Major Data Breaches Research Articles

Modeling self-propagating malware with epidemiological models

Self-propagating malware (SPM) is responsible for large financial losses and major data breaches with devastating social impacts that cannot be understated. Well-known campaigns such as WannaCry and Colonial Pipeline have been able to propagate rapidly on the Internet and cause widespread service disruptions. To date, the propagation behavior of SPM is still not well understood. As result, our ability to defend against these cyber threats is still limited. Here, we address this gap by performing a comprehensive analysis of a newly proposed epidemiological-inspired model for SPM propagation, the Susceptible-Infected-Infected Dormant-Recovered (SIIDR) model. We perform a theoretical analysis of the SIIDR model by deriving its basic reproduction number and studying the stability of its disease-free equilibrium points in a homogeneous mixed system. We also characterize the SIIDR model on arbitrary graphs and discuss the conditions for stability of disease-free equilibrium points. We obtain access to 15 WannaCry attack traces generated under various conditions, derive the model’s transition rates, and show that SIIDR fits the real data well. We find that the SIIDR model outperforms more established compartmental models from epidemiology, such as SI, SIS, and SIR, at modeling SPM propagation.

Cybersecurity Breach at a Big 4 Accounting Firm: Effects on Auditor Reputation

ABSTRACT Public company investors rely on the Big 4 audit firms to provide assurance over internal controls and financial reporting. What, then, would happen if one of these very assurance providers suffered its own cybersecurity breach? We examine such an event in the major data breach of Deloitte in 2017. Using U.S. data from 2014 to 2019, we find Deloitte suffered significant reputational damage postbreach. Specifically, audit clients and existing shareholders became less likely to approve of Deloitte as the company’s auditor. Deloitte also charged lower audit fees after the incident. Furthermore, Deloitte’s audit clients suffered significant negative market reactions postbreach. Our results suggest pervasive implications of cyberattacks on auditor reputation and support recent congressional efforts to expand regulation in this area.

Cyber Kill Chain Analysis of Five Major US Data Breaches

Data breaches are a major concern for both US and global corporations. With more companies allowing their employees to be working remote, providing them a secure work environment has been a priority for employers. The Interpol 2020 report on cyber breaches mentions that the number of cyber-attacks has multiplied in the last year. The IBM Data Breach Report of 2021 notes that data breach costs rose from USD 3.86 million to USD 4.24 million, while the average cost was USD 1.07 Mil higher in breaches where remote work was a factor in causing the breach. Given this environment of increased cyber breaches, it is important to learn from previous major data breaches to understand the root cause which led to the compromise of information security and the steps which could have effectively prevented the same. This paper evaluates five major data breaches in US history using Lockheed's Cyber Kill Chain Analysis, since the details of these breaches have never been documented for research and also proposes an eight-step cyber-attack prevention plan.

Privacy Concerns, Economic Benefits, and Consumer Decisions: A Multi-Period Panel Study of Consumer Choices in the Automobile Insurance Industry

To examine the relationship between privacy concerns and consumer choices, we develop a finite time-horizon dynamic structural model to study consumers’ adoption and use of Usage-Based Insurance (UBI). UBI enables auto insurers to collect individual-level driving data, provide feedback on driving performance, and offer individually targeted prices. Using detailed information on insurance premiums, adoption, retention decisions, and driving behavior (as measured by sensor data), we estimate the costs of using UBI including the privacy cost. During our study, the company (along with most competitors) announced an enhancement to privacy protection (limiting usage of location-based data); subsequently, there was a widely reported external data breach at a major, unrelated retailer. Our main empirical results indicate that (1) both initial and ongoing costs play crucial roles in customers’ adoption and dropout decisions; (2) the enhancement in privacy policy reduces the adoption cost and is associated with higher UBI adoption; and (3) despite being an external event, the major data breach is associated with a decrease in retention rates among customers currently being monitored. Sensitivity to these events varies by gender. These results are consistent with the view that consumers trade-off privacy costs for economic benefits.

