cyber attack case study examples

An official website of the United States government

Here’s how you know

Official websites use .gov A .gov website belongs to an official government organization in the United States.

Secure .gov websites use HTTPS A lock ( Lock A locked padlock ) or https:// means you’ve safely connected to the .gov website. Share sensitive information only on official, secure websites.

https://www.nist.gov/itl/smallbusinesscyber/cybersecurity-basics/case-study-series

Small Business Cybersecurity Corner

Small business cybersecurity case study series.

Ransomware, phishing, and ATM skimming are just a few very common and very damaging cybersecurity threats that Small Businesses need to watch out for. The following Case Studies were created by the National Cyber Security Alliance , with a grant from NIST, and should prove useful in stimulating ongoing learning for all business owners and their employees.

• Case 1: A Business Trip to South America Goes South Topic: ATM Skimming and Bank Fraud
• Case 2: A Construction Company Gets Hammered by a Keylogger Topic: Keylogging, Malware and Bank Fraud
• Case 3: Stolen Hospital Laptop Causes Heartburn Topic: Encryption and Business Security Standards
• Case 4: Hotel CEO Finds Unwanted Guests in Email Account Topic: Social Engineering and Phishing
• Case 5: A Dark Web of Issues for a Small Government Contractor Topic: Data Breach

• Talk to Expert
• Machine Identity Management
• October 20, 2023
• 9 minute read

7 Data Breach Examples Involving Human Error: Did Encryption Play a Role?

Despite an overall increase in security investment over the past decade, organizations are still plagued by data breaches. What’s more, we’re learning that many of the attacks that result in breaches misuse encryption in some way. (By comparison, just four percent of data breaches tracked by Gemalto’s Breach Level Index were “secure breaches” in that the use of encryption rendered stolen data useless). Sadly, it’s often human error that allows attackers access to encrypted channels and sensitive information. Sure, an attacker can leverage “gifts” such as zero-day vulnerabilities to break into a system, but in most cases, their success involves provoking or capitalizing on human error.

Human error has a well-documented history of causing data breaches. The 2022  Global Risks Report  released by the World Economic Forum, found that 95% of cybersecurity threats were in some way caused by human error. Meanwhile, the  2022 Data Breach Investigations Report  (DBIR) found that 82% of breaches involved the human element, including social attacks, errors and misuse. 

I think it’s interesting to look at case studies on how human error has contributed to a variety of data breaches, some more notorious than others. I’ll share the publicly known causes and impacts of these breaches. But I’d also like to highlight how the misuse of encryption often compounds the effects of human error in each type of breach.

SolarWinds: Anatomy of a Supersonic Supply Chain Attack

Data breach examples.

Here is a brief review of seven well-known data breaches caused by human error.

1. Equifax data breach—Expired certificates delayed breach detection

In the spring of 2017, the U.S. Department of Homeland Security's Computer Emergency Readiness Team (CERT) sent consumer credit reporting agency Equifax a notice about a vulnerability affecting certain versions of Apache Struts. According to former CEO Richard Smith, Equifax sent out a mass internal email about the flaw. The company’s IT security team should have used this email to fix the vulnerability, according to Smith’s testimony before the House Energy and Commerce Committee. But that didn’t happen. An automatic scan several days later also failed to identify the vulnerable version of Apache Struts. Plus, the device inspecting encrypted traffic was misconfigured because of a digital certificate that had expired ten months previously. Together, these oversights enabled a digital attacker to crack into Equifax’s system in mid-May and maintain their access until the end of July.

How encryption may become a factor in scenarios like this:  Once attackers have access to a network, they can install rogue or stolen certificates that allow them to hide exfiltration in encrypted traffic. Unless HTTPS inspection solutions are available and have full access to all keys and certificates, rogue certificates will remain undetected.

Impact:  The bad actor is thought to have exposed the personal information of 145 million people in the United States and more than 10 million UK citizens. In September 2018, the Information Commissioner’s Office  issued Equifax a fine of £500,000, the maximum penalty amount allowed under the Data Protection Act 1998, for failing to protect the personal information of up to 15 million UK citizens during the data breach.

2. Ericsson data breach—Mobile services go dark when the certificate expires

At the beginning of December 2018, a digital certificate used by Swedish multinational networking and telecommunications company Ericsson for its SGSN–MME (Serving GPRS Support Node—Mobility Management Entity) software expired. This incident caused outages for customers of various UK mobile carriers including O2, GiffGaff, and Lyca Mobile. As a result, a total of 32 million people in the United Kingdom alone lost access to 4G and SMS on 6 December. Beyond the United Kingdom, the outage reached 11 countries including Japan.

How encryption may become a factor in scenarios like this: Expired certificates do not only cause high-impact downtime; they can also leave critical systems without protection. If a security system experiences a certificate outage , cybercriminals can take advantage of the temporary lack of availability to bypass the safeguards.

Impact:  Ericsson restored the most affected customer services over the course of 6 December. The company also noted in a  blog post  that “The faulty software [for two versions of SGSN–MME] that has caused these issues is being decommissioned.”

3. LinkedIn data breach—Millions miss connections when the certificate expires

On 30 November, a certificate used by business social networking giant LinkedIn for its country subdomains expired. As reported by The Register , the incident did not affect www.linkedin.com, as LinkedIn uses a separate certificate for that particular domain. But the event, which involved a certificate issued by DigiCert SHA2 Secure Server CA, did invalidate us.linkedin.com along with the social media giant’s other subdomains. As a result, millions of users were unable to log into LinkedIn for several hours.

How encryption may become a factor in scenarios like this:  Whenever certificates expire, it may indicate that overall protection for machine identities is not up to par. Uncontrolled certificates are a prime target for cybercriminals who can use them to impersonate the company or gain illicit access.

Impact:  Later in the afternoon on 30 November, LinkedIn deployed a new certificate that helped bring its subdomains back online, thereby restoring all users’ access to the site.

4. Strathmore College data breach—Student records not adequately protected

In August 2018, it appears that an employee at Strathmore secondary college accidentally published more than 300 students’ records on the school’s intranet. These records included students' medical and mental health conditions such as Asperger’s, autism and ADHD. According to The Guardian , they also listed the exposed students’ medications along with any learning and behavioral difficulties. Overall, the records remained on Strathmore’s intranet for about a day. During that time, students and parents could have viewed and/or downloaded the information.

How encryption may become a factor in scenarios like this:  Encrypting access to student records makes it difficult for anyone who doesn’t have the proper credentials to access them. Any information left unprotected by encryption can be accessed by any cybercriminals who penetrate your perimeter.

Impact:  Strathmore’s principal said he had arranged professional development training for his staff to ensure they’re following best security practices. Meanwhile, Australia’s Department of Education announced that it would investigate what had caused the breach.

5. Veeam data breach—Customer records compromised by unprotected database

Near the end of August 2018, the Shodan search engine indexed an Amazon-hosted IP. Bob Diachenko, director of cyber risk research at Hacken.io, came across the IP on 5 September and quickly determined that the IP resolved to a database left unprotected by the lack of a password. The exposed database contained 200 gigabytes worth of data belonging to Veeam, a backup and data recovery company. Among that data were customer records including names, email addresses and some IP addresses.

How encryption may become a factor in scenarios like this:  Usernames and passwords are a relatively weak way of securing private access. Plus, if an organization does not maintain complete control of the private keys that govern access for internal systems, attackers have a better chance of gaining access.

Impact:  Within three hours of learning about the exposure, Veeam took the server offline. The company also reassured  TechCrunch  that it would “conduct a deeper investigation and… take appropriate actions based on our findings.”

6. Marine Corps data breach—Unencrypted email misfires

At the beginning of 2018, the Defense Travel System (DTS) of the United States Department of Defense (DOD) sent out an unencrypted email with an attachment to the wrong distribution list. The email, which the DTS sent within the usmc.mil official unclassified Marine domain but also to some civilian accounts, exposed the personal information of approximately 21,500 Marines, sailors and civilians. Per Marine Corp Times , the data included victims’ bank account numbers, truncated Social Security Numbers and emergency contact information.

How encryption may become a factor in scenarios like this:  If organizations are not using proper encryption, cybercriminals can insert themselves between two email servers to intercept and read the email. Sending private personal identity information over unencrypted channels essentially becomes an open invitation to cybercriminals.

Impact:  Upon learning of the breach, the Marines implemented email recall procedures to limit the number of email accounts that would receive the email. They also expressed their intention to implement additional security measures going forward.

7. Pennsylvania Department of Education data breach—Misassigned permissions

In February 2018, an employee in Pennsylvania’s Office of Administration committed an error that subsequently affected the state’s Teacher Information Management System (TIMS). As reported by PennLive , the incident temporarily enabled individuals who logged into TIMS to access personal information belonging to other users including teachers, school districts and Department of Education staff. In all, the security event is believed to have affected as many as 360,000 current and retired teachers.

How encryption may become a factor in scenarios like this: I f you do not know who’s accessing your organization’s information, then you’ll never know if it’s being accessed by cybercriminals. Encrypting access to vital information and carefully managing the identities of the machines that house it will help you control access.

Impact:  Pennsylvania’s Department of Education subsequently sent out notice letters informing victims that the incident might have exposed their personal information including their Social Security Numbers. It also offered a free one-year subscription for credit monitoring and identity protection services to affected individuals.

How machine identities are misused in a data breach

Human error can impact the success of even the strongest security strategies. As the above attacks illustrate, this can compromise the security of machine identities in numerous ways. Here are just a few:

• SSH keys grant privileged access to many internal systems. Often, these keys do not have expiration dates. And they are difficult to monitor. So, if SSH keys are revealed or compromised, attackers can use them to pivot freely within the network.
• Many phishing attacks leverage wildcard or rogue certificates to create fake sites that appear to be authentic. Such increased sophistication is often required to target higher-level executives.
• Using public-key encryption and authentication in the two-step verification makes it harder to gain malicious access. Easy access to SSH keys stored on computers or servers makes it easier for attackers to pivot laterally within the organization.
• An organization’s encryption is only as good as that of its entire vendor community. If organizations don’t control the keys and certificates that authenticate partner interactions, then they lose control of the encrypted tunnels that carry confidential information between companies.
• If organizations are not monitoring the use of all the keys and certificates that are used in encryption, then attackers can use rogue or stolen keys to create illegitimate encrypted tunnels. Organizations will not be able to detect these malicious tunnels because they appear to be the same as other legitimate tunnels into and out of the organization.

How to avoid data breaches

The best way to avoid a data breach to make sure your organization is using the most effective, up-to-date security tools and technologies. But even the best cybersecurity strategy is not complete unless it is accompanied by security awareness training for all who access and interact with sensitive corporate data. 

Because data breaches take many different forms and can happen in a multitude of ways, you need to be ever vigilant and employ a variety of strategies to protect your organization. These should include regular patching and updating of software, encrypting sensitive data, upgrading obsolete machines and enforcing strong credentials and multi-factor authentication.

In particular, a zero-trust architecture will give control and visibility over your users and machines using strategies such as least privileged access, policy enforcement, and strong encryption. Protecting your machine identities as part of your zero trust architecture will take you a long way toward breach prevention. Here are some machine identity management best practices that you should consider: 

• Locate all your machine identities.  Having a complete list of your machine identities and knowing where they’re all installed, who owns them, and how they’re used will give you the visibility you need to ensure that they are not being misused in an attack.
• Set up and enforce security policies.  To keep your machine identities safe, you need security policies that help you control every aspect of machine identities — issuance, use, ownership, management, security, and decommissioning. 
• Continuously gather machine identity intelligence.  Because the number of machines on your network is constantly changing, you need to maintain intelligence their identities, including the conditions of their use and their environment. 
• Automate the machine identity life cycle.  Automating he management of certificate requests, issuance, installation, renewals, and replacements helps you avoid error-prone manual actions that may leave your machine identities vulnerable to outage or breach. 
• Monitor for anomalous use.  After you’ve established a baseline of normal machine identity usage, you can start monitoring and flagging anomalous behavior, which can indicate a machine identity compromise.
• Set up notifications and alerts.  Finding and evaluating potential machine identity issues before they exposures is critical. This will help you take immediate action before attackers can take advantage of weak or unprotected machine identities.
• Remediate machine identities that don’t conform to policy.  When you discover machine identities that are noncompliant, you must quickly respond to any security incident that requires bulk remediation.

Training your users about the importance of machine identities will help reduce user errors. And advances in AI and RPA will also play a factor in the future. But for now, your best bet in preventing encryption from being misused in an attack on your organization is an automated machine identity management solution that allows you to maintain full visibility and control of your machine identities. Automation will help you reduce the inherent risks of human error as well as maintain greater control over how you enforce security policies for all encrypted communications. 

( This post has been updated. It was originally published Posted on October 15, 2020. ) 

Related posts

• Marriott Data Breach: 500 Million Reasons Why It’s Critical to Protect Machine Identities
• Breaches Are Like Spilled Milk: It Doesn’t Help to Cry
• The Major Data Breaches of 2017: Did Machine Identities Play a Factor?

2024 Machine Identity Management Summit

Help us forge a new era of cybersecurity

Looking to vulcanize your security with an identity-first strategy? Register today and save up to $100 with exclusive deals. But hurry, this sale won't last!

• Data Breach

• Hackers and cybercrime prevention

zephyr_p - stock.adobe.com

Top 10 cyber crime stories of 2021

Cyber crime hit new heights and drew more attention than ever in 2021. we look back at the biggest stories of the year.

• Alex Scroxton, Security Editor

The past 12 months have seen no shortage of cyber crime incidents as ransomware gangs ran amok, with security teams seemingly powerless to do much more than watch on in shock.

Some of the bigger cyber attacks of the year even had damaging real-world implications, which served to bring cyber crime mainstream attention, and to the top of national security agendas, particularly in the US and UK.

Meanwhile, the impact of the Covid-19 pandemic continued to loom large, with cyber criminals showing no shame as they attempted to disrupt organisations in the healthcare sector.

Here are Computer Weekly’s top 10 cyber crime stories of 2021:

1. Colonial Pipeline ransomware attack has grave consequences

Though it did not trouble the fuel supply at petrol stations in the UK, the DarkSide ransomware attack against Colonial Pipeline – the operator of the largest fuel pipeline in the US – in May 2021 was one of the most impactful cyber incidents of recent years. Indeed, it may have prompted concerted action against ransomware gangs at long last – time will tell.

As we reported in the immediate aftermath of the attack, the US government was forced to declare an emergency and the Department of Transportation temporarily relaxed regulations across most of the Mid-Atlantic and southern US, and Texas, that governed how long truckers were permitted to remain behind the wheel, to improve flexibility in the fuel supply chain.

2. REvil crew wants $70m in Kaseya ransomware heist

It was a 4 July summer blockbuster as  the REvil ransomware crew demanded a cumulative $70m ransom payment from over 1,000 businesses whose IT systems were locked after the gang compromised services provider Kaseya in a classic example of a supply chain hack. Such was the scale of the incident that the REvil group was forced to go into hiding for a time, subsequently emerging only to find that their infrastructure had been hacked back by law enforcement. One gang member is now facing extradition to the US to answer for his crimes; others are on the run.

3. BlackMatter gang ramps up attacks on multiple victims

Ransomware gangs come and go for many reasons, but one thing is certain, whether a rebrand of an existing group or a new player in the game, there will always be someone else ready to take their place. One of 2021’s more impactful emergent ransom crews is known as BlackMatter , and in September, we reported on a spate of attacks against multiple targets that prompted warnings from around the security community.

4. Irish health service hit by major ransomware attack

On the morning of 14 May, the Conti ransomware gang hit the headlines after they encrypted the systems of the Irish Health Service Executive in a callous and truly heartless cyber attack. The incident caused significant disruption to patient services across Ireland and prompted a large-scale response that even saw the army drafted in. Mercifully, there were no recorded fatalities as a direct result of the incident, but over six months on, the service has not fully recovered.

