Evaluating the Cybersecurity Controls of Capital One Company
Introduction
Capital one company experienced an attack that caused data breach and affected approximately 100 million people in the United States and about 6 million people in Canada. The attack managed to enter the organization’s systems undetected and had its requests for data accepted. This impact created a lot of mistrust among the organization’s customers who had much of their data exposed. The data breach would remain contained in time if the organization had a robust integrated system for uniting the actions of the administrative, technical, and physical cybersecurity measures to ensure that they conduct a wholesome detection, prevention, and investigation.
Evaluating the Administrative, Technical, and Physical Cybersecurity Controls of Capital One Company.
The cyberattack was allegedly conducted by a former Amazon employee using a technique that perhaps was an insider attack. The capital one company used security capabilities supported by Amazon organization that gave the adversary the channel to use access authority she had from Amazon. She used methods of cyberattack that are understood for years, but the organizations would be victims of processes they knew. Investigation illustrated that the attack happened from a misconfigured open-source Web Application Firewall (WAF) that capital one obtained as a cloud service with Amazon Web Services.
The cybersecurity system is commonly known as ‘ModSecurity’ and would protect the web-based applications from various groups of vulnerabilities. Attackers would probably deploy attack programs to compromise the security of web-servers. The intruder tricked the misconfigured WAF to allow requests to extract data and read the contents of files. The technology used to conduct the attack is called Server-Side Request Forgery (SSRF) that involves the tricking of a server to run prohibited commands like talking to the metadata service.
The administrative cybersecurity department would contribute to the prevention of the attack by demanding for cybersecurity operation reports that would help them gauge the level of security of their systems. They would, however, be guided by an Information Technology expert who would be part of the executive. The technical department illustrated the major state of vulnerability by operating with a misconfigured security system. Access to resources or data is controlled by the access policy defined by an administrator (Ullah et al., 2018). The open-source Web Application Firewall had a misconfiguration that allowed the attacker to relay requests and receive positive feedback from the metadata service.
The technical department would not manage to protect the systems against the serious threat of SSRF attacks. Detecting such attacks is difficult, and the technical team would identify the possible loopholes where they would occur and monitor their effectiveness frequently. They became victims of one of the most serious vulnerabilities facing organizations that use public clouds. Although the attack is hard to prevent, the organization’s technical team would identify the available weaknesses and advise the company appropriately on the protection methods given that the Amazon Web Services (AWF) does not have mitigation frameworks built to prevent it. The organization would find ways to research the problem and allocate resources to its IT department to find solutions to the known cybersecurity threats. Several researchers have contributed to the knowledge of cyberattack taxonomy and classification to help users become aware of cyber threats/risks associated with online activities (Shabut, Lwin, & Hossain, 2016). The operations supported by AWS, however, are quality enough to safeguard the organizations against intrusions.
References
https://krebsonsecurity.com/2019/08/what-we-can-learn-from-the-capital-one-hack/
Shabut, A. M., Lwin, K. T., & Hossain, M. A. (2016, December). Cyber attacks, countermeasures,
and protection schemes—A state of the art survey. In 2016 10th International Conference on Software, Knowledge, Information Management & Applications (SKIMA) (pp. 37-44). IEEE.
Ullah, F., Edwards, M., Ramdhany, R., Chitchyan, R., Babar, M. A., & Rashid, A. (2018). Data
exfiltration: A review of external attack vectors and countermeasures. Journal of Network and Computer Applications, 101, 18-54.