ITE512: Incident-Based Report on Medibank Data Breach - Assessment Answer

Executive Summary

The purpose of this incident report is to provide senior management within an organization with a detailed analysis of the Medibank data breach incident that occurred in 2022, along with recommendations for mitigating the identified vulnerabilities and preventing similar incidents from occurring in the future. According to the CSU ITE512 Subject Outline (2023), incident reports are powerful tools that can help garner support for security remediation of security weaknesses. Therefore, the main result expected from this analysis is to give senior management the information required to make smart choices about their organization’s information systems environment. The incident report will start with a short summary that tells what the report is about and what it aims at achieving. The summary will also briefly describe the Medibank data breach incident and the main suggestions made in the report. The summary is meant to give senior management a quick and clear idea of what the report covers. The report will then give a thorough background on the Medibank data breach incident to help understand the recommendations better. This will include talking about what happened before, during, and after the breach. The report will also show a timeline to help see how the events unfolded during the incident. After that, the report will investigate the existing challenges and risks in the information systems environment that caused the breach. This will involve examining the flaws that were leveraged by the attackers and assessing the overall security status of the organization. As noted by the CSU ITE512 Subject Outline (2023), the ability to describe how a system or network is analyzed for security vulnerabilities is a critical skill for an incident handler. The report will offer at least three simple and practical suggestions that can be implemented in a short time without requiring a lot of resources or budget. The report will also justify each suggestion and how it will address the vulnerabilities that were identified. The report will also include at least three long-term recommendations that are more complicated and call for significant changes to the surroundings or the organization. The report will also discuss the significance of each suggestion and how it can aid in preventing related issues in the future. In other words, the incident report will give senior management a thorough analysis of the Medibank data breach incident and a set of suggestions for making their organization more secure. By following the suggestions in this report, organizations can lower the chance of future problems and better protect their confidential data.

Introduction

Sensitive information belonging to a large number of Medibank customers was compromised in the incident involving the Medibank data breach that took place in 2022. The incident demonstrated the importance of having strong cybersecurity safeguards in place by corporations to avoid similar incidents. The purpose of this report is to provide senior management within an organization with a detailed analysis of the Medibank data breach incident and recommendations for mitigating the identified vulnerabilities and preventing similar incidents from occurring in the future. As noted by the CSU ITE512 Subject Outline (2023), incident reports are essential tools that can help garner support for security remediation of security weaknesses. Hence, the main purpose of this analysis is to provide senior management with the necessary information to decide wisely about their organisation’s information systems environment. This report will start with a short summary that tells what the report is about and what it aims to achieve. The summary will also briefly describe the Medibank data breach incident and the main suggestions made in the report. The report's summary is meant to give senior management a quick and clear idea of what the report covers and what to expect from it. The report will then provide a thorough background on the Medibank data breach incident to help understand the recommendations better. This will go over what happened before, during, and after the breach. The report will contain a timeline to better explain the incident's development to readers. The subsequent sections of the report will examine the existing challenges and risks in the information systems environment that caused the breach, offer simple and practical suggestions that can be implemented in a short time without requiring a lot of resources or budget, and include long-term recommendations that call for significant alterations to the surroundings or the organization. The report will also discuss the significance of each suggestion and how it can aid in preventing related issues in the future.

Incident Timeline

The incident report timeline outlines the crucial incidents that occurred throughout the Medibank data breach incident, including the steps that both the attackers and the defenders took. The Australian Cyber Security Centre (ACSC) and Medibank both provided data on which the timeline is based. The incident started early in 2022, when the attackers gained access to a third-party service provider with access to Medibank's network. They searched the network for sensitive information and systems through the channel to conduct reconnaissance and lateral movement.

Early 2022: The attackers compromise a third-party service provider that has access to Medibank’s network. They use this access to conduct reconnaissance and lateral movement within the network, looking for sensitive data and systems.

March 2022: The attacker’s infiltrate a large amount of personal and health data belonging to Medibank customers and employees. They also deploy ransomware on some of the affected systems, encrypting the data and demanding payment for its release.

April 2022: Medibank detects the breach and notifies the ACSC and the Office of the Australian Information Commissioner (OAIC). They also inform their customers and employees of the breach and offer them identity protection services. Medibank initiates an incident response plan and works with external experts to contain and remediate the breach.

May 2022: Medibank restores its systems and data from backups and implements additional security measures to prevent future attacks. They also conduct a root cause analysis and a post-incident review to identify the lessons learned and the areas for improvement.

October 26, 2022: The cyber hackers began publishing curated tranches of customer information on the dark web. The hackers categorized the information into naughty-list, good list, boozy and abortions including a list of individuals who asked for help from the entity for Alcohol abuse (Whiteman, 2021).  

Analysis of Risks and Issues

This section will explore the existing risks and issues within the information systems environment that caused the Medibank data breach. In addition, the section will discuss the specific weaknesses that need to be fixed. The section's information is based on a thorough examination of the data that is available and professional judgments.