5. Stolen Pfizer/BioNTech Covid-19 vaccine data leaked

Cyber criminals also tried their best to disrupt the roll-out of the Covid-19 vaccine programme in Europe, when data relating to the Pfizer/BioNTech Covid-19 vaccine, which was stolen in December 2020 following a cyber attack against the European Medicines Agency, was leaked on the internet in January 2021 . The data dump included screenshots of emails, peer review information, and other documents including PDFs and PowerPoint presentations.

6. Police raids around world after investigators crack An0m cryptophone app in major hacking operation

In June, police in 16 countries launched multiple raids after intercepting the communications of organised criminal groups. The gangs had been sending messages on an encrypted communications network, unaware that it was being run by the FBI . This was only one of several similar raids in 2021, which, while successful at disrupting organised and cyber crime, have at the same time surfaced legitimate concerns over the ability of law enforcement to conduct surveillance, and the admissibility of the evidence they collected.

7. Retailer FatFace pays $2m ransom to Conti cyber criminals

In March, Computer Weekly broke the news that fashion retailer  FatFace had paid a $2m ransom to the Conti ransomware gang following a successful cyber attack on its systems that took place in January. The ransomware operators had initially demanded a ransom of $8m, approximately 213 bitcoin at the prevailing rate, but were successfully talked down during a protracted negotiation process.

8. Scammers accidentally reveal fake Amazon review data

Over the years, Computer Weekly has often covered data loss incidents at organisations that failed to secure their databases correctly, so it was gratifying in May to find that cyber criminals and fraudsters are bad at operational security too. This unfortunate scammer accidentally exposed more than 13 million records in an open ElasticSearch database and in doing so blew the lid on a massive fake review scam implicating hundreds of third-party Amazon sellers in unethical and illegal behaviour.

9. $50m ransomware demand on Acer is highest ever

Roy Castle and Cheryl Baker taught a generation of British schoolchildren that records are made to be broken, so perhaps members of the REvil ransomware gang also watched BBC1 after school when they were younger. Either way, the $50m ransom demand made against PC company Acer was – for a time – the highest ever made. Details of the record-breaking double-extortion attack emerged in March when the gang published Acer’s data to its leak site, but investigations by Computer Weekly’s sister titles LeMagIT and SearchSecurity were instrumental in uncovering and highlighting the ransomware demand.

10. Ransomware gangs seek people skills for negotiations.

Finally, in July 2021, we reported on how the increasing sophistication of the cyber criminal underground was being reflected in how ransomware operations put together their operations , seeking out specialist talent and skillsets. Indeed, researchers from Kela found that some gangs are coming to resemble corporations, with diversified roles and even outsourced negotiations with victims. Naturally, people skills are in high demand as gangs try to sweet-talk their victims into coughing up.

Read more on Hackers and cybercrime prevention

Analysts confirm return of REvil ransomware gang

What’s up with Conti and REvil, and should we be worrying?

Cyber pros: Don’t revel in REvil’s downfall just yet

Us seeks to extradite revil affiliate who attacked kaseya.

As U.S. states like Colorado pass their own AI laws, businesses will need to prepare compliance measures if they do business in ...

Digital transformation success requires cross-organizational alignment, actionable goals and top-notch project management. Here's...

President Joe Biden throws his support behind Microsoft to build an AI data center in Racine, Wis., as big tech companies invest ...

APIs are essential, but hackers find them attractive targets. A comprehensive API risk assessment strategy helps you identify ...

Threat actors are targeting vulnerable Progress Telerik Report Server systems just days after a proof of concept was published ...

The public sector took the brunt of ransomware in May, while another damaging attack against a healthcare company disrupted ...

SASE offers companies a compelling security strategy, but it takes time to ensure network teams have the visibility and ...

At Cisco Live 2024, leaders discussed how AI can support business objectives. Companies like CSL Behring and Room & Board ...

Cisco is integrating Splunk, AppDynamics and ThousandEyes to create a critical differentiator in the observability market. ...

A main focus of the Dell Technologies World 2024 conference was AI and how it impacts infrastructure environments. Dell ...

In this Q&A, Dell's Matt Baker lays out how its AI Factory is designed for faster AI adoption, why there are so many chatbots and...

An incredible amount of research must go into data center site selection. If the location does not fit company demands, the data ...

Any effective data quality process needs data profiling. Evaluate key criteria to select which of the top 10 data profiling tools...

The lakehouse specialist's latest purchase adds support for Apache Iceberg to its existing support for Delta Lake and is also a ...

AI models rely on data to function. Before implementing AI, make sure your data can support initiatives by evaluating its quality...

This browser is no longer supported.

Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.

Microsoft Incident Response ransomware case study

• 6 contributors

Human-operated ransomware continues to maintain its position as one of the most impactful cyberattack trends world-wide and is a significant threat that many organizations have faced in recent years. These attacks take advantage of network misconfigurations and thrive on an organization's weak interior security. Although these attacks pose a clear and present danger to organizations and their IT infrastructure and data, they are a preventable disaster .

The Microsoft Incident Response team (formerly DART/CRSP) responds to security compromises to help customers become cyber-resilient. Microsoft Incident Response provides onsite reactive incident response and remote proactive investigations. Microsoft Incident Response leverages Microsoft's strategic partnerships with security organizations around the world and internal Microsoft product groups to provide the most complete and thorough investigation possible.

This article describes how Microsoft Incident Response investigated a recent ransomware incident with details on the attack tactics and detection mechanisms.

See Part 1 and Part 2 of Microsoft Incident Response's guide to combatting human-operated ransomware for more information.

Microsoft Incident Response leverages incident response tools and tactics to identify threat actor behaviors for human operated ransomware. Public information regarding ransomware events focuses on the end impact, but rarely highlights the details of the operation and how threat actors were able to escalate their access undetected to discover, monetize, and extort.

Here are some common techniques that attackers use for ransomware attacks based on MITRE ATT&CK tactics .

Microsoft Incident Response used Microsoft Defender for Endpoint to track the attacker through the environment, create a story depicting the incident, and then eradicate the threat and remediate. Once deployed, Defender for Endpoint began detecting successful logons from a brute force attack. Upon discovering this, Microsoft Incident Response reviewed the security data and found several vulnerable Internet-facing devices using the Remote Desktop Protocol (RDP).

After initial access was gained, the threat actor used the Mimikatz credential harvesting tool to dump password hashes, scanned for credentials stored in plaintext, created backdoors with Sticky Key manipulation, and moved laterally throughout the network using remote desktop sessions.

For this case study, here is the highlighted path that the attacker took.

The following sections describe additional details based on the MITRE ATT&CK tactics and include examples of how the threat actor activities were detected with the Microsoft Defender portal.

Initial access

Ransomware campaigns use well-known vulnerabilities for their initial entry, typically using phishing emails or weaknesses in perimeter defense such as devices with the enabled Remote Desktop service exposed on the Internet.

For this incident, Microsoft Incident Response managed to locate a device that had TCP port 3389 for RDP exposed to the Internet. This allowed threat actors to perform a brute-force authentication attack and gain the initial foothold.

Defender for Endpoint used threat intelligence to determine that there were numerous sign-ins from known brute-force sources and displayed them in the Microsoft Defender portal. Here's an example.

Reconnaissance

Once the initial access was successful, environment enumeration and device discovery began. These activities allowed the threat actors to identify information about the organization's internal network and target critical systems such as domain controllers, backup servers, databases, and cloud resources. After the enumeration and device discovery, the threat actors performed similar activities to identify vulnerable user accounts, groups, permissions, and software.

The threat actor leveraged Advanced IP Scanner, an IP address scanning tool, to enumerate the IP addresses used in the environment and perform subsequent port scanning. By scanning for open ports, the threat actor discovered devices that were accessible from the initially compromised device.

This activity was detected in Defender for Endpoint and used as an indicator of compromise (IoC) for further investigation. Here's an example.

Credential theft

After gaining initial access, the threat actors performed credential harvesting using the Mimikatz password retrieval tool and by searching for files containing “password” on initially compromised systems. These actions enabled the threat actors to access additional systems with legitimate credentials. In many situations, threat actors use these accounts to create additional accounts to maintain persistence after the initial compromised accounts are identified and remediated.

Here's an example of the detected use of the Mimikatz in the Microsoft Defender portal.

Lateral movement

Movement across endpoints can vary between different organizations, but threat actors commonly use different varieties of remote management software that already exists on the device. By utilizing methods of remote access that the IT department commonly uses in their day-to-day activities, threat actors can fly under the radar for extended periods of time.

Using Microsoft Defender for Identity, Microsoft Incident Response was able to map out the path that the threat actor took between devices, displaying the accounts that were used and accessed. Here's an example.

Defense evasion

To avoid detection, the threat actors used defense evasion techniques to avoid identification and achieve their objectives throughout the attack cycle. These techniques include disabling or tampering with anti-virus products, uninstalling or disabling security products or features, modifying firewall rules, and using obfuscation techniques to hide the artifacts of an intrusion from security products and services.

The threat actor for this incident used PowerShell to disable real-time protection for Microsoft Defender on Windows 11 and Windows 10 devices and local networking tools to open TCP port 3389 and allow RDP connections. These changes decreased the chances of detection in an environment because they modified system services that detect and alert on malicious activity.

Defender for Endpoint, however, cannot be disabled from the local device and was able to detect this activity. Here's an example.

Persistence

Persistence techniques include actions by threat actors to maintain consistent access to systems after efforts are made by security staff to regain control of compromised systems.

The threat actors for this incident used the Sticky Keys hack because it allows for remote execution of a binary inside the Windows operating system without authentication. They then used this capability to launch a Command Prompt and perform further attacks.

Here's an example of the detection of the Sticky Keys hack in the Microsoft Defender portal.

Threat actors typically encrypt files using applications or features that already exist within the environment. The use of PsExec, Group Policy, and Microsoft Endpoint Configuration Management are methods of deployment that allow an actor to quickly reach endpoints and systems without disrupting normal operations.

The threat actor for this incident leveraged PsExec to remotely launch an interactive PowerShell Script from various remote shares. This attack method randomizes distribution points and makes remediation more difficult during the final phase of the ransomware attack.

Ransomware execution

Ransomware execution is one of the primary methods that a threat actor uses to monetize their attack. Regardless of the execution methodology, distinct ransomware frameworks tend to have a common behavioral pattern once deployed:

• Obfuscate threat actor actions
• Establish persistence
• Disable windows error recovery and automatic repair
• Stop a list of services
• Terminate a list of processes
• Delete shadow copies and backups
• Encrypt files, potentially specifying custom exclusions
• Create a ransomware note

Here's an example of a ransomware note.

Additional ransomware resources

Key information from Microsoft:

• The growing threat of ransomware , Microsoft On the Issues blog post on July 20, 2021
• Human-operated ransomware
• Rapidly protect against ransomware and extortion
• 2021 Microsoft Digital Defense Report (see pages 10-19)
• Ransomware: A pervasive and ongoing threat threat analytics report in the Microsoft Defender portal
• Microsoft Incident Response ransomware approach and best practices

Microsoft 365:

• Deploy ransomware protection for your Microsoft 365 tenant
• Maximize Ransomware Resiliency with Azure and Microsoft 365
• Recover from a ransomware attack
• Malware and ransomware protection
• Protect your Windows 10 PC from ransomware
• Handling ransomware in SharePoint Online
• Threat analytics reports for ransomware in the Microsoft Defender portal

Microsoft Defender XDR:

• Find ransomware with advanced hunting

Microsoft Defender for Cloud Apps:

• Create anomaly detection policies in Defender for Cloud Apps

Microsoft Azure:

• Azure Defenses for Ransomware Attack
• Backup and restore plan to protect against ransomware
• Help protect from ransomware with Microsoft Azure Backup (26 minute video)
• Recovering from systemic identity compromise
• Advanced multistage attack detection in Microsoft Sentinel
• Fusion Detection for Ransomware in Microsoft Sentinel

Microsoft Security team blog posts:

3 steps to prevent and recover from ransomware (September 2021)

A guide to combatting human-operated ransomware: Part 1 (September 2021)

Key steps on how Microsoft Incident Response conducts ransomware incident investigations.

A guide to combatting human-operated ransomware: Part 2 (September 2021)

Recommendations and best practices.

Becoming resilient by understanding cybersecurity risks: Part 4—navigating current threats (May 2021)

See the Ransomware section.

Human-operated ransomware attacks: A preventable disaster (March 2020)

Includes attack chain analyses of actual attacks.

Ransomware response—to pay or not to pay? (December 2019)

Norsk Hydro responds to ransomware attack with transparency (December 2019)

Was this page helpful?

Coming soon: Throughout 2024 we will be phasing out GitHub Issues as the feedback mechanism for content and replacing it with a new feedback system. For more information see: https://aka.ms/ContentUserFeedback .

Submit and view feedback for

Additional resources

Cyber Security Case Studies

Lead by example in cyber, search a sample of our high-quality, objective, peer-reviewed case studies.

In November 2017, the company's (new) CEO Dara Khosrowshahi disclosed a cyber attack suffered in October 2016 which breached the personal information of 57 million customers and drivers saying "none of this should have happened, and I will not make ex...

In July 2015, a cyber attacker group called Impact Team stole the controversial dating site's user database by identifying weaknesses in password encryption and used these to crack the bcrypt-hashed passwords to gain access. The attackers tried to...

In April 2018 the company disclosed a data breach affecting 30,000 current and former customers that lasted from January to March 2018. The breach was caused by a hacker gaining unauthorized access to an employee’s email account through a phishing sca...

In July 2019, the company announced one of the largest thefts of bank data in US history affecting more than 100 million credit card customers after an attacker exploited a specific configuration vulnerability in its digital infrastructure and alleged...

In April 2015, the company discovered the breach as part of a security review that found hackers had gained access to a database that members use to get access to the company's website and services. 1.1 million members had their names, birth dates...

• Next ›
• Last »

Let us do the analysis so you can make the decisions

Premier risk-driven analysis, high-quality structured cyber dataset, consulting & training services.

Cyber Case Study: UVM Health Network Ransomware Attack

by Kelli Young | Dec 6, 2021 | Case Study , Cyber Liability Insurance

In October 2020, the University of Vermont (UVM) Health Network—a six-hospital health care organization that serves over 1 million patients throughout Vermont and upstate New York—discovered that its systems had been compromised by cybercriminals in a ransomware attack. The UVM Health Network ransomware attack led to major disruptions across the organization’s infrastructure, shutting down critical technology and delaying patient care.

This attack—which ultimately stemmed from an employee error—resulted in significant recovery costs and reputational damages for UVM Health Network, emphasizing the severity of cyber incidents within the health care industry. There are various cybersecurity lessons that organizations can learn by reviewing the details of this incident, its impact and the mistakes UVM Health Network made along the way.

The Details of the UVM Health Network Ransomware Attack

At the beginning of October 2020, a UVM Health Network employee took their work laptop on vacation with them. During this vacation, the employee used the laptop to check their personal emails. One of these emails was from the employee’s local homeowners association. Although the email seemed legitimate, the homeowners association had recently been hacked by cybercriminals. As a result, the email was actually a phishing scam. By opening the email, the employee unknowingly allowed cybercriminals to launch malware on their work laptop. When the employee came back to work and connected their laptop to the UVM Health Network’s systems, the cybercriminals then utilized that malware to target the entire organization.

While the text file didn’t contain a specific ransom demand, UVM Health Network’s IT department was fairly confident that contacting the cybercriminals would only result in such a demand—a demand that the organization did not want to satisfy. After all, there was no guarantee that the cybercriminals would actually restore the organization’s systems and data after the ransom was paid. Therefore, instead of complying with the cybercriminals’ orders, the organization contacted the FBI for assistance. From there, UVM Health Network worked closely with the FBI to identify the source of the attack and resolve the incident. In the coming weeks, Vermont Gov. Phil Scott also deployed the state’s National Guard to further assist in the matter.

