I'm working on the print edition.  I'm running a 50% off promo on Volumes 1-3 on Kindle through midnight 20 April. Take advantage before the prices go back up. I described the new title thus: Go beyond TaoSecurity Blog with this new volume from author Richard Bejtlich. In the first three volumes of the series, Mr. Bejtlich selected and republished the very best entries from 18 years of writing and over 18 million blog views, along with commentaries and additional material.  In this title, Mr. Bejtlich collects material that has not been published elsewhere, including articles that are no longer available or are stored in assorted digital or physical archives. Volume 4 offers early white papers that Mr. Bejtlich wrote as a network defender, either for technica...
Read more