So-net And Sony Bmg Greece Face Data Breach

By Author: eccuni
Total Articles: 211
Comment this article

Security woes for Sony continue. Recently, So-net Entertainment, a subsidiary of Sony Corporation and Sony BMG Greece suffered security breach. Over the last month, Sony has been in the news for repeated security breach incidents from that of PSN Network, online entertainment, password reset page to reported phishing site on company's Thailand server. The latest security breach incident at So-net, an Internet service provider based in Japan has resulted in unauthorized access to 201 customer accounts. Attackers were reportedly successful in redeeming over 1200 points related to 128 customer accounts. Cybercriminals were also successful in compromising 90 e-mail accounts. Information security professionals are investigating the incident. Preliminary investigations have not revealed breach of other sensitive information such as names, addresses and phone numbers. Attackers allegedly made 10,000 attempts to gain unauthorized access to customer reward service from a single Internet Protocol (IP) address.

In another security breach incident, attackers were successful in compromising the website of Sony BMG Greece. ...
... Intruders reportedly extracted sensitive information such as user names, real names, and e-mail addresses from customer databases. Attackers have allegedly exposed information on underground crime sites. Cybercriminals may misuse the gathered information for fraudulent purposes, launching phishing and spear-phishing attacks, conducting unauthorized transactions and impersonating legitimate users. According to researchers at Internet security firm, Sophos, attackers may have exploited SQL injection vulnerabilities on the website to insert malicious code.

Websites act as interface between an organization and customers. They not only provide information relation to product and services offered by a firm, but also allow third parties to advertise their offerings. Cybercriminals proactively scan the web to identify and exploit vulnerabilities. They may inject malicious codes on vulnerable websites, and redirect users to malicious websites.

Organizations must regular assess the weaknesses of the IT infrastructure through professionals qualified in masters of security science and penetration testing. In case of penetration tests, experts identify the threat vectors, and examine their exploitability. They then attempt to exploit the flaws to evaluate the strength of the IT infrastructure. They