Fortunately, the organization confirmed that no sensitive data (e.g., patient records or employee information) was stolen or exposed during the attack. Rather, UVM Health Network’s existing cybersecurity measures allowed the organization to regain access to most of its data through safely stored back-up copies. Nevertheless, the attack still largely disrupted the organization’s operations for several weeks while it worked to fully recover its data, remove the malware (as well as any digital backdoors created by the malware) from all infected technology and rebuild its damaged infrastructure. During this time, hundreds of employees were unable to perform their job responsibilities due to the computer and phone systems remaining shut down. What’s worse, many patients faced delayed test results, experienced appointment cancellations and had to reschedule elective medical procedures while UVM Health Network recovered from the incident. In total, it took multiple months for the organization to totally restore its infrastructure.

The Impact of the UVM Health Network Ransomware Attack

UVM Health Network ransomware attack caused a range of consequences, including the following:

Recovery costs and lost revenue The organization incurred significant recovery expenses as a result of the attack. This includes costs related to UVM Health Network rebuilding 1,300 damaged servers, restoring 600 disabled applications, scanning and cleaning 5,000 malware-ridden computers, and repopulating its overall infrastructure with backed-up data. In addition, the organization lost a considerable amount of revenue in the time it took to recover from the incident—totaling nearly $1.5 million per day. As a whole, the attack is estimated to have cost UVM Health Network over $63 million . These costs greatly exceeded the organization’s existing cyber insurance protection, as it was only insured for $30 million.

Reputational damages Apart from recovery expenses, the organization encountered widespread scrutiny due to the attack. Specifically, UVM Health Network was criticized for allowing employees to access their personal emails on workplace devices—a flaw that essentially led to the incident. Although the organization’s existing cybersecurity measures effectively prevented the attack from resulting in a data breach, UVM Health Network was still scrutinized for its lengthy incident recovery process, especially considering that this process resulted in delayed patient care.

Delayed system updates Lastly, the attack forced the organization to modify its timeline for rolling out an updated electronic health record system. This system was intended to replace the organization’s current patchwork of health record applications and create a more integrated system to be utilized for both inpatient and outpatient care. While UVM Health Network had already implemented the first phase of this rollout in November 2019, the second and third phases were pushed back to November 2021 and April 2022, respectively.

Lessons Learned

There are several cybersecurity takeaways from the UVM Health Network ransomware attack. In particular, the incident showcased these key lessons:

Employee education can’t be ignored. Employees are often the first line of defense against cyberattacks. In fact, as many as 90% of such attacks stem from human error. This issue was certainly emphasized during UVM Health Network’s cyber incident. If the organization had educated its employees on safe email protocols and phishing detection measures, it’s possible that this attack could have been avoided altogether. As such, it’s crucial to share the following cybersecurity best practices with employees:

• Avoid opening or responding to emails from unfamiliar individuals or organizations. If an email claims to be from a trusted source, verify their identity by double-checking the address.
• Never click on suspicious links or pop-ups, whether they’re in an email or on a website. Don’t download attachments or software programs from unknown sources or locations.
• Utilize unique, complicated passwords for all workplace accounts. Never share credentials or other sensitive information online.
• Only browse safe and secure websites on workplace devices. Refrain from using these devices for answering personal emails or browsing the internet on topics unrelated to work.
• Contact a supervisor or the IT department if suspicious activity arises.

Effective secu rity software is a must. After the attack, UVM Health Network made it a priority to block employees’ access to their personal emails on all workplace devices, as well as equip this technology with more advanced security software. While this software may seem like an expensive investment, it’s worth it to minimize the impacts of potentially devastating cyber incidents. Software to consider includes network-monitoring systems, antivirus programs, firewalls, endpoint-detection products and patch-management tools. Also, it’s valuable to conduct routine penetration testing to determine whether this software possesses any security gaps. If such testing reveals any problems, these issues should be addressed immediately.

Cyber incident response plans make a difference. UVM Health Network took an extended period of time to recover from this incident, ultimately increasing disruption concerns, delaying patient care and compounding the overall costs of the attack. Such lengthy recovery issues highlight how essential it is to have an effective cyber incident response plan in place. This type of plan can help an organization establish timely response protocols for remaining operational and mitigating losses amid a cyber event. A successful incident response plan should outline potential cyberattack scenarios, methods for maintaining key functions during these scenarios and the individuals responsible for carrying out such functions. This plan should be routinely reviewed through different activities—such as tabletop exercises—to ensure effectiveness and identify ongoing vulnerabilities. Based on the results from these activities, the plan should be adjusted as needed.

Proper coverage can provide much-needed protection. Finally, this attack made it clear that no organization—not even a major health care organization—is immune to cyber-related losses. That’s why it’s crucial to ensure adequate protection against potential cyber incidents by securing proper coverage. Considering how expensive cyber events can be (especially ransomware attacks), it’s best to carefully select a policy limit that will provide sufficient protection amid a costly incident. Consult a trusted insurance professional when navigating these coverage decisions.

We are here to help.

If you’d like additional information and resources, we’re here to help you analyze your needs and make the right coverage decisions to protect your operations from unnecessary risk. You can download a free copy of our  eBook , or if you’re ready to make Cyber Liability Insurance a part of your insurance portfolio, Request a Proposal or download our Cyber & Data Breach Insurance Application  and we’ll get to work for you.

Recent Posts

• Live Well Work Well – June 2024
• CoverLink Insurance Helps IMPACT60 to Provide Life Changing Opportunities to Our Local Community with $8,500 Grant
• How to Choose an Independent Insurance Agent
• Cyber Solutions: Navigating the Cyber Insurance Claims Process
• Live Well Work Well – May 2024

Case Studies: Notable Breaches

Cyber attacks and data breaches are unfortunately common in modern times, and they often have serious consequences. In this article, we’ll look at three examples of successful breaches to learn what happened before, during, and after the attack. We’ll also discuss key takeaways and lessons from these events.

Breach 1: Uber

In late 2016, attackers used a password obtained in an unrelated data breach to gain access to an Uber engineer’s personal GitHub account. From this account, the attackers were able to access one of Uber’s internal repositories, which contained a private key used to access Uber’s datastores. These datastores contained unencrypted personal information for approximately 57 million Uber drivers and riders. The attackers downloaded copies of this private user information violating the information’s confidentiality. The attackers then contacted Uber, informed them that they had compromised Uber’s databases, and demanded a ransom to delete the stolen data.

Uber was contacted by the attackers on November 14th, 2016, and Uber chose to pay the ransom. Uber had the attackers sign non-disclosure agreements regarding the stolen information.

What Uber did not do, however, was disclose the breach. Uber was also under investigation at the time for a different breach that occurred in 2014. Uber didn’t disclose the breach until November 21, 2017, following the appointment of a new CEO. In addition to being highly unethical, Uber’s failure to disclose the breach was also illegal. In addition to the $100,000 ransom, Uber paid $148 million as part of the settlement.

Lessons learned

• Failing to disclose breaches is unethical and illegal. Prompt disclosure is crucial to maintaining the trust of customers and complying with the law.
• Mistakenly including keys or other sensitive data in source-control repositories is a common mistake with potentially serious repercussions. Administrative and technical controls should be put in place to prevent sensitive data from being included in repositories, even internal repositories.
• Allowing access to internal resources with personal, external accounts is a security risk. Internal resources should be accessed using work accounts with strong security policies.
• Don’t store private user information in an unencrypted format.

Breach 2: Target

In late November of 2013, attackers gained access to Target’s internal network using credentials stolen from a third-party vendor with network access. Improper network segmentation let the attackers gain access to Target’s point-of-sale (POS) system, which they installed malware onto. This malware stole the details of over 40 million credit cards used at Target’s stores, along with the personal information of over 70 million people. Target had antimalware software monitoring their system, but it was improperly monitored and configured. The software was not able to automatically remove the malware, and the alerts it raised went uninvestigated.

Target discovered the breach on December 12th, 2013, and quickly responded, working with federal and private investigators to conduct a forensic investigation and remove the malware. While the breach was disclosed to card processors by the 16th, it was not disclosed to the public until the 18th when Brian Krebs, a security researcher, broke the story. In the aftermath of the breach, Target invested 100 million dollars into improving its cybersecurity and paid out an additional 18.5 million dollars in settlement costs.

• Promptly responding to breaches is crucial to maintain both legal compliance, and professional image. While Target’s public disclosure was delayed, there can be valid investigative reasons to delay public disclosure.
• Proper configuration is a requirement for security systems to be effective.
• Conducting a proper investigation of security alerts is crucial to catching attacks before they get out of control. Improperly configured alerts, particularly high volumes of false alarms, can cause legitimate alerts to be ignored.
• High-value targets should be hardened against attack. Target’s POS terminals were not hardened against tampering, allowing the attackers to violate their integrity and install malware.

Breach 3: SolarWinds

In September of 2019, a group of hackers covertly gained access to SolarWinds, a company that develops enterprise IT and cybersecurity software. The attackers tested and deployed Sunspot, a piece of custom malware, targeting Orion, one of SolarWinds’ products. Sunspot secretly added a backdoor to Orion, which was then digitally signed by SolarWinds’ update system which made it appear legitimate and pushed to customers through software updates. The backdoor allowed the attackers to install additional malware, known as Teardrop, onto the networks of SolarWinds customers, causing a massive breach of confidentiality and integrity.

SolarWinds did not become aware of the attack until December of 2020 when FireEye, another cybersecurity company, discovered the backdoor while investigating how they themselves had been breached. In the ensuing investigation, it was determined that the attackers had used the backdoor to attack approximately 100 companies including Boeing and 9 federal agencies, including the United States Department of Defense and Justice Department. The attack has been publicly attributed to Russia by multiple United States government organizations, including the FBI and NSA. This attack is one of the largest and most serious cases of cyber-espionage in history.

• Organizations should know their threat landscape. Organizations that provide software, particularly to high-value targets such as Fortune 500 companies and government agencies, should consider themselves potential targets for APT groups.
• Supply chain attacks are a real and serious threat, and organizations should be aware that the tools they use could become compromised.
• Security needs to be proactive, in addition to reactive. Additional proactive security measures and investigation by SolarWinds might have caught the addition of malicious code to Orion sooner.

Cyberattacks and security breaches have become a semi-regular occurrence, but that doesn’t mean we should simply accept them as a fact of life. It’s important to analyze and understand how security has failed in the past in order to improve it for the future. Organizations have a responsibility to protect the confidentiality, integrity, and availability of data entrusted to them by implementing good security practices and responding promptly and ethically when a breach does happen.

Learn More on Codecademy

Cybersecurity for business, introduction to cybersecurity.

Type to search

Cybersecurity Case Studies and Real-World Examples

image courtesy pixabay.com

Table of Contents

In the ever-evolving landscape of cybersecurity, the battle between hackers and defenders continues to shape the digital domain. To understand the gravity of cybersecurity challenges, one need only examine real-world examples—breaches that have rocked industries, compromised sensitive data, and left organizations scrambling to shore up their defenses. In this exploration, we’ll dissect notable cybersecurity case studies, unravel the tactics employed by cybercriminals , and extract valuable lessons for strengthening digital defenses.

Equifax: The Breach that Shattered Trust

In 2017, Equifax, one of the largest credit reporting agencies, fell victim to a massive data breach that exposed the personal information of nearly 147 million individuals. The breach included sensitive data such as names, Social Security numbers, birthdates, and addresses, leaving millions vulnerable to identity theft and fraud.

Lessons Learned

1. Patch Management is Crucial:

The breach exploited a known vulnerability in the Apache Struts web application framework. Equifax failed to patch the vulnerability promptly, highlighting the critical importance of timely patch management. Organizations must prioritize staying current with security patches to prevent known vulnerabilities from being exploited.

2. Transparency Builds Trust:

Equifax faced severe backlash not only for the breach itself but also for its delayed and unclear communication with affected individuals. Transparency in communication is paramount during a cybersecurity incident. Organizations should proactively communicate the extent of the breach, steps taken to address it, and measures for affected individuals to protect themselves.

Target: A Cybersecurity Bullseye

In 2013, retail giant Target suffered a significant breach during the holiday shopping season. Hackers gained access to Target’s network through a third-party HVAC contractor, eventually compromising the credit card information of over 40 million customers and the personal information of 70 million individuals.

1. Third-Party Risks Require Vigilance:

Target’s breach underscored the risks associated with third-party vendors. Organizations must thoroughly vet and monitor the cybersecurity practices of vendors with access to their networks. Note that a chain is only as strong as its weakest link.

2. Advanced Threat Detection is Vital:

Target failed to detect the initial stages of the breach, allowing hackers to remain undetected for an extended period. Implementing robust advanced threat detection systems is crucial for identifying and mitigating breaches in their early stages.

WannaCry: A Global Ransomware Epidemic

In 2017, the WannaCry ransomware swept across the globe, infecting hundreds of thousands of computers in over 150 countries. Exploiting a vulnerability in Microsoft Windows, WannaCry encrypted users’ files and demanded ransom payments in Bitcoin for their release.

1. Regular System Updates are Non-Negotiable:

WannaCry leveraged a vulnerability that had been addressed by a Microsoft security update months before the outbreak. Organizations fell victim due to delayed or neglected updates. Regularly updating operating systems and software is fundamental to thwarting ransomware attacks .

2. Backup and Recovery Planning is Essential:

Organizations that had robust backup and recovery plans were able to restore their systems without succumbing to ransom demands. Implementing regular backup procedures and testing the restoration process can mitigate the impact of ransomware attacks.

Sony Pictures Hack: A Cyber Espionage Saga

In 2014, Sony Pictures Entertainment became the target of a devastating cyberattack that exposed an array of sensitive information, including unreleased films, executive emails, and employee records. The attackers, linked to North Korea, sought to retaliate against the film “The Interview,” which portrayed the fictional assassination of North Korea’s leader.

1. Diverse Attack Vectors:

The Sony hack demonstrated that cyber threats can come from unexpected sources and employ diverse attack vectors. Organizations must not only guard against common threats but also be prepared for unconventional methods employed by cyber adversaries .

2. Nation-State Threats:

The involvement of a nation-state in the attack highlighted the increasing role of geopolitical motivations in cyber incidents. Organizations should be aware of the potential for state-sponsored cyber threats and implement measures to defend against politically motivated attacks.

Marriott International: Prolonged Exposure and Ongoing Impact

In 2018, Marriott International disclosed a data breach that had persisted undetected for several years. The breach exposed personal information, including passport numbers, of approximately 500 million guests. The prolonged exposure raised concerns about the importance of timely detection and response.

1. Extended Dwell Time Matters:

Marriott’s breach highlighted the significance of dwell time—the duration a threat actor remains undetected within a network. Organizations should invest in advanced threat detection capabilities to minimize dwell time and swiftly identify and mitigate potential threats.

2. Post-Breach Communication:

Marriott faced criticism for the delayed communication of the breach to affected individuals. Prompt and transparent communication is vital in maintaining trust and allowing individuals to take necessary actions to protect themselves.

SolarWinds Supply Chain Attack: A Wake-Up Call

In late 2020, the SolarWinds supply chain attack sent shockwaves through the cybersecurity community. Sophisticated threat actors compromised SolarWinds’ software updates, enabling them to infiltrate thousands of organizations, including government agencies and major corporations.

1. Supply Chain Vulnerabilities:

The incident underscored the vulnerability of the software supply chain. Organizations must conduct thorough assessments of their suppliers’ cybersecurity practices and scrutinize the security of third-party software and services.

2. Continuous Monitoring is Essential:

The SolarWinds attack highlighted the importance of continuous monitoring and threat detection. Organizations should implement robust monitoring systems to identify anomalous behavior and potential indicators of compromise.

Notable Lessons and Ongoing Challenges

1. Human Element:

Many breaches involve human error, whether through clicking on phishing emails or neglecting cybersecurity best practices. Cybersecurity awareness training is a powerful tool in mitigating the human factor. Employees should be educated on identifying phishing attempts, using secure passwords, and understanding their role in maintaining a secure environment.

2. Zero Trust Architecture:

The concept of Zero Trust, where trust is never assumed, has gained prominence. Organizations should adopt a mindset that verifies every user, device, and network transaction, minimizing the attack surface and preventing lateral movement by potential intruders.

3. Cybersecurity Collaboration:

Cybersecurity is a collective effort. Information sharing within the cybersecurity community, between organizations, and with law enforcement agencies is crucial for staying ahead of emerging threats. Collaborative efforts can help identify patterns and vulnerabilities that may not be apparent to individual entities.