Leadership in the cyber warfare era: Formulating a data breach reporting and management strategy

This paper focuses on one of the fundamental requirements of the General Data Protection Regulation (GDPR), namely the duty to inform data protection regulators and users promptly when there has been breach of user data. It notes that many corporate leaders fear this requirement, which is generally viewed as an unnecessary expense on the organisation. It argues, however, that responsible leaders must embrace this requirement and view it not as a threat but an opportunity to continuously improve their systems. It posits that responsible leaders must not fear this, whether they are governed by the GDPR or not. The paper highlights, with some examples, the major data breaches that have compromised user information in arguing that while investment in robust end-to-end security systems is imperative, it cannot guarantee against data breach due to the increasing sophistication of both state and non-state hackers. It analyses some reasons why many leaders often try to conceal data breach and concludes by proffering some advice, backed by practical examples of how responsible leadership can formulate novel and holistic data breach reporting and management strategies that go beyond the traditional crisis management and continuity models.

Threats and Major Data Breaches: Securing Third-Party Vendors

The emerging trend of increasing numbers of third-party data breaches and publicly exposed data has deep impact on consumer trust. These breaches affect multiple industries and government agencies including online retailer Target Corporation, Marriott Corporation hotel chain, and the United States Office of Personnel Management which have all been breached by cybercriminals due to inadequate security or the lack of secure connections with their third-party vendors. This paper provides an overview of three major third-party breaches resulting in millions of exposed records and the impact of those breaches, followed by recommendations to reduce the risk of third-party data breaches.

User Compensation as a Data Breach Recovery Action: An Investigation of the Sony PlayStation Network Breach

Drawing on expectation confirmation research, we develop hypotheses regarding the effect of compensation on key customer outcomes following a major data breach and consequent service recovery effor...

How data breaches lead to fraud

The past few years have been particularly eventful and 2015 will be remembered for many momentous milestones. Those of us involved in security and fighting fraud online will remember it as big year for major data breaches. A report carried out by PwC examining UK data breaches showed that not only had there been rise in 2015 but that the scale and cost of these breaches had doubled.1 The report concluded that data breaches, for large business, are a near certainty.Many people will remember 2015 as year of major data breaches. It wasn't just the sensitivity of the information but the variety of sources from which customer's data was compromised.These breaches happen because the data stolen is valuable. And in many cases the stolen data is considered valuable because it can be used to defraud businesses. But if organisations get smart and get prepared for fraud, this data won't be as valuable, explains Don Bush of Kount.

Characterization of a new subset of CD8+HLA-DR+ T cells in human decidua

Connecting the dots is a symbolic way of stating we want to discuss all the topics within the preceding chapters by interweaving other related topics to show the value threat forecasting has for your organization. This chapter is broken into five main sections ranging from the comparing and contrasting of historical threat reporting and threat forecasting, to real-world examples where threat forecasting played a role or could have played a role in some of the major data breaches in recent time.The first section discusses historical threat reporting and its relationship to threat forecasting. When discussing this topic with fellow colleagues in the information security industry, there was an automatic assumption that we no longer believe this is of any value. The opposite is in fact true. Historical threat reporting provides great value to organizations around the world, and these types of reports are available from security product vendors to security intelligence companies. There are several pitfalls associated with historical threat reports, however these are overcome when applying threat forecasting within your organization.The next section dives into the state of the security industry by discussing the types of threats security products deal with as well as analyzing data from a third party, independent security testing lab. The types of threats security products need to deal with can be broken into three types. These are threats completely known to the security product, threats detected partially by the security product and threats completely unknown to the security product. The final type is where security products are the weakest and this is where threat intelligence combined with threat forecasting can help improve the gaps in your security coverage thus limiting exposure to your threat landscape. These unknown threats are best highlighted by the data within the study carried out by the cited independent testing lab, as they show, historically, that security products have had security efficacy issues.Finally, we will outline how you can begin to apply threat forecasting techniques within your organization. We will give you a three-phased approach to entering threat forecasting to help lower the barrier to entry and make this new technique more accessible. Phase 1 focuses on research into threat intelligence feeds and improvements in your organization’s existing security practices. Phase 2 introduces the creation of knowledge elements and helps you to begin threat modeling (and thus begin threat forecasting) using your data and, eventually, data from at least one threat intelligence feed. In the third and final phase you jump in with both feet and begin contributing to the threat intelligence community. Knowledge is power and by sharing knowledge elements you are enabling the global threat intelligence community through more actionable intelligence, as they are enabling your organization via your subscription to the feeds you are accessing. Successful implementation of threat forecasting techniques, powered by big data, will give you the data you need to better understand your organization’s threat landscape and give you actionable intelligence so that your organization can help prevent the next major data breach.This chapter is a call to action to begin applying the techniques within this book to improve your organization’s security practices and procedures and begin threat forecasting.