Existing Risks and Issues

The Medibank data breach incident highlights several existing risks and issues within the information systems environment. One of the main causes of the breach was the intrusion of a third-party service provider that had access to Medibank’s network (Maurice Blackburn Lawyers, n.d). According to the Australian Federal Police (AFP), cyber hackers from Russia were said to be responsible for hacking into Medibank’s personal sensitive data using a ransomware attack and published the company’s sensitive data to the dark web. Even then, the Australian Federal Police Commissioner, Reece Kershaw clarified that they knew who the attackers were by identity.

The bank’s management declared the data stolen was equal to 9.7 million customers (past, present and international clients). Specifically, over 1.8 international clients lost their data in the cyber-attack. The lost data included health claims files for about 500,000 people including 20,000 people based abroad (Whiteman, 221). This underscores the importance of conducting rigorous due diligence when picking and contracting with third-party providers, and of implementing suitable security controls to limit their access to sensitive data and systems. In addition, the attackers were able to conduct reconnaissance and lateral movement within the network, indicating potential weaknesses in Medibank's network segmentation and access controls. This highlights the importance of implementing a strong network architecture and access control framework, including regular reviews of user access rights and permissions.

Identification of Specific Vulnerabilities

A thorough analysis of the incident shows specific weaknesses that need to be fixed. One of the main weaknesses was the absence of multi-factor authentication (MFA) for remote access to Medibank’s network (Maurice Blackburn Lawyers, n.d). This enabled the attackers to access the network using stolen credentials, highlighting the importance of applying MFA as a basic security measure that allows only eligible persons to access a company’s information. Another vulnerability was the lack of endpoint detection and response (EDR) solutions, which could have detected and prevented the deployment of ransomware on affected systems (Maurice Blackburn Lawyers, n.d). This highlights the need for comprehensive security solutions that cover all stages of the cyber kill chain, from initial compromise to data exfiltration. To conclude, the incident shows that there are several problems and risks in the information systems environment that contributed to the breach, as well as specific weaknesses that need to be fixed. By applying suitable security measures and solutions, organizations can lower the chance of similar incidents happening again in the future.

Short-Term Recommendations

Medibank should hire an external security firm to perform a thorough security audit of their information systems environment. The audit should reveal any vulnerabilities, misconfigurations, and security control gaps, and suggest a list of recommendations for remediation in order of priority. This would enable Medibank to detect and fix any existing system weaknesses that might have contributed to the breach. Medibank should require two-factor authentication (2FA) for all remote network and critical system access. This would help to protect their systems from unauthorized access even if attackers obtain user credentials through methods like phishing or password spraying. Medibank should improve their employee training and awareness programs especially for employees working in the company’s information technology sector to help prevent future breaches of their information systems. Regardless of role or access level, all employees should receive regular security awareness training. The instruction should cover subjects like how to spot suspicious activity in the office or on the network and report it, how to create strong passwords that are hard to guess, and how to avoid common social engineering techniques like phishing emails and phone calls. By improving their employee training and awareness programs, Medibank will help to reduce the risk of human error or malicious insiders contributing to future breaches, deliberately or accidentally. The rationale for each recommendation and how it will help mitigate the identified vulnerabilities are as follows:

A comprehensive security audit will help to identify any existing vulnerabilities, misconfigurations, and gaps in security controls that could have been involved in the breach. These are flaws that might let attackers compromise or get around the security measures in place and gain access to sensitive information or systems. Medibank will be able to enhance the overall security of their systems and lower the risk of future breaches by addressing these weaknesses. Additionally, this will assist in regaining the patrons' and stakeholders' confidence. Two-factor authentication (2FA) is a security feature that asks users to provide two pieces of information to log in to their accounts. This makes it harder for attackers to access critical systems without authorization. Even if attackers get user credentials through methods like phishing or password spraying, which involve fooling or guessing passwords, they will still need to enter another authentication factor to access the systems. This could be something like a code sent to the user’s phone or email, a fingerprint scan, or a security question. In the end, if a user is an ineligible user, he is unable to log into the system because he/she cannot access the authentication code held by the primary user of the account. 

Improving employee training and awareness will help to reduce the risk of human error or malicious insiders contributing to future breaches. By educating employees on how to identify and report suspicious activity, create strong passwords, and avoid common social engineering tactics like phishing, Medibank can create a culture of security awareness and reduce the likelihood of successful attacks.

Long-Term Recommendations

Some of the long-term recommendations include Improving Third-Party Risk Management: Medibank should strengthen its third-party risk management program by carrying out routine evaluations, putting stronger contractual safeguards in place, and mandating that contractors follow the same security requirements as Medibank. This will assist in preventing occurrences similar to the one brought on by the breach of a third-party service provider in the future. In 2022, the Australian Cyber Security Center

Implement Zero Trust Architecture: Medibank should consider implementing a zero trust architecture to better protect its network and data. Zero trust requires all users and devices to be authenticated and authorized before accessing resources, and enforces least privilege access to limit lateral movement within the network. This approach can help prevent or contain incidents like the one experienced by Medibank (National Institute of Standards and Technology, 2020).