4. Regulatory Compliance:

The landscape of data protection and privacy regulations is evolving. Compliance with regulations such as GDPR, HIPAA, or CCPA is not only a legal requirement but also a cybersecurity best practice. Understanding and adhering to these regulations enhances data protection and builds trust with customers.

5. Encryption and Data Protection:

The importance of encryption and data protection cannot be overstated. In various breaches, including those of Equifax and Marriott, the compromised data was not adequately encrypted, making it easier for attackers to exploit sensitive information. Encrypting data at rest and in transit is a fundamental cybersecurity practice.

6. Agile Incident Response:

Cybersecurity incidents are inevitable, but a swift and agile incident response is crucial in minimizing damage. Organizations should regularly test and update their incident response plans to ensure they can respond effectively to evolving threats.

7. User Awareness and Training:

Human error remains a significant factor in many breaches. User awareness and training programs are essential for educating employees about cybersecurity risks , promoting responsible online behavior, and reducing the likelihood of falling victim to phishing or social engineering attacks.

8. Continuous Adaptation:

Cyber threats constantly evolve, necessitating a culture of continuous adaptation. Organizations should regularly reassess and update their cybersecurity strategies to address emerging threats and vulnerabilities.

Conclusion: Navigating the Cybersecurity Landscape

The world of cybersecurity is a battlefield where the landscape is ever-changing, and the adversaries are relentless. Real-world case studies serve as poignant reminders of the importance of proactive cybersecurity measures . As organizations adapt to emerging technologies, such as cloud computing, IoT, and AI, the need for robust cybersecurity practices becomes more pronounced. Real-world case studies offer invaluable insights into the tactics of cyber adversaries and the strategies employed by organizations to defend against evolving threats.

Prabhakar Pillai

I am a computer engineer from Pune University. Have a passion for technical/software blogging. Wrote blogs in the past on SaaS, Microservices, Cloud Computing, DevOps, IoT, Big Data & AI. Currently, I am blogging on Cybersecurity as a hobby.

Leave a Comment Cancel Comment

Your email address will not be published. Required fields are marked *

Save my name, email, and website in this browser for the next time I comment.

• Quick links
• 10 Trends Shaping 2024
• Global Private Equity Risk Index Highlights Risky Insight From Digital Chatter
• 2023 Fraud and Financial Crime Report
• Popular topics
• Valuation Advisory Services
• Compliance and Regulation
• Corporate Finance and Restructuring
• Investigations and Disputes
• Digital Technology Solutions
• Business Services
• Environmental, Social and Governance Advisory Services (ESG)
• Environmental, Social and Governance
• Consumer and Retail
• Financial Services
• Industrials
• Technology, Media and Telecom
• Energy and Mining
• Healthcare and Life Sciences
• Real Estate
• Our Experts
• Client Stories
• Transactions
• Restructuring Administration Cases
• Settlement Administration Cases
• Anti-Money Laundering
• Artificial Intelligence
• Cost of Capital
• Cryptocurrency
• Financial Crime
• M&A Updates

Valuation Outlook

• Blogs / Publications
• Webcasts and Videos

Cyber Security Case Studies

Managed detection and response case studies, client story, building cyber resilience amid microsoft azure migration.

Seamless Response to Ransomware and a Cyber Resilience Upgrade

Managed Detection and Response

Reducing a hospitality company’s cyber risk surface.

Enhancing Security Visibility for a Leading Asset Management Firm

Elevating Cyber Security Maturity of a Housebuilding Company

Protecting the 2008 U.S. Presidential Election from Cyber Attacks

by Alan Brill

Endpoint Detection and Response to Increase Plastics Manufacturer’s Cyber Posture

Stronger Threat Detection and Response for UK Bank: Reduced False Positives, Swifter Response

Enhanced Ransomware Defences for Global Shipping Business with Robust MDR

Large Hospital Leverages Managed Detection and Response for Increased Resilience and Compliance Reporting

Defending Healthcare Organization Against Persistent Trickbot Attacks

Optimized Security Operations and Cyber Governance for Asset Management Firm

Digital Forensics and Incident Response Case Studies

Digital forensics and incident response, online skimming attack facilitated by work-from-home arrangements.

Electronic Gift Card Fraud Investigation Uncovers Contractual Risks

Spearphishing Compromises Fuel Chain Credit Card Transactions, Ends in Ransomware

Insider Threat Case Study: Digital Forensics Reveals Fraud, Potential Regulatory Concerns

by Kevin Wong, Ben Hawkins

Kroll Contains, Remediates SWIFT System Cyber Fraud for Middle Eastern Bank

by Kevin Wong, Imran Khan

Transatlantic Cyber Investigation Unmasks Insider Threat, Preempts Ransom Attempt

by Michael Quinn, Ben Hawkins, Justin Price

Office 365 Business Email Compromise Investigation Leads to Stronger Security

by Devon Ackerman

Business Email Compromise Attack Investigation and Remediation for Insurance Broker

Proactive Services Case Studies

Penetration testing, continuous penetration testing optimizes security in agile product development for software startup.

Scaling Up Application Security for a Global Telecommunications Company

by Rahul Raghavan, Rob Deane

Safeguarding Election Security Through Penetration Testing

AWS Penetration Testing Gives In-Depth Cyber Risk Insight to Specialist Bank

State of Arkansas Cyber Security Assessment

by Frank Marano, Jeff Macko

Red Team Exercise Helps International Trade Organization Comply with FCA Cyber Security Mandates

Other Cyber Security Case Studies

Cyber governance and risk, gdpr assessment and u.s. data privacy laws action plan for a global biopharmaceutical company.

Cyber Litigation Support

Uncovering critical historical data to progress a complex legal case.

Taking an Underwriter’s Security Posture From At-Risk to Resilient

Kroll Assists Entertainment Conglomerate in Achieving Holistic Digital Transformation with Cloud Native Security Platform Implementation

by Frank Marano, Rahul Raghavan, Rob Deane

Incident response, digital forensics, breach notification, managed detection services, penetration testing, cyber assessments and advisory.

Agile Penetration Testing Program

Integrated into your software development lifecycle (SDLC), Kroll’s agile penetration testing program is designed to help teams address security risks in real time and on budget.

Penetration Testing Services

Validate your cyber defenses against real-world threats. Kroll’s world-class penetration testing services bring together front-line threat intelligence, thousands of hours of cyber security assessments completed each year and a team of certified cyber experts — the foundation for our sophisticated and scalable approach.

Application Threat Modeling Services

Kroll helps development teams design and build internal application threat modeling programs to identify and manage their most pressing vulnerabilities.

Application Security Services

Kroll’s product security experts upscale your AppSec program with strategic application security services catered to your team’s culture and needs, merging engineering and security into a nimble unit.

Cloud Security Services

Kroll’s multi-layered approach to cloud security consulting services merges our industry-leading team of AWS and Azure-certified architects, cloud security experts and unrivalled incident expertise.

24x7 Incident Response

Kroll is the largest global IR provider with experienced responders who can handle the entire security incident lifecycle.

Connect With Us

Chief Financial Officers Ignoring Cyber Risk Worth Millions of Dollars According to Kroll Report

Kroll Acquires Crisp, Trusted Provider of Real-time Risk Intelligence

by Andrew Burke

Kroll Partners with Armis to Extend Preparedness and Response for OT and ICS Environments

Kroll Acquires Resolver, a Leader in Risk Intelligence Technology

Webinar – Mitigating Valuation Uncertainty

As private credit markets continue to grow, many investors and fund managers have questioned the accuracy of reported net asset values.

Threat Intelligence

Webinar: fighting advanced malware threats - kimsuky and the screenconnect vulnerability.

Get the latest insights into threat actor activity straight from the frontlines fueled by data from Kroll’s incident response intelligence and elite analyst.

IVSC Valuation Webinar Series 2024

Kroll and the International Valuations Standards Council (IVSC) are pleased to invite you to the 2024 Valuation Webinar Series.

Kroll is headquartered in New York with offices around the world.

More About Kroll

• Trending Topics
• Find an Expert
• Media Inquiry

• Accessibility
• Code of Conduct
• Data Privacy Framework
• Kroll Ethics Hotline
• Modern Slavery Statement
• Privacy Policy

• Case Studies

Cyber Security Hub aims to produce case studies routinely, in which the site's editorial staff chats with leading security executives about recent initiatives (with ROI and measurable results).

Mid-year state of cyber security: APAC

Cyber Security Hub provides an in-depth look at trends, challenges and investment opportunities across APAC

The benefits of automating enterprise cyber security

Insights on perspectives on automation imperatives, inhibitors, talent and budget in the enterprises to prevent threats, vulnerabilities as well as cyber security

Have your say: the global state of cyber security

The global survey offers cyber security professionals the opportunity to share their thoughts and the chance to win $1,000 in Amazon vouchers

The top XDR investment decisions for CISOs

This Cyber Security Hub report shows how CISOs' uses managed services and XDR to detect threat and prevention of cyber attacks.

The global state of the cyber security industry 2022

This exclusive report aims to keep cyber security professionals abreast of today’s threats and highlight the areas in which CISOs are allocating security budgets to mitigate the risks facing their org...

The top 20 cyber security movers and shakers 2022

Cyber Security Hub’s inaugural power list is live, profiling the achievements from cyber security leaders at Microsoft, Visa, Coca-Cola and Aston Martin

Have your say: Cyber Security Hub readership survey

CS Hub is constantly looking to improve our content, take our survey to tell us how

CS Hub launches 20 cybersecurity leaders to watch

CS Hub's inaugural power list to highlight cyber security professionals who ahev been making strides in cyber security over the past 12 months

We want to hear your views on the state of cyber security today

Help educate your fellow cyber security professionals on the biggest challenges facing the cyber world today by taking part in our mid-year survey

SaaS Security Survey Report 2022

Find out what steps CISOs are taking to ensure the growing SaaS app attack surface is secured

Top 10 cyber security blogs

Cyber Security Hub's recommended blogs to help keep you and your organization secure

Outpacing Compliance, Realizing Risk Management & Achieving Forward Posture 

Anti-Financial Crime Exchange Europe 2024

September 19-20 Frankfurt, Germany

Automotive Cyber Security Europe 2024

11 - 14 November 2024 Frankfurt, Germany

Anti-Financial Crime Exchange UK

March 17 - 18, 2025 London, UK

Subscribe to our Free Newsletter

Insights from the world’s foremost thought leaders delivered to your inbox.

Latest Webinars

Preventing financial and reputational risk with process intelligence.

2024-05-23 11:00 AM - 12:00 PM EDT

Building high-performing development teams: Harnessing tools, processes & AI

2024-05-02 11:00 AM - 12:00 PM EDT

Building cyber resilience

2024-04-24 11:30 AM - 12:30 PM SGT

FIND CONTENT BY TYPE

• White Papers

Cyber Security Hub COMMUNITY

• Advertise with us
• Cookie Policy
• User Agreement
• Become a Contributor
• All Access from CS Hub
• Become a Member Today
• Media Partners

ADVERTISE WITH US

Reach Cyber Security professionals through cost-effective marketing opportunities to deliver your message, position yourself as a thought leader, and introduce new products, techniques and strategies to the market.

JOIN THE Cyber Security Hub COMMUNITY

Join CSHUB today and interact with a vibrant network of professionals, keeping up to date with the industry by accessing our wealth of articles, videos, live conferences and more.

Cyber Security Hub, a division of IQPC

Careers With IQPC | Contact Us | About Us | Cookie Policy

Become a Member today!

PLEASE ENTER YOUR EMAIL TO JOIN FOR FREE

Already an IQPC Community Member? Sign in Here or Forgot Password Sign up now and get FREE access to our extensive library of reports, infographics, whitepapers, webinars and online events from the world’s foremost thought leaders.

We respect your privacy, by clicking 'Subscribe' you will receive our e-newsletter, including information on Podcasts, Webinars, event discounts, online learning opportunities and agree to our User Agreement. You have the right to object. For further information on how we process and monitor your personal data click here . You can unsubscribe at any time.

Cyber Case Studies Subscribe

The 2 am call: Preparing for a government cyberattack

Fremont County suffered a cyberattack in 2022 that took pieces of the county's law enforcement's systems offline, including communications.

Häfele recovers from ransomware attack with new SASE platform

An international manufacturer and supplier of furniture fittings,  recovered from a recent ransomware attack after utilizing a single-vendor SASE platform. 

Ride-hailing company, inDrive, uses new platform to prevent fraud

The ride-share company is using a security platform to keep negotiations & prices transparent and dishonest & fraudulent users out of the system.

The Old Spaghetti Factory restaurant chain ups network & physical security

The Old Spaghetti Factory restaurant chain decided to upgrade legacy technology with network, voice and security infrastructure from Interface Systems.

K-8 students learn cybersecurity through gamification

K-8 students can learn cybersecurity techniques through a gamified education platform called Cyber Legends. Learn more in this case study.

Electric company uses SAP monitoring to bolster cybersecurity

International electric and manufacturing firm Schneider Electric uses a Systems Applications and Products (SAP) security platform from SecurityBridge to bolster SAP visibility. Learn more in this case study.

Pharmaceutical company secures network with AppSec compliance tools

Sanofi, a global biopharmaceutical company based in France, protects its network security with the Security Platform & Compliance Monitor from SecurityBridge. Learn more in this case study.

Tech university stops cyberattack with AI

When an African technology university was targeted by Malware as a Service, Darktrace AI helped identify the cyberattack in its early stages.

Coding robot teaches K-12 students about cybersecurity

K-12 students need to learn about cybersecurity along with their exposure to digital technology. The Sphero BOLT, a coding robot, can help teach students about cyber risk management, ethical hacking and more.

Anti-human trafficking organization combats abuse with data analytics

The Anti-Human Trafficking Intelligence Initiative (ATII) uses data analytics tools to monitor the dark web for information on human trafficking operations. The organization now uses Siren's Investigative Intelligence platform to expedite their search capacity.

Sign-up to receive top management & result-driven techniques in the industry.

Join over 20,000+ industry leaders who receive our premium content..

Copyright ©2024. All Rights Reserved BNP Media.

Design, CMS, Hosting & Web Development :: ePublishing

• Threats and vulnerabilities

Ransomware is malware that locks and encrypts a victim's data, files, devices or systems, rendering them inaccessible and unusable until the attacker receives a ransom payment. A ransomware attack can shut down a business for days, even weeks and -- even when the company pays the ransom -- there's no guarantee it will ever get its assets back, or that it won't be attacked again. This guide covers the history and basics of ransomware, identifies the most common targets and offers expert instructions on how to prevent an attack. Or, if the worst happens, how to recognize an attack's taken place and remove the ransomware as swiftly as possible.

Ransomware case study: recovery can be painful, in ransomware attacks, backups can save the day and the data. even so, recovery can still be expensive and painful, depending on the approach. learn more in this case study..

• Alissa Irei, Senior Site Editor

Seasoned IT consultant David Macias will never forget the day he visited a new client's website and watched in horror as it started automatically downloading ransomware before his eyes. He quickly disconnected his computer from the rest of the network, but not before the malware had encrypted 3 TB of data in a matter of seconds.

"I just couldn't believe it," said Macias, president and owner of ITRMS, a managed service provider in Riverside, Calif. "I'm an IT person, and I am [incredibly careful] about my security. I thought, 'How can this be happening to me?' I wasn't online gambling or shopping or going to any of the places you typically find this kind of stuff. I was just going to a website to help out a client, and bingo -- I got hit."

Macias received a message from the hackers demanding $800 in exchange for his data. "I told them they could go fly a kite," he said. He wiped his hard drive, performed a clean install and restored everything from backup. "I didn't lose anything other than about five days of work."

Ransomware case study: Attack #2

A few years later, another of Macias' clients -- the owner of a direct-mail printing service -- called to report he couldn't access his server. Macias logged into the network through a remote desktop and saw someone had broken through the firewall. "I told the client, 'Run as fast as you can and unplug all the computers in the network,'" he said. This short-circuited the attack, but the attacker still managed to encrypt the server, five out of 15 workstations and the local backup.

