Group assingment
- 1. Case Study: “The Worm – Episode 1” GROUP ASSINGMENT Group Members • Tanushini Bandara – MS18908084 • Jeewanthi Fernando - MS18901290 1
- 2. Contents 10/19/2020Case Study: “The Worm – Episode 1” 2
- 3. Main incident and motivation. • The Government Department had an Application Server running an extremely Critical Application, which processed hundreds of requests a day. • We were informed that the Critical Application had become non-operational a few days earlier, and that a large number of service recipients had begun to queue outside the Office as a result. 10/19/2020Case Study: “The Worm – Episode 1” 3
- 4. • The IT team of the Department had identified the situation several days earlier and had attempted to resolve the issue using internal resources. • As part of their response, they had used a virus removal tool on the Application Server to remove files which the Anti Virus software showed as being infected by a Virus, but the problem persisted. • The situation had continued to deteriorate, and the senior management had decided to ask for external assistance. 10/19/2020Case Study: “The Worm – Episode 1” 4
- 5. How they identified the real attacker ? • They initially collected some basic information over the phone and via E-mail from the official who contacted us to establish a background for the affected Department, so as to establish contacts and escalation and reporting points within the Department. 10/19/2020Case Study: “The Worm – Episode 1” 5
- 6. Other reasons • The Department’s network was not protected with up-to- date Antivirus software. • There was no documented Security Policy in place governing such security related procedures and actions. • Users were accessing the Application Server system using a common password. 10/19/2020Case Study: “The Worm – Episode 1” 6
- 7. The methods they used to carry out the attack • Verify that this was indeed an incident. • Initially collected some basic information over the phone and via E-mail • Ask four critical questions. • Gather there are own information's from the victim site 10/19/2020Case Study: “The Worm – Episode 1” 7
- 8. Steps they have taken to unmask the real attacker 8 • The presence of the CME-24 was detected on the Application Server, by the Department’s IT team, under the alias W32.Blackmal.E. • Gather there are own information from the victim site. Case Study: “The Worm – Episode 1” 10/19/2020
- 9. Steps they have taken to prove the real attacker's identity • Most of the client machines had detected a virus infection in the Shared folder of the Application Server. • Analysis of the gathered information began to give us a clear picture of the Department network setup, and the potential weaknesses that may have led to the incident. 10/19/2020Case Study: “The Worm – Episode 1” 9
- 10. The best security practices they can take to avoid future attacks 10 • Ensured that Anti Virus & Operating System software were regularly updated. • Access to critical systems was restricted using a strong password policy. • Clear audit trails were maintained using system access logs. Case Study: “The Worm – Episode 1” 10/19/2020
- 11. Thank You…. 10/19/2020Case Study: “The Worm – Episode 1” 11