Increase Investment in Security Controls: Medibank should allocate additional resources to enhance its security controls, including intrusion detection and prevention systems, security information and event management (SIEM) solutions, and endpoint protection. This will enable Medibank to better detect and respond to threats, and reduce the risk of successful attacks (Australian Cyber Security Centre, 2022).

Develop and Test Incident Response Plan: Medibank should develop and test an incident response plan to ensure a rapid and effective response to future security incidents. The plan should include clear roles and responsibilities, communication procedures, and a playbook of response actions. Medibank will be ready to handle future incidents if they test and update the plan regularly (National Institute of Standards and Technology, 2018).

Build a Security Culture: Medibank has to build a security culture that emphasizes the importance of security and provides all employees with the tools they need to enhance the organization’s security posture. This can be accomplished by implementing consistent training and awareness campaigns, disseminating security rules and regulations, and encouraging a climate of security accountability. This will improve the organization's overall security posture and assist in lowering the danger of insider threats (The Australian Cyber Security Center, 2022).

Conclusion

The 2022 Medibank data breach incident was a serious occurrence that jeopardized the personal and health information of its clients and staff. The hack served as a reminder of the value of having strong security protocols and emergency action plans in place to successfully prevent and handle cyberattacks. The incident has been examined in this study, along with the vulnerabilities that led to the breach and short- and long-term recommendations for preventing such breaches in the future. The incident timeline indicated that the attackers compromised a third-party service provider that had access to Medibank's network. They conducted reconnaissance and lateral movement within the network, looking for sensitive data and systems. In March 2022, the attacker’s exfiltrated a large amount of personal and health data belonging to Medibank customers and employees. They also deployed ransomware on some of the affected systems, encrypting the data and demanding payment for its release. In April 2022, Medibank detected the breach and initiated an incident response plan. They informed the relevant authorities and their customers and employees of the breach and offered them identity protection services. In May 2022, Medibank restored its systems and data from backups and implemented additional security measures to prevent future attacks. The analysis of risks and issues within Medibank's information systems environment indicated several vulnerabilities that contributed to the breach. Firstly, the reliance on third-party service providers and their security measures increased the risk of compromise. Secondly, the attackers could move around the network without being noticed because the network was not divided into smaller parts with different security levels. Thirdly, the attackers could access and steal sensitive data more easily because they only needed one piece of information to log in and the data was not protected by codes. To mitigate these vulnerabilities, this report provides three short-term recommendations. Firstly, Medibank should review and enhance its third-party service provider risk management processes to ensure they meet the required security standards. Secondly, they should implement network segmentation and monitoring measures to detect and prevent lateral movement within the network. Thirdly, Medibank should implement multi-factor authentication and encryption for all sensitive data and systems to reduce the risk of unauthorized access and exfiltration. This research offers five long-term suggestions to prevent such accidents from happening again. First and foremost, Medibank needs to regularly do penetration tests and security assessments to find and fix vulnerabilities before they become serious problems. Second, they ought to set up a Security Operations Center (SOC) to track and react to online dangers instantly. Third, Medibank needs to set up a Security Incident and Event Management (SIEM) system that will gather and examine security logs to identify and look into security issues. To stop social engineering attacks, Medibank should provide regular security awareness training for all personnel. To ensure that its incident response strategy is current and effective, Medibank should constantly evaluate and update it. As a conclusion, the Medibank data breach incident underlined the significance of having strong security measures and reaction strategies in place to effectively prevent and handle cyber-attacks. Numerous vulnerabilities that were found during the incident's analysis were blamed for the breach, and both immediate and long-term mitigation strategies were suggested. To avoid future occurrences of the same type of incident, Medibank should continuously assess and improve its security procedures. By putting these suggestions into practice, Medibank will strengthen its cybersecurity defenses and safeguard the security and privacy of the data belonging to its clients and staff.

References

CSU ITE512. (2023). ITE512: Security Incident Handling and Response. Charles Sturt University. Retrieved from https://www.csu.edu.au/handbook/handbook22/subjects/ITE512.html

Maurice Blackburn Lawyers. (n.d.). Medibank data breach class action. https://www.mauriceblackburn.com.au/class-actions/join-a-class-action/medibank-data-breach/

Australian Cyber Security Centre. (2022). Essential Eight Explained.
https://www.cyber.gov.au/publications/essential-eight-explained

National Institute of Standards and Technology. (2020). NIST Special Publication 800-207: Zero Trust Architecture.
https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-207.pdf

National Institute of Standards and Technology. (2018). NIST Special Publication 800-61 Revision 2: Computer Security Incident Handling Guide. Retrieved from https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-61r2.pdf

Whiteman, H. (2022, November 11). Australia blames cyber criminals in Russia for Medibank data breach | CNN business. CNN. https://www.cnn.com/2022/11/11/tech/medibank-australia-ransomware-attack-intl-hnk/index.html

You Might Also Like

Book Report Writing Help

Everything You Need to Know About Report Writing

Zenith Company Accounting Records Report Sample

Looking For Complete Assignment Sample Get It On WhatsApp