This article is part of

What is ransomware? How it works and how to remove it

• Which also includes:
• The 10 biggest ransomware attacks in history
• How to recover from a ransomware attack
• How to prevent ransomware in 6 steps

"What made this ransomware attack so bad was that it attacked the private partition that lets you restore the operating system," Macias added. Although the ransom demanded was again only $800, he advised against paying , since attackers often leave backdoors in a network and can return to steal data or demand more money.

What made this ransomware attack so bad was that it attacked the private partition that lets you restore the operating system. David Macias President, ITRMS

Fortunately, Macias had a full image-based backup of the client's network saved to a cloud service. Even so, recovery was expensive, tedious and time-consuming. He had to reformat the hard drive manually, rebuild the server from scratch and reinstall every single network device. The process took about a week and a half and cost $15,000. "The client was just incredibly grateful that all their data was intact," Macias said.

Although pleased the client's data loss was negligible, Macias wanted to find a more efficient, less painful disaster recovery strategy . Shortly after the second ransomware incident, he learned about a company called NeuShield that promised one-click backup restoration. He bought the technology for his own network and also sold it to the client that had been attacked. According to NeuShield, its Data Sentinel technology works by showing an attacker a mirror image of a computer's data, thus protecting the original files and maintaining access to them, even if encryption takes place.

Ransomware case study: Attack #3

The printing services company experienced another ransomware incident a couple of years later, when its owner was working from home and using a remote desktop without a VPN . A malicious hacker gained entry through TCP port 3389 and deployed ransomware, encrypting critical data.

In this instance, however, Macias said NeuShield enabled him to restore the system with a simple click and reboot. "When they got hit the first time, it took forever to restore. The second time, they were back up and running in a manner of minutes," he said.

While he praised NeuShield's technology, Macias noted it doesn't negate the need for antivirus protection to guard against common malware threats or for cloud backup in case of fires, earthquakes or other disasters. "Unfortunately, there's no one-stop solution," he said. "I wish there was one product that included everything, but there isn't."

Macias said he knows from personal experience, however, that investing upfront can prevent massive losses down the road. "I've had clients tell me, 'I'll worry about it when it happens.' But that's like driving without insurance. Once you get into an accident, it's too late."

How to create a ransomware incident response plan

Best practices for reporting ransomware attack

How to remove ransomware, step by step

17 ransomware removal tools to protect enterprise networks

4 tips to find cyber insurance coverage in 2023

Related Resources

• Create Secure Digital Experiences Across Hybrid Environments –Ironside Group
• Towards an Autonomous Vehicle Enabled Society: Cyber Attacks and Countermeasures –TechTarget ComputerWeekly.com
• Demystifying the myths of public cloud computing –TechTarget ComputerWeekly.com
• Simplify Threat Detection And Response With IBM Security ReaQta And Logicalis –Logicalis

Dig Deeper on Threats and vulnerabilities

Ransomware, storage and backup: Impacts, limits and capabilities

How to prepare for ransomware

How to stop ransomware: 4 steps to ransomware containment

Future of tape backup built on consistent advancements

SASE offers companies a compelling security strategy, but it takes time to ensure network teams have the visibility and ...

At Cisco Live 2024, leaders discussed how AI can support business objectives. Companies like CSL Behring and Room & Board ...

Cisco is integrating Splunk, AppDynamics and ThousandEyes to create a critical differentiator in the observability market. ...

As U.S. states like Colorado pass their own AI laws, businesses will need to prepare compliance measures if they do business in ...

Digital transformation success requires cross-organizational alignment, actionable goals and top-notch project management. Here's...

President Joe Biden throws his support behind Microsoft to build an AI data center in Racine, Wis., as big tech companies invest ...

There are several types of Group Policies that could exist for a particular desktop, so IT must carefully manage these different ...

Microsoft, with the help of Qualcomm, might have finally delivered a device that will cause users to reconsider their Apple ...

There are many ways local AI on PC hardware can help users, but the broader use cases aren't there yet. Learn about the emerging ...

Is it better to be 'first' or 'smart' in cloud? Compare the two strategies to determine which will help achieve your ...

Consistency and standardization are critical to a successful AWS tagging strategy. Consider these best practices to organize and ...

Serverless computing continues to grow in popularity to build modern applications. Evaluate the risks and rewards, as well as ...

PSNI publishes report on police surveillance of journalists and lawyers but Northern Ireland’s Policing Board says it does not ...

Juniper Networks announces industry leadership with enhancements to cloud-native Mist AI engine for all network domains, claiming...

Networking giant sets out strategy to empower customers to see everything across complex digital supply chain, turning data into ...

Cyber Insight

What is case study in cyber security? Learn from real-life examples.

June 27, 2023

As a cyber security expert with years of experience, I understand how intimidating it can be to protect one’s digital presence in today’s world. We constantly hear about security breaches, ransomware attacks, and hackers stealing sensitive data. However, it’s not just the industry professionals who can learn to protect themselves from cyber-attacks. With the right knowledge, anyone can learn how to spot and neutralize potential threats.

One of the best ways to gain this knowledge is through real-life examples. That’s where case studies come in. These case studies allow us to learn from actual cyber-security incidents and understand what went wrong, why it happened, and how it could have been prevented. As a reader, you’ll be able to apply this knowledge to your own digital presence, and protect yourself, your family, and your business from cyber-attacks.

So, in this post, we’ll dive into what exactly a case study is in the context of cyber-security. I’ll show you how to use these case studies to learn from past security incidents, how they can help you understand the risks you face, and ultimately, how to protect yourself from becoming a victim of a cyber-attack. Are you ready to learn from some real-life examples in cyber-security? Let’s get started!

What is case study in cyber security?

The team responsible for conducting a cyber security case study typically employs a variety of methods to get a complete perspective on the threat environment. Some of the methods they may use include:

• Collecting data from internal security systems, such as firewalls and intrusion detection systems, to identify potential threats
• Analyzing data on cyber-related threats from external sources, such as threat intelligence feeds and open-source intelligence (OSINT)
• Engaging with other organizations or industry groups to share information and best practices
• Conducting interviews with employees and other stakeholders to gather insights and information about the incident

Once the team has collected and analyzed all the necessary data, they develop a detailed report outlining their findings and recommendations for improving the organization’s cyber security posture. This report may be used to inform the development of new policies and procedures, or to train employees on how to better detect and respond to cyber threats. Ultimately, the goal of a cyber security case study is to help organizations become more resilient and better prepared to defend against cyber attacks.

???? Pro Tips:

1. Understand the purpose of a case study in cyber security. A case study is an in-depth analysis of a particular cybersecurity event or incident, which is used to identify the weaknesses in the system or processes and provide insights into how to improve them.

2. Choose the right case study. When selecting a case study for analysis, ensure that it is relevant to your organization’s cybersecurity practices and challenges. Consider factors such as industry, size, and security posture while selecting a case study.

3. Analyze the case study thoroughly. When analyzing a case study, pay attention to the details of the event or incident being studied. Take note of what went wrong, how it could have been prevented, and what the organization did to recover. This analysis will provide valuable insights into improving your organization’s cybersecurity defenses.

4. Discuss the findings with your team. Once you have analyzed the case study, share your findings and insights with your cybersecurity team. Use the case study as a learning opportunity to explain the importance of cybersecurity management and how to develop proactive strategies to prevent similar incidents.

5. Use the insights to strengthen your organization’s defense. After reviewing the case study and discussing its implications with your team, develop strategies and tactics to strengthen your organization’s cybersecurity defenses. Use the insights gained from analyzing the case study to better protect your organization from similar cyber attacks.

Understanding Case Study in Cyber Security

A case study is an in-depth analysis of a particular problem or situation. In the context of cyber security, a case study focuses on the use of specific tools and techniques to identify, analyze, and mitigate cyber threats. Cyber security case studies are valuable resources that help organizations better understand real-world threats and develop effective strategies to protect their assets against them. Case studies provide insight into how attackers target specific businesses, the methods they use, and the impact of their actions.

The Importance of Threat Monitoring in Cyber Security

Threat monitoring is one of the most crucial aspects of cyber security. It involves regularly monitoring and collecting data on cyber-related threats around the globe, which could affect the sector or business. The goal is to identify potential threats and notify the relevant teams so that they can take appropriate action to prevent or mitigate the risk. Without effective threat monitoring, organizations are vulnerable to a wide range of cyber threats, including malware, phishing attacks, ransomware, and other malicious activities.

Methods Used to Collect Data on Cyber-Related Threats

There are various methods used to collect data on cyber-related threats, including:

• Network scanning: This involves scanning the organization’s network to identify potential vulnerabilities and threats.
• Vulnerability assessments: This involves identifying and assessing potential vulnerabilities in the organization’s hardware, software, and network infrastructure.
• Penetration testing: This involves simulating a cyber-attack to identify weaknesses and vulnerabilities in the system.
• Intelligence gathering: This involves collecting and analyzing information from various sources, including social media, open-source databases, and other traditional intelligence sources, to identify potential threats.

Analyzing the Overall Threat Environment

An essential aspect of threat intelligence is analyzing the overall threat environment. Cyber security experts collect large amounts of data on threats and vulnerabilities to gain a complete perspective of the threat environment. This analysis involves identifying patterns, trends, and emerging threats that could affect an organization. There are numerous tools and techniques used to analyze the overall threat environment, including:

• Machine learning algorithms: This involves analyzing data using artificial intelligence and machine learning techniques to identify patterns and trends.
• Data visualization tools: This involves using charts, graphs, and other visual aids to represent data and identify trends.
• Threat intelligence platforms: This involves using specialized software and tools to automate threat intelligence gathering and analysis.

Assessing Threats and Motivations to Target a Business

Assessing threats and motivations to target a business is a critical aspect of cyber security. Cyber criminals are motivated by different factors, including financial gain, political motives, espionage, and so on. Understanding the motivations behind a cyber-attack can help organizations better prepare for and prevent or mitigate possible threats. Some common motivations include:

• Financial gain: Cyber criminals target businesses to steal sensitive data, intellectual property, or financial details that could help them steal money.
• Political motives: Hackers might target businesses to protest or create political unrest, this may go in line with their ideologies.
• Sabotage: Some cyber-attacks aim to sabotage a business’s operations or reputation.

Implementing Effective Cyber Security Measures

Effective cyber security measures involve identifying threats and implementing strategies to mitigate them. There are various ways to implement cybersecurity measures, including:

• Implementing security protocols: Security protocols ensure that all members of the organization follow the same procedures to maintain the security of the system. This includes guidelines for passwords, access control, and network security.
• Train employees: Training employees, every member of an organization is a potential entry point for a cyber attack, so all employees should be trained to identify and prevent cyber-attacks.
• Upgrading software and hardware: Outdated software and hardware are more vulnerable to cyber-attacks. Upgrades to the latest versions can help prevent many cyber threats.

Staying Ahead of Emerging Cyber Threats

Staying ahead of emerging cyber threats is an essential aspect of cyber-security. Hackers are continuously developing new techniques and tools to circumvent security measures. To keep up with the ever-evolving threat landscape, cyber-security experts must continuously monitor the threat environment, track emerging trends, and implement new security protocols to mitigate new threats. In summary, cyber security experts must remain vigilant, employ a variety of threat monitoring methods and stay appraisable on emerging cyber threats.

most recent

Cybersecurity Basics

What are the three approaches to security in cyber security: explained.

Services & Solutions

What is security solution and why it matters: ultimate guide.

Training & Certification

Is a masters in cybersecurity worth the investment.

What is the Cyber Security Strategy Objective? Protecting Against Breaches.

What is Dart in Cyber Security? A Powerful Tool for Threat Detection.

Decoding SLED: Is Public Sector Cybersecurity the Same?

PH +1 000 000 0000

24 M Drive East Hampton, NY 11937

© 2024 INFO

• New Zealand
• United Kingdom

Case Studies in Cybersecurity: Learning from Notable Incidents and Breaches

Stay Informed With Our Weekly Newsletter

Receive crucial updates on the ever-evolving landscape of technology and innovation.

By clicking 'Sign Up', I acknowledge that my information will be used in accordance with the Institute of Data's Privacy Policy .

The importance of cybersecurity cannot be overstated in today’s digital age.

With technological advancements, businesses and individuals increasingly rely on the Internet and digital platforms for various activities.

However, this reliance also exposes us to potential cyber threats and breaches that can have significant impacts.

According to findings by IBM and the Ponemon Institute, security teams typically require, on average, approximately 277 days to detect and mitigate a data breach.

By understanding the role of cybersecurity and dissecting notable case studies in cybersecurity, we can learn valuable lessons that can help us improve our overall cybersecurity strategies.

Understanding the importance of cybersecurity

It encompasses various measures and practices that are designed to prevent unauthorized access, use, or disclosure of data.

In a world where cybercriminals are constantly evolving their techniques, examining case studies in cybersecurity and having a robust strategy is essential.

The role of cybersecurity in today’s digital age

In today’s interconnected world, businesses and individuals rely heavily on digital platforms and online services.

From online banking to e-commerce, from social networking to remote working, our lives revolve around the digital landscape.

With such heavy dependence, cyber threats and breaches become a real and constant danger.

The evolving nature of cybersecurity threats calls for continuous vigilance and proactive measures, like consistently reviewing case studies in cybersecurity.

Cybersecurity professionals need to be well-versed in the latest threats, vulnerabilities, and solutions to mitigate risks effectively.

The potential impact of cybersecurity breaches

Cybersecurity breaches can have severe consequences for organizations and individuals alike.

They can result in unauthorized access to sensitive information, financial loss, reputational damage, and legal implications.

The impact of a breach can extend far beyond immediate financial losses, as organizations can suffer long-term damage to their brand and customer trust.

For individuals, cybersecurity breaches can result in identity theft, personal financial loss, and compromised privacy.

The consequences of a breach can be emotionally and financially distressing, affecting individuals’ lives for years to come.

Now, let’s look at some important case studies in cybersecurity.

Dissecting notable case studies in cybersecurity

Examining case studies in cybersecurity incidents allows us to gain a deeper understanding of a breach’s anatomy and the emerging common themes.

The sony pictures hack

In 2014, cyber attackers infiltrated Sony Pictures’ network, releasing confidential data, including employees’ personal details and private communications between executives.

This breach led to significant reputational harm and financial setbacks for Sony, prompting substantial investments in cybersecurity improvements and numerous legal settlements.

Case studies in cybersecurity like this one underscore the critical need for enhanced network security measures and more rigorous data handling and protection protocols.

The Equifax data breach

Equifax suffered a massive breach in 2017 when hackers exploited a web application vulnerability to access the personal data of roughly 147 million consumers.

This incident ranks among the most substantial losses of consumer data to date, resulting in severe reputational and financial damage to Equifax.

Case studies in cybersecurity like this highlight the critical importance of keeping software up to date and the need for a thorough vulnerability management strategy to prevent similar breaches.

The WannaCry ransomware attack

The WannaCry ransomware is another case study in cybersecurity from 2017.

It was a global crisis, impacting hundreds of thousands of computers across 150 countries by exploiting vulnerabilities in outdated Microsoft Windows systems.

The attack disrupted critical services in sectors such as healthcare and transportation, leading to extensive financial losses worldwide.

This event demonstrated the importance of regular system updates, effective backup protocols, and ongoing employee training to mitigate the risks of phishing and other cyber threats .

How to apply these lessons to improve cybersecurity

Applying the lessons learned from past case studies in cybersecurity requires a holistic and proactive approach.

Organizations should conduct regular vulnerability assessments and penetration testing to identify weaknesses within their infrastructure.

These assessments provide valuable insights into potential vulnerabilities that can be addressed to strengthen overall cybersecurity.

In addition, continuous education and awareness programs should be implemented to ensure employees are well informed about the latest threats and trained on cybersecurity best practices.

Regular training sessions, simulated phishing campaigns, and security awareness workshops can contribute to creating a security-conscious culture within the organization.

Consider an online training program like the Institute of Data’s Cybersecurity Program , which can teach you the necessary skills and provide real-world project experience to enter or upskill into the cybersecurity domain.

Strategies for enhancing cybersecurity

Effective cybersecurity strategies go beyond implementing technical controls and educating employees.

They encompass a comprehensive approach that addresses various aspects of cybersecurity, including prevention, detection, response, and recovery.

Best practices for preventing cybersecurity breaches

• Implementing multi-factor authentication (MFA) for all accounts
• Regularly patching and updating systems and software
• Using strong, unique passwords or password managers
• Encrypting sensitive data both at rest and in transit
• Restricting user access based on the principle of least privilege
• Implementing robust firewalls and network segmentation
• Conducting regular vulnerability assessments and penetration testing
• Monitoring network traffic and system logs for anomalies
• Regularly backing up critical data and testing the restore process
• Establishing incident response plans and conducting tabletop exercises

The future of cybersecurity: predictions and precautions

As technology continues to evolve, so do cyber threats. It is essential to anticipate future trends and adopt proactive measures to strengthen our cybersecurity defenses.

Emerging technologies like artificial intelligence and the Internet of Things present both opportunities and challenges.

While they enhance convenience and efficiency, they also introduce new attack vectors. It is crucial for cybersecurity professionals to stay abreast of these developments and implement necessary safeguards.

Learning from case studies in cybersecurity allows us to understand the evolving landscape of cybersecurity better.

Dissecting these incidents, identifying key lessons, and applying best practices can strengthen our overall cybersecurity strategies.

As the digital age continues to advance, we must remain vigilant and proactive in our efforts to protect our digital assets and sensitive information.

Enrol in the Institute of Data’s Cybersecurity Program to examine important case studies in cybersecurity, improve your knowledge of cybersecurity language, and stay ahead of evolving challenges.

Alternatively, if you’re interested in learning more about the program and how it can benefit your career, book a free career consultation with a member of our team today.

Follow us on social media to stay up to date with the latest tech news

Stay connected with Institute of Data

Identifying and Mitigating Top Risks in Cybersecurity: A Guide for Businesses Today

How to Identify Online Scams in the Digital Economy

Don’t Scam Yourself Out of a Cybersecurity Career

Cybersecurity 101: A Comprehensive Introduction

© Institute of Data. All rights reserved.

Copy Link to Clipboard

• Artificial Intelligence
• Generative AI
• Business Operations
• IT Leadership
• Application Security
• Business Continuity
• Cloud Security
• Critical Infrastructure
• Identity and Access Management
• Network Security
• Physical Security
• Risk Management
• Security Infrastructure
• Vulnerabilities
• Software Development
• Enterprise Buyer’s Guides
• United States
• United Kingdom
• Newsletters
• Foundry Careers
• Terms of Service
• Privacy Policy
• Cookie Policy
• Member Preferences
• About AdChoices
• E-commerce Links
• Your California Privacy Rights

Our Network

• Computerworld
• Network World

Equifax data breach FAQ: What happened, who was affected, what was the impact?

In 2017, attackers exfiltrated hundreds of millions of customer records from the credit reporting agency. here's a timeline of the security lapses that allowed the breach to happen and the company's response..

In March 2017, personally identifying data of hundreds of millions of people was stolen from Equifax, one of the credit reporting agencies that assess the financial health of nearly everyone in the United States.

As we’ll see, the breach spawned a number of scandals and controversies: Equifax was criticized for everything ranging from their lax security posture to their bumbling response to the breach, and top executives were accused of corruption in the aftermath. And the question of who was behind the breach has serious implications for the global political landscape.

How did the Equifax breach happen?

Like plane crashes, major infosec disasters are typically the result of multiple failures. The Equifax breach investigation highlighted a number of security lapses that allowed attackers to enter supposedly secure systems and exfiltrate terabytes of data.

Most of the discussion in this section and the subsequent one comes from two documents: A detailed report from the U.S. General Accounting Office , and an in-depth analysis from Bloomberg Businessweek based on sources inside the investigation. A top-level picture of how the Equifax data breach happened looks like this:

• The company was initially hacked via a consumer complaint web portal, with the attackers using a widely known vulnerability that should have been patched but, due to failures in Equifax’s internal processes, wasn’t.
• The attackers were able to move from the web portal to other servers because the systems weren’t adequately segmented from one another, and they were able to find usernames and passwords stored in plain text that then allowed them to access still further systems.
• The attackers pulled data out of the network in encrypted form undetected for months because Equifax had crucially failed to renew an encryption certificate on one of their internal security tools.
• Equifax did not publicize the breach until more than a month after they discovered it had happened; stock sales by top executives around this time gave rise to accusations of insider trading.

To understand how exactly all these crises intersected, let’s take a look at how the events unfolded.

When did the Equifax breach happen?

The crisis began in March of 2017. In that month, a vulnerability, dubbed CVE-2017-5638 , was discovered in Apache Struts, an open source development framework for creating enterprise Java applications that Equifax, along with thousands of other websites, uses. If attackers sent HTTP requests with malicious code tucked into the content-type header, Struts could be tricked into executing that code, and potentially opening up the system Struts was running on to further intrusion. On March 7, the Apache Software Foundation released a patch for the vulnerabilities; on March 9, Equifax administrators were told to apply the patch to any affected systems, but the employee who should have done so didn’t. Equifax’s IT department ran a series of scans that were supposed to identify unpatched systems on March 15; there were in fact multiple vulnerable systems, including the aforementioned web portal, but the scans seemed to have not worked, and none of the vulnerable systems were flagged or patched.

While it isn’t clear why the patching process broke down at this point, it’s worth noting what was happening at Equifax that same month, according to Bloomberg Businessweek: Unnerved by a series of incidents in which criminals had used Social Security numbers stolen from elsewhere to log into Equifax sites, the credit agency had hired the security consulting firm Mandiant to assess their systems. Mandiant warned Equifax about multiple unpatched and misconfigured systems, and the relationship devolved into in acrimony within a few weeks.

Forensics analyzed after the fact revealed that the initial Equifax data breach date was March 10, 2017: that was when the web portal was first breached via the Struts vulnerability. However, the attackers don’t seem to have done much of anything immediately. It wasn’t until May 13, 2017 — in what Equifax referred to in the GAO report as a “separate incident” — that attackers began moving from the compromised server into other parts of the network and exfiltrating data in earnest. (We’ll revisit this time gap later, as it’s important to the question of who the attackers were.)

From May through July of 2017, the attackers were able to gain access to multiple Equifax databases containing information on hundreds of millions of people; as noted, a number of poor data governance practices made their romp through Equifax’s systems possible. But how were they able to remove all that data without being noticed? We’ve now arrived at another egregious Equifax screwup. Like many cyberthieves, Equifax’s attackers encrypted the data they were moving in order to make it harder for admins to spot; like many large enterprises, Equifax had tools that decrypted, analyzed, and then re-encrypted internal network traffic, specifically to sniff out data exfiltration events like this. But in order to re-encrypt that traffic, these tools need a public-key certificate , which is purchased from third parties and must be annually renewed. Equifax had failed to renew one of their certificates nearly 10 months previously — which meant that encrypted traffic wasn’t being inspected .

The expired certificate wasn’t discovered and renewed until July 29, 2019, at which point Equifax administrators almost immediately began noticing all that previously obfuscated suspicious activity; this was when Equifax first knew about the breach.

It took another full month of internal investigation before Equifax publicized the breach, on September 8, 2017. Many top Equifax executives sold company stock in early August, raising suspicions that they had gotten ahead of the inevitable decline in stock price that would ensue when all the information came out. They were cleared, though one lower-level exec was charged with insider trading .

What data was compromised and how many people were affected?

Equifax specifically traffics in personal data, and so the information that was compromised and spirited away by the attackers was quite in-depth and covered a huge number of people. It potentially affected 143 million people — more than 40 percent of the population of the United States — whose names, addresses, dates of birth, Social Security numbers, and drivers’ licenses numbers were exposed. A small subset of the records — on the order of about 200,000 — also included credit card numbers ; this group probably consisted of people who had paid Equifax directly in order to order to see their own credit report.

This last factor is somewhat ironic, as the people concerned enough about their credit score to pay Equifax to look at it also had the most personal data stolen, which could lead to fraud that would then damage their credit score. But a funny thing happened as the nation braced itself for the wave of identity theft and fraud that seemed inevitable after this breach: it never happened. And that has everything to do with the identity of the attackers. 

Who was responsible for the Equifax data breach?

As soon as the Equifax breach was announced, infosec experts began keeping tabs on dark web sites, waiting for huge dumps of data that might be connected to it. They waited, and waited, but the data never appeared. This gave rise to what’s become a widely accepted theory: that Equifax was breached by Chinese state-sponsored hackers whose purpose was espionage, not theft.

The Bloomberg Businessweek analysis follows these lines and points to a number of additional clues beyond the fact that the stolen data never seems to have leaked. For instance, recall that the initial breach on March 10 was followed by more than two months of inactivity before attackers began abruptly moving onto high-value targets within Equifax’s network. Investigators believe that the first incursion was achieved by relatively inexperienced hackers who were using a readily available hacking kit that had been updated to take advantage of the Struts vulnerability, which was only a few days old at that point and easy to exploit. They may have found the unpatched Equifax server using a scanning tool and not realized how potentially valuable the company they had breached was. Eventually, unable to get much further beyond their initial success, they sold their foothold to more skilled attackers, who used a variety of techniques associated with Chinese state-backed hackers to get access to the confidential data.

And why would the Chinese government be interested in Equifax’s data records? Investigators tie the attack into two other big breaches that similarly didn’t result in a dump of personally identifying data on the dark web: the 2015 hack of the U.S. Office of Personnel Management , and the 2018 hack of Marriott’s Starwood hotel brands . All are assumed to be part of an operation to build a huge “data lake” on millions of Americans, with the intention of using big data techniques to learn about U.S. government officials and intelligence operatives. In particular, evidence of American officials or spies who are in financial trouble could help Chinese intelligence identify potential targets of bribery or blackmail attempts.

In February of 2020, the United States Department of Justice formally charged four members of the Chinese military with the attack . This was an extremely rare move — the U.S. rarely files criminal charges against foreign intelligence officers in order to avoid retaliation against American operatives — that underscored how seriously the U.S. government took the attack.

How did Equifax handle the breach?

At any rate, once the breach was publicized, Equifax’s immediate response did not win many plaudits. Among their stumbles was setting up a separate dedicated domain, equifaxsecurity2017.com, to host the site with information and resources for those potentially affected. These sorts of lookalike domains are often used by phishing scams, so asking customers to trust this one was a monumental failure in infosec procedure. Worse, on multiple occasions official Equifax social media accounts erroneously directed people to securityequifax2017.com instead; fortunately, the person who had snapped up that URL used it for good, directing the 200,000 (!) visitors it received to the correct site .

Meanwhile, the real equifaxsecurity2017.com breach site was judged insecure by numerous observers, and may have just been telling everyone that they were affected by the breach whether they really were or not . Language on the site (later retracted by Equifax) implied that just by checking to see if you were affected meant that you were giving up your right to sue over it . And in the end, if you were affected, you were directed to enroll in an Equifax ID protection service — for free, but how much do you trust the company at this point?

What happened to Equifax after the data breach?

What, ultimately, was the Equifax breach’s impact? Well, the upper ranks of Equifax’s C-suite rapidly turned over . Legislation sponsored by Elizabeth Warren and others that would’ve imposed fines on credit-reporting agencies that get hacked went nowhere in the Senate.

That doesn’t mean the Equifax breach cost the company nothing, though. Two years after the breach, the company said it had spent $1.4 billion on cleanup costs , including “incremental costs to transform our technology infrastructure and improve application, network, [and] data security.” In June 2019, Moody’s downgraded the company’s financial rating in part because of the massive amounts it would need to spend on infosec in the years to come. In July 2019 the company reached a record-breaking settlement with the FTC, which wrapped up an ongoing class action lawsuit and will require Equifax to spend at least $1.38 billion to resolve consumer claims.

Was I affected by the Equifax breach?

This was a lot of anguish just to find out if you were one of the unlucky 40 percent of Americans whose data was stolen in the hack. Things have settled down in the subsequent years, and now there’s a new site where you can check to see if you’re affected, with yet another somewhat confusing name: eligibility.equifaxbreachsettlement.com/en/Eligibility .

That settlement eligibility website actually isn’t hosted by Equifax at all; instead, it’s from the FTC.

How does the Equifax settlement work?

The Equifax settlement dangles the prospect that you might get a check for your troubles, but there are some catches. The settlement mandates that Equifax compensate anyone affected by the breach with credit monitoring services; Equifax wants you to sign up for their own service, of course, and while they will also give you a $125 check to go buy those services from somewhere else, you have to show that you do have alternate coverage to get the money (though you could sign up for a free service).

More cash is available if you’ve actually lost money from identity theft or spent significant amounts of time dealing with the fallout, but here, too, documentation is required. And that $125 is just a maximum; it almost certainly will go down if too many people request checks .

What are the lessons learned from the Equifax breach?

If we wanted to make a case study of the Equifax breach, what lessons would we pull from it? These seem to be the big ones:

• Get the basics right. No network is invulnerable. But Equifax was breached because it failed to patch a basic vulnerability, despite having procedures in place to make sure such patches were applied promptly. And huge amounts of data was exfiltrated unnoticed because someone neglected to renew a security certificate. Equifax had spent millions on security gear , but it was poorly implemented and managed.
• Silos are defensible. Once the attackers were inside the perimeter, they were able to move from machine to machine and database to database . If they had been restricted to a single machine, the damage would’ve been much less.
• Data governance is key — especially if data is your business. Equifax’s databases could’ve been stingier in giving up their contents . For instance, users should only be given access to database content on a “need to know basis”; giving general access to any “trusted” users means that an attacker can seize control of those user accounts and run wild. And systems need to keep an eye out for weird behavior; the attackers executed up to 9,000 database queries very rapidly, which should’ve been a red flag.

Related content

Spam blocklist sorbs shuts down after over two decades, new ransomhub ransomware gang has ties to older knight group, whitelisting explained: how it works and where it fits in a security program, how amazon ciso amy herzog responds to cybersecurity challenges, from our editors straight to your inbox.

Josh Fruhlinger is a writer and editor who lives in Los Angeles.

More from this author

Download our password managers enterprise buyer’s guide, cism certification: requirements, training, exam, and cost, two-factor authentication (2fa) explained: how it works and how to enable it, most popular authors.

• Microsoft Security

Show me more

Fbi offers to share 7,000 lockbit ransomware decryption keys with cisos.

Complaints in EU challenge Meta’s plans to utilize personal data for AI

What CISOs need to know about Microsoft’s Copilot+

CSO Executive Sessions: The new realities of the CISO role - whistleblowing and legal liabilities

CSO Executive Sessions India with Pradipta Kumar Patro, Global CISO and Head IT Platform, KEC International

CSO Executive Sessions: The personality of cybersecurity leaders

Sponsored Links

• Tomorrow’s cybersecurity success starts with next-level innovation today. Join the discussion now to sharpen your focus on risk and resilience.

Home  >  Learning Center  >  Cyber Attack  

Article's content

Need help protecting your applications?

See how imperva can help, cyber attack, what is a cyber attack.

A cyber attack is a set of actions performed by threat actors, who try to gain unauthorized access, steal data or cause damage to computers, computer networks, or other computing systems. A cyber attack can be launched from any location. The attack can be performed by an individual or a group using one or more tactics, techniques and procedures (TTPs).

The individuals who launch cyber attacks are usually referred to as cybercriminals, threat actors, bad actors, or hackers. They can work alone, in collaboration with other attackers, or as part of an organized criminal group. They try to identify vulnerabilities—problems or weaknesses in computer systems—and exploit them to further their goals.

Cybercriminals can have various motivations when launching cyber attacks. Some carry out attacks for personal or financial gain. Others are “ hacktivists ” acting in the name of social or political causes. Some attacks are part of cyberwarfare operations conducted by nation states against their opponents, or operating as part of known terrorist groups.

This is part of an extensive series of guides about application security .

Cyber Attack Statistics

What are the costs and impact of cyber attacks for businesses?

The global cost of cyber attacks is expected to grow by 15% per year and is expected to reach over $10 trillion. A growing part of this cost is Ransomware attacks, which now cost businesses in the US $20 billion per year.

The average cost of a data breach in the US is $3.8 million. Another alarming statistic is that public companies lose an average of 8% of their stock value after a successful breach.

How well are organizations prepared for cyber attacks?

In a recent survey, 78% of respondents said they believe their company’s cybersecurity measures need to be improved. As many as 43% of small businesses do not have any cyber defenses in place. At the same time, organizations of all sizes are facing a global cybersecurity skills shortage, with almost 3.5 million open jobs worldwide, 500,000 of them in the US alone.

PCI DSS 4.0 is almost here – are you ready?

Register Now

Cyber Attack Examples

Here are a few recent examples of cyber attacks that had a global impact.

Kaseya Ransomware Attack

Kaseya, a US-based provider of remote management software, experienced a supply chain attack, which was made public on July 2, 2021. The company announced that attackers could use its VSA product to infect customer machines with ransomware.

The attack was reported to be highly sophisticated, chaining together several new vulnerabilities discovered in the Kaseya product: CVE-2021-30116 (credentials leak and business logic flaw), CVE-2021-30119 (XSS), and CVE-2021-30120 (two-factor authentication flaw). The malware exploiting these vulnerabilities was pushed to customers using a fake software update labelled “Kaseya VSA Agent Hot Fix”.

The attack was carried out by the Russian-based REvil cybercrime group. Kaseya said less than 0.1% of their customers were affected by the breach, however, some of them were managed service providers (MSP) who used Kaseya software, and the attack affected their customers. A short time after the attack, press reports said 800-1500 small to mid-sized companies were infected by REvil ransomware as a result of the attack.

SolarWinds Supply Chain Attack

This was a massive, highly innovative supply chain attack detected in December 2020, and named after its victim, Austin-based IT management company SolarWinds. It was conducted by APT 29, an organized cybercrime group connected to the Russian government.

The attack compromised an update meant for SolarWinds’s software platform, Orion. During the attack, threat actors injected malware, which came to be known as the Sunburst or Solorigate malware—into Orion’s updates. The updates were then distributed to SolarWinds customers.

The SolarWinds attack is considered one of the most serious cyber espionage attacks on the United States, because it successfully breached the US military, many US-based federal agencies, including agencies responsible for nuclear weapons, critical infrastructure services, and a majority of Fortune 500 organizations.

Amazon DDoS Attack

In February 2020, Amazon Web Services (AWS) was the target of a large-scale distributed denial of service (DDoS) attack. The company experienced and mitigated a 2.3 Tbps (terabits per second) DDoS attack, which had a packet forwarding rate of 293.1 Mpps and a request rate per second (rps) of 694,201. It is considered one of the largest DDoS attacks in history.

Microsoft Exchange Remote Code Execution Attack

In March 2021, a large-scale cyber attack was carried out against Microsoft Exchange, a popular enterprise email server. It leveraged four separate zero-day vulnerabilities discovered in Microsoft Exchange servers.

These vulnerabilities enable attackers to forge untrusted URLs, use them to access an Exchange Server system, and provide a direct server-side storage path for malware. It is a Remote Code Execution (RCE) attack, which allows attackers to completely compromise a server and gain access to all its data. On affected servers, attackers stole sensitive information, injected ransomware, and deployed backdoors in a way that was almost untraceable.

In the United States alone, the attacks affected nine government agencies and more than 60,000 private businesses.

Twitter Celebrities Attack

In July 2020, Twitter was breached by a group of three attackers, who took over popular Twitter accounts. They used social engineering attacks to steal employee credentials and gain access to the company’s internal management systems, later identified by Twitter as vishing (phone phishing).

Dozens of well-known accounts were hacked, including Barack Obama, Jeff Bezos, and Elon Musk. The attackers used the stolen accounts to post bitcoin scams and earned more than $100,000. Two weeks after the events, the US Justice Department charged three suspects, one of whom was 17 years old at the time.

Other Notable Attacks

• Marriott’s Starwood Hotels announced a breach that leaked the personal data of more than 500 million guests.
• UnderArmor’s MyFitnessPal brand leaked the email addresses and login information of 150 million user accounts.
• The WannaCry ransomware attack affected more than 300,000 computers in 150 countries, causing billions of dollars in damages.
• Equifax experienced an open source vulnerability in an unpatched software component, which leaked the personal information of 145 million people.
• The NotPetya attack hit targets around the world, with several waves continuing for more than a year, costing more than $10 billion in damage.
• An attack on the FriendFinder adult dating website compromised the data of 412 million users.
• Yahoo’s data breach incident compromised the accounts of 1 billion users, not long after a previous attack exposed personal information contained in 500 million user accounts.

6 Types of Cyber Attacks

While there are thousands of known variants of cyber attacks, here are a few of the most common attacks experienced by organizations every day.

Ransomware is malware that uses encryption to deny access to resources (such as the user’s files), usually in an attempt to compel the victim to pay a ransom. Once a system has been infected, files are irreversibly encrypted, and the victim must either pay the ransom to unlock the encrypted resources, or use backups to restore them.

Ransomware is one of the most prevalent types of attacks, with some attacks using extortion techniques, such as threatening to expose sensitive data if the target fails to pay the ransom. In many cases, paying the ransom is ineffective and does not restore the user’s data.

There are many types of malware , of which ransomware is just one variant. Malware can be used for a range of objectives from stealing information, to defacing or altering web content , to damaging a computing system permanently.

The malware landscape evolves very quickly, but the most prevalent forms of malware are:

• Botnet Malware —adds infected systems to a botnet, allowing attackers to use them for criminal activity
• Cryptominers —mines cryptocurrency using the target’s computer
• Infostealers —collects sensitive information on the target’s computer
• Banking trojans —steals financial and credential information for banking websites
• Mobile Malware —targets devices via apps or SMS
• Rootkits —gives the attacker complete control over a device’s operating system

DoS and DDoS Attacks

Denial-of-service (DoS) attacks overwhelm the target system so it cannot respond to legitimate requests. Distributed denial-of-service (DDoS) attacks are similar but involve multiple host machines. The target site is flooded with illegitimate service requests and is forced to deny service to legitimate users. This is because servers consume all available resources to respond to the request overload.

These attacks don’t provide the attacker with access to the target system or any direct benefit. They are used purely for the purpose of sabotage, or as a diversion used to distract security teams while attackers carry out other attacks.

Firewalls and network security solutions can help protect against small-scale DoS attacks. To protect against large scale DDoS, organizations leverage cloud-based DDoS protection which can scale on demand to respond to a huge number of malicious requests.

Phishing and Social Engineering Attacks

Social engineering is an attack vector that relies heavily on human interaction, used in over 90% of cyberattacks. It involves impersonating a trusted person or entity, and tricking individuals into granting an attacker sensitive information, transferring funds, or providing access to systems or networks.

Phishing attacks occur when a malicious attacker obtains sensitive information from a target and sends a message that appears to be from a trusted and legitimate source. The name “phishing” alludes to the fact that attackers are “fishing” for access or sensitive information, baiting the unsuspecting user with an emotional hook and a trusted identity.

As part of a phishing message, attackers typically send links to malicious websites, prompt the user to download malicious software, or request sensitive information directly through email, text messaging systems or social media platforms. A variation on phishing is “spear phishing”, where attackers send carefully crafted messages to individuals with special privileges, such as network administrators, executives, or employees in financial roles.

MitM Attacks

Man-in-the-Middle (MitM) attacks are breaches that allow attackers to intercept the data transmitted between networks, computers or users. The attacker is positioned in the “middle” of the two parties and can spy on their communication, often without being detected. The attacker can also modify messages before sending them on to the intended recipient.

You can use VPNs or apply strong encryption to access points to protect yourself from MitM attacks.

Fileless Attacks

Fileless attacks are a new type of malware attack, which takes advantage of applications already installed on a user’s device. Unlike traditional malware, which needs to deploy itself on a target machine, fileless attacks use already installed applications that are considered safe, and so are undetectable by legacy antivirus tools.

Fileless malware attacks can be triggered by user-initiated actions, or may be triggered with no user action, by exploiting operating system vulnerabilities. Fileless malware resides in the device’s RAM and typically access native operating system tools, like PowerShell and Windows Management Instrumentation (WMI) to inject malicious code.

A trusted application on a privileged system can carry out system operations on multiple endpoints, making them ideal targets for fileless malware attacks.

Cyber Attack Prevention: Common Cybersecurity Solutions

Following are a few security tools commonly deployed by organizations to prevent cyber attacks. Of course, tools are not enough to prevent attacks—every organization needs trained IT and security staff, or outsourced security services, to manage the tools and effectively use them to mitigate threats.

Web Application Firewall (WAF)

A WAF protects web applications by analyzing HTTP requests and detecting suspected malicious traffic. This may be inbound traffic, as in a malicious user attempting a code injection attack, or outbound traffic, as in malware deployed on a local server communicating with a command and control (C&C) center.

WAFs can block malicious traffic before it reaches a web application, and can prevent attackers from exploiting many common vulnerabilities—even if the vulnerabilities have not been fixed in the underlying application. It complements traditional firewalls and intrusion detection systems (IDS), protecting attacks performed by attackers at the application layer (layer 7 of the OSI network model).

DDoS Protection

A DDoS protection solution can protect a network or server from denial of service attacks. It does this using dedicated network equipment, deployed on-premises by the organization, or as a cloud-based service. Only cloud based services are able to deflect large scale DDoS attacks, which involve millions of bots, because they are able to scale on demand.

A DDoS protection system or service monitors traffic to detect a DDoS attack pattern, and distinguish legitimate from malicious traffic. When it detects an attack, it performs “scrubbing”, inspecting traffic packets and dropping those that are deemed malicious, preventing them from reaching the target server or network. At the same time, it routes legitimate traffic to the target system to ensure there is no disruption of service.

Bot Protection

Bots make up a large percentage of Internet traffic. Bots put a heavy load on websites, taking up system resources. While some bots are useful (such as bots that index websites for search engines), others can perform malicious activities. Bots can be used for DDoS, to scrape content from websites, automatically perform web application attacks, spread spam and malware, and more.

A bot protection system detects and blocks bad bots, while allowing legitimate bots to perform activities like search indexing, testing and performance monitoring. It does this by maintaining a large database of known bot sources, and detecting behavior patterns that might indicate a bot is malicious.

Cloud Security

Almost all organizations today manage infrastructure, applications, and data in the cloud. Cloud systems are especially vulnerable to cyber threats, because they are commonly exposed to public networks, and often suffer from a low level of visibility, because they are highly dynamic and running outside the corporate network.

Cloud providers take responsibility for securing their infrastructure, and offer built-in security tools that can help cloud users secure their data and workloads. However, first-party cloud security tools are limited, and there is no guarantee that they are being used properly and all cloud resources are really secured. Many organizations use dedicated cloud security solutions to ensure that all sensitive assets deployed in the cloud are properly protected.

Database Security

Databases typically hold sensitive, mission critical information, and are a prime target for attackers. Securing databases involves hardening database servers, properly configuring databases to enable access control and encryption, and monitoring for malicious activities.

Database security solutions can help ensure a consistent level of security for databases across the organization. They can help prevent issues like excessive privileges, unpatched vulnerabilities in database engines, unprotected sensitive data, and database injection.

API Security

Modern applications use application programming interfaces (APIs) to communicate with other applications, to obtain data or services. APIs are used to integrate systems inside an organization, and are increasingly used to contact and receive data from systems operated by third parties.

All APIs, especially public APIs that are accessed over the Internet, are sensitive to attacks. Because APIs are highly structured and documented, they are easy for attackers to learn and manipulate. Many APIs are not properly secured, may be weakly authenticated, or exposed to vulnerabilities like cross site scripting (XSS), SQL injection, and man in the middle (MitM) attacks.

Securing APIs requires a variety of measures, including strong multi factor authentication (MFA), secure use of authentication tokens, encryption of data in transit, and sanitization of user inputs to prevent injection attacks. API solutions can help enforce these security controls for APIs in a centralized manner.

Threat Intelligence

Threat intelligence operates in the background and supports many modern security tools. It is also used directly by security teams when investigating incidents. Threat intelligence databases contain structured information, gathered from a variety of sources, about threat actors, attack tactics, techniques, and procedures, and known vulnerabilities in computing systems.

Threat intelligence solutions gather data from a large number of feeds and information sources, and allows an organization to quickly indicators of compromise (IOCs), use them to identify attacks, understand the motivation and mode of operation of the threat actor, and design an appropriate response.

Cyber Attack Prevention with Imperva

Imperva provides security solutions that protect organizations against all common cyber attacks.

Imperva Application Security

Imperva provides comprehensive protection for applications, APIs, and microservices:

Web Application Firewall – Prevent attacks with world-class analysis of web traffic to your applications.

Runtime Application Self-Protection (RASP) – Real-time attack detection and prevention from your application runtime environment goes wherever your applications go. Stop external attacks and injections and reduce your vulnerability backlog.

API Security – Automated API protection ensures your API endpoints are protected as they are published, shielding your applications from exploitation.

Advanced Bot Protection – Prevent business logic attacks from all access points – websites, mobile apps and APIs. Gain seamless visibility and control over bot traffic to stop online fraud through account takeover or competitive price scraping.

DDoS Protection – Block attack traffic at the edge to ensure business continuity with guaranteed uptime and no performance impact. Secure your on premises or cloud-based assets – whether you’re hosted in AWS, Microsoft Azure, or Google Public Cloud.

Attack Analytics – Ensures complete visibility with machine learning and domain expertise across the application security stack to reveal patterns in the noise and detect application attacks, enabling you to isolate and prevent attack campaigns.

Client-Side Protection – Gain visibility and control over third-party JavaScript code to reduce the risk of supply chain fraud, prevent data breaches, and client-side attacks.

Imperva Data Security

Imperva protects all cloud-based data stores to ensure compliance and preserve the agility and cost benefits you get from your cloud investments:

Cloud Data Security – Simplify securing your cloud databases to catch up and keep up with DevOps. Imperva’s solution enables cloud-managed services users to rapidly gain visibility and control of cloud data.

Database Security – Imperva delivers analytics, protection and response across your data assets, on-premise and in the cloud – giving you the risk visibility to prevent data breaches and avoid compliance incidents. Integrate with any database to gain instant visibility, implement universal policies, and speed time to value.

Data Risk Analysis – Automate the detection of non-compliant, risky, or malicious data access behavior across all of your databases enterprise-wide to accelerate remediation.

See Additional Guides on Key Application Security Topics

Together with our content partners, we have authored in-depth guides on several other topics that can also be useful as you explore the world of application security .

Authored by Bright Security

• What Is API security? The Complete Guide
• REST API Testing: The Basics and 8 API Testing Tips
• WS-Security: Is It Enough to Secure Your SOAP Web Services?

Vulnerability Management

• Vulnerability Management: Lifecycle, Tools, and Best Practices
• Vulnerability Examples: Common Types and 5 Real World Examples
• Vulnerability Testing: Methods, Tools, and 10 Best Practices
• Cross-Site Request Forgery (CSRF): Impact, Examples, and Prevention
• Open Redirect Vulnerability: Impact, Severity, and Prevention
• How to test for Cross-Site Request Forgery?

Latest Blogs

Nadav Avital

Apr 4, 2024 2 min read

Mar 28, 2024 4 min read

Daniel Johnston

, Yohann Sillam

Mar 20, 2024 3 min read

Feb 19, 2024 6 min read

Jan 11, 2024 5 min read

, Sofia Naer

Dec 19, 2023 2 min read

Dec 14, 2023 5 min read

Dec 14, 2023 3 min read

Latest Articles

• Cybersecurity 101

190.2k Views

120.6k Views

118.5k Views

99.1k Views

59.2k Views

58.3k Views

2024 Bad Bot Report

Bad bots now represent almost one-third of all internet traffic

The State of API Security in 2024

Learn about the current API threat landscape and the key security insights for 2024

Protect Against Business Logic Abuse

Identify key capabilities to prevent attacks targeting your business logic

The State of Security Within eCommerce in 2022

Learn how automated threats and API attacks on retailers are increasing

Prevoty is now part of the Imperva Runtime Protection

Protection against zero-day attacks

No tuning, highly-accurate out-of-the-box

Effective against OWASP top 10 vulnerabilities

An Imperva security specialist will contact you shortly.

Top 3 US Retailer

What are the 4 Types of Threat Intelligence?

Top 4 use cases for a threat intel platform (tip), specific examples of threat intelligence use cases.

• MITRE ATT&CK as a Threat Intelligence Use Case

Threat Intelligence Use Cases FAQs

Threat intelligence use cases and examples.

• 1. What are the 4 Types of Threat Intelligence?
• 2. Top 4 Use Cases for a Threat Intel Platform (TIP)
• 3. Specific Examples of Threat Intelligence Use Cases
• 4. MITRE ATT&CK as a Threat Intelligence Use Case
• 5. Threat Intelligence Use Cases FAQs

Threat intelligence provides organizations with valuable information about potential cyberthreats and vulnerabilities. The ability to survey the entire threat landscape is essential, requiring organizations to prioritize threat intelligence.

Threat intelligence use cases encompass a wide range of activities and strategies aimed at identifying, mitigating, and responding to cyberthreats. The specific use cases that are most relevant to an organization depend on its industry, size, and unique cybersecurity needs. As a rule, the more an organization relies on applications, digital tools, and technology-driven workflows for its business operations, the more use cases it identifies for threat intelligence.

Understanding the various types of threat intelligence is a cornerstone of effective cybersecurity. The landscape of cyberthreats is complex and dynamic, demanding a nuanced approach to defense. In this exploration, the focus is on the different categories of threat intelligence - tactical, operational, strategic, and technical - each serving a distinct purpose. These types are dissected to reveal their unique roles in helping organizations anticipate, identify, and respond to cyberthreats, providing a comprehensive view of how they collectively fortify cybersecurity measures.

Strategic Threat Intelligence

Strategic threat intelligence refers to the broad analysis of the cyberthreat landscape with an emphasis on long-term trends. Its core purpose is to inform decision-makers about the overarching cyber risks that could impact an organization's future. Strategic threat intelligence is the starting point of an enterprise-wide cybersecurity intelligence program.

Unlike its more immediate counterparts, strategic intelligence deals less with the technical specifics of daily threats and more with the analysis of potential future risks, emerging threat patterns, geopolitical developments, and the implications of new technologies and laws on cybersecurity.

Tactical Threat Intelligence

Tactical threat intelligence provides detailed information on the tactics, techniques, and procedures (TTPs) employed by cyberthreat actors. Its purpose is to give IT security teams the insights formed from comprehensive data collection to strengthen defenses and respond to threats in real time. Tactical intelligence often includes specifics such as malware signatures, indicators of compromise (IoCs), and analysis of threat actor behavior.

This type of intelligence focuses on the current methods attackers use, offering insights into the latest cyberthreats. Security teams use this information to update firewalls, enhance security protocols, and train personnel to recognize and mitigate these risks. Tactical intelligence keeps pace with the rapidly changing threat landscape, enabling security measures to be as current as possible.

Operational Threat Intelligence

Operational threat intelligence pertains to the specifics of individual cyberthreats and campaigns. It provides insights into the motivations, targets, and methods of attackers, often in real time. This intelligence is crucial for incident response teams who need to understand the context of an attack to effectively counteract it.

Technical Threat Intelligence

Technical threat intelligence allows teams to conduct proactive threat hunting, analyze security incidents in depth, and locate forensic evidence, which is critical for defending against and mitigating the impact of cyberattacks. It also provides a foundation for enhancing security measures, keeping systems updated against known threats, and improving an organization’s resilience.

A threat intelligence platform (TIP) ’s primary goal is to help organizations proactively defend against cyberthreats by providing timely and relevant information about intent and capabilities of relevant threat actors. The platform plays an important role in cybersecurity strategy, enabling organizations to enhance their threat detection, response, and mitigation capabilities.

There are many use cases where cybersecurity threat intelligence plays a critical role in the digital health of an organization, its people, and its assets. These use cases fall into several broad categories, including:

• Threat Identification
• Threat Prevention
• Threat Remediation

1. Incident Enrichment Using Threat Intel Data

Problem : Most tools that security operations centers (SOCs) and incident response (IR) teams use to respond to alerts are very generic. There is not much correlation between network data and understanding of threats and attacker movements.

Many times there is a dump of information including bad IP addresses or domains and someone has to be assigned to resolve them and figure out false positives manually. In addition, there is a lack of understanding of malicious families, hacking tools and their patterns of attacks.

This process is cumbersome, takes a lot of time, and is impractical. This is especially true in the present security scenario, where hundreds, if not thousands, of indicators are collected daily.

Solution : Accelerating incident response with TIP and alert enrichment using threat intelligence (TI) data.

Incident enrichment workflow in Cortex XSOAR Threat Intelligence Management (TIM) leverages TI from their very own high-fidelity centralized threat intelligence library.

Research data from Unit 42 to learn more about:

• Known malware campaigns or families
• IPs and domains with WHOIS data
• Passive DNS data
• Web categorization data

The video below provides you with a glimpse into our next release, TIM 3.0 , and explores the enhancements and capabilities listed above, including how they can assist you in responding to incidents with confidence.

2. Proactive Blocking of Threats

Problem: The security team needs to leverage TI to block or alert on indicators of compromise (IoC) such as known bad domains, IPs, and hashes, using detection response tools and techniques. The indicators are being collected from many different sources that need to be normalized, scored, and analyzed before the customer can push to security devices such as SIEM and firewall for alerting. Detection tools can only handle limited amounts of TI data and must constantly re-prioritize indicators.

Solution: Proactive threat monitoring with playbook-driven automation.

With indicator prioritization, you can ingest alerts from email inboxes through integrations. Once an alert is ingested, a playbook is triggered and can have any combination of automated or manual actions that users desire. The playbooks can have filters and conditions that execute different branches depending on certain values.

Here is a demo of how TIM works with proactive blocking of threats.

3. Intelligence Reporting and Distribution

Problem: TI programs have a growing set of responsibilities. One key responsibility is producing and disseminating TI reports that keep employees updated on the latest threats targeting their industry.

Most intelligence is still shared via unstructured formats such as email and blogs. Sharing information about IOC is not enough. Additional context is required for the shared intelligence to have value.

Analysts go through hours of manual work to create reports by performing the following activities:

• Aggregating and digging for news of known malware families
• Curating news and threats related to the company or vertical for an industry
• Describing why the stories are relevant to the company

The analysts then need to send this report to a large audience to raise security awareness and alert other stakeholders so they can facilitate better-informed decisions in the future.

Solution: Workflows and a central repository for intelligence analysts to create, collaborate and share finished intelligence products with stakeholders via PDF reports. Intel analysts will be able to understand trends within TI using their local/curated intel and Unit 42 Threat Intelligence.

4. External Threat Landscape Modeling

Problem: TI teams need to understand details of attacks and how their organization may be vulnerable. The foundational element of understanding risk/impact to an organization begins when threat analysts begin profiling the attacks.

Solution: Threat modeling is employed to prevent or mitigate the impact of threats on the system. The threat intel team is responsible for contsructing profiles of threat actors, determining the existence of elated attacks, and identifying the techniques and tools used by the threat actor. Subsequently, this information is shared with key stakeholders, including security operations and leadership team.

See this demo to see how external threat landscaping is done in a real scenario.

Together, these use cases form the basis of a cybersecurity threat intelligence framework that acts as a guideline for using various threat intelligence sources to spot potential cyber problems before they have a substantial impact. Threat intelligence use cases typically align with one or more different types of threat intelligence.

Watch our video to see how external threat landscaping is done in a real scenario.

MITRE ATT&CK as a Threat Intelligence Use Case

MITRE ATT&CK (Adversarial Tactics, Techniques, and Common Knowledge) is a security framework threat hunters use. Organizations use MITRE ATT&CK to determine the tactics, techniques, and procedures (TTPs) used by cyber adversaries. TI teams and organizations can use MITRE ATT&CK in various ways to enhance their cybersecurity efforts.

Here are several ways MITRE ATT&CK can be used for TI:

• Security Operations : Security teams can use ATT&CK to match real-time events and behaviors to known attack patterns, enhancing detection and response capabilities.
• Threat Hunting : Threat hunters can leverage ATT&CK to search for new, or previously undetected, activities within an environment that aligns with known adversary behaviors.
• Red Teaming/Adversary Emulation : Teams can use ATT&CK to emulate an adversary's TTPs and test the effectiveness of security controls and incident response capabilities.
• Gap Analysis : ATT&CK can help organizations identify and prioritize the security gaps adversaries most likely exploit. It can show which tactics and techniques are not adequately covered by existing defenses.
• Security Assessment and Engineering : Engineers can use the ATT&CK framework to design and assess security architectures, ensuring that controls are in place to detect or mitigate specific adversary behaviors.
• Incident Response : Incident responders can use ATT&CK to categorize adversary behavior during an investigation, allowing them to determine the scope of an intrusion and develop effective remediation plans.
• Threat Intelligence : Analysts can compare external threat reports with the ATT&CK framework to understand adversaries' tactics and procedures and communicate about them using a common language.
• Education and Training : ATT&CK can serve as a training guide for new cybersecurity professionals to understand common adversary behaviors and the lifecycle of cyberattacks.
• Behavioral Analytics Development : Security teams can develop new analytics based on ATT&CK to detect adversarial behavior across different stages of the attack lifecycle.
• Risk Assessment : Risk management teams can use ATT&CK to better understand the risks associated with specific adversary behaviors and develop strategies to mitigate those risks.

Using MITRE ATT&CK involves integrating the framework into various cybersecurity practices to improve understanding, detection, and prevention of cyber threats. MITRE ATT&CK helps organizations understand who is targeting them and their industry, allowing for more informed threat response and proactive defense measures. It can also aid in sharing TI with the broader cybersecurity community.

While MITRE ATT&CK provides a valuable framework for understanding adversary behavior, it may not always lead to conclusive attribution on its own. Nonetheless, it is a critical tool for building a comprehensive understanding of the tactics and techniques used by threat actors, aiding in defense and response efforts.

Which members of an organization determine the best use cases for cyber threat intelligence?

What is a good way to determine which use case should be utilized for ti, which metrics are essential to evaluate the effectiveness of ti in key use cases.

Related Content

Cyberthreat intelligence enhances cybersecurity by analyzing and sharing insights on digital threats, helping organizations preemptively defend against cyber attacks.

Threat intelligence management is the process of effectively managing threat intelligence data. Learn about Palo Alto Networks’ threat intelligence management.

Cortex XSOAR Threat Intelligence Management (TIM) takes a unique approach to native threat intelligence management, unifying aggregation, scoring, and sharing of threat intelligenc...

Enhance SOC efficiency with extended SOAR: Aggregating threat intel for complete control, quick response, and better collaboration.

Get the latest news, invites to events, and threat alerts

By submitting this form, you agree to our Terms of Use and acknowledge our Privacy Statement .

• USA (ENGLISH)
• AUSTRALIA (ENGLISH)
• BRAZIL (PORTUGUÉS)
• CANADA (ENGLISH)
• CHINA (简体中文)
• FRANCE (FRANÇAIS)
• GERMANY (DEUTSCH)
• INDIA (ENGLISH)
• ITALY (ITALIANO)
• JAPAN (日本語)
• KOREA (한국어)
• LATIN AMERICA (ESPAÑOL)
• MEXICO (ESPAÑOL)
• SINGAPORE (ENGLISH)
• SPAIN (ESPAÑOL)
• TAIWAN (繁體中文)
• UK (ENGLISH)

Popular Resources

• Communities
• Content Library
• Event Center
• Products A-Z

Legal Notices

• Privacy Statement
• Trust Center
• Terms of Use
• Do Not Sell or Share My Personal Information

Popular Links

• Manage Email Preferences
• Product Certifications

• Skip to main content
• Skip to search
• Skip to footer

Products and Services

Cisco Secure Firewall

Do you have a firewall fit for today's challenges.

Does it harmonize your network, workload, and application security? Does it protect apps and employees in your hybrid or multicloud environment? Make sure you're covered.

Anticipate, act, and simplify with Secure Firewall

With workers, data, and offices located across the country and around the world, your firewall must be ready for anything. Secure Firewall helps you plan, prioritize, close gaps, and recover from disaster—stronger.

Lean on AI that simplifies policy management

Streamlining workflows. Finding misconfigurations. Auto-generating rules. With thousands of policies to manage and threats pouring in, Cisco AI Assistant saves time by simplifying how you manage firewall policy.

Achieve superior visibility

Regain visibility and control of your encrypted traffic and application environments. See more and detect more with Cisco Talos, while leveraging billions of signals across your infrastructure with security resilience.

Drive efficiency at scale

Secure Firewall supports advanced clustering, high availability, and multi-instance capabilities, enabling you to bring scalability, reliability, and productivity across your teams and hybrid network environments.

Make zero trust practical

Secure Firewall makes a zero-trust posture achievable and cost-effective with network, microsegmentation, and app security integrations. Automate access and anticipate what comes next.

Cisco AI Assistant for Security demo

Find the ideal firewall for your business.

1000 Series

Best for smaller businesses and branch offices.

1200 Series

Consolidate advanced security and networking of distributed enterprise branches with a compact, high-performing, SD-WAN firewall.

3100 Series

Enhanced for medium-sized enterprises, with the flexibility to grow in the future.

4100 Series

Security, speed, and scalability for a powerful data center.

4200 Series

Experience faster threat detection with greater visibility and the agility to safeguard large enterprise data center and campus networks.

9300 Series

Optimized for service providers and high-performance data centers.

Secure Firewall Threat Defense Virtual

Virtual firewalls for consistent policies across physical, cloud, and hyperconverged environments.

Secure Firewall ISA3000

Rugged design for manufacturing, industrial, and operational technology environments.

Secure WAF and bot protection

Enhance application security and resilience for today’s digital enterprise with Secure WAF and bot protection.

DDoS protection

Defend against attacks that flood your network with traffic, impacting access to apps and business-critical services.

Why migrate?

Level up your security posture with the latest capabilities for unified network and workload micro-segmentation protection.

Experience Firewall Management Center in action

See how you can centralize and simplify your firewall admin and intrusion prevention. With visibility across ever-changing and global networks, you can manage modern applications and malware outbreaks in real time.

Get 3 vital protections in a single step

You don't have to trade security for productivity. The Cisco Security Step-Up promotion deploys three powerful lines of defense that are simple, secure, and resilient for your business. Defend every critical attack vector–email, web traffic, and user credentials—in one easy step.

Add value to security solutions

Cisco Security Enterprise Agreement

Instant savings

Experience security software buying flexibility with one easy-to-manage agreement.

Services for security

Let the experts secure your business

Get more from your investments and enable constant vigilance to protect your organization.

Customer stories and insights

Powering fuel providers.

Ampol's global business includes refineries, fueling stations, and corporate offices. The company's infrastructure and retail operations are protected and connected with Cisco technology.

Ampol Limited

Reducing cybersecurity risk

A zero-trust approach to security protects the privacy of patients' personal data at this Ohio children's hospital.

Dayton Children’s

Better wireless access and security

A Texas school district turned to Cisco technology to bring ubiquitous, reliable wireless access to students while assuring proactive network monitoring capabilities.

Protecting networks and assets

A Michigan-based credit union protects the digital security of its hybrid workforce, customers, and assets with help from Cisco.

Lake Trust Credit Union

Boosting visibility and security

This Indiana university provides reliable and safe network access with Cisco's unified security ecosystem as its foundation for zero trust.

Marian University

The NFL relies on Cisco

From the draft to Super Bowl Sunday, the NFL relies on Cisco to protect billions of devices, endpoints, and users from cyber threats. What does that look like on game day? Watch the video on the story page to find out.

National Football League

Simple, visible, and unified

Unify security across your high-performing data centers, providing superior visibility and efficiency. Then watch it work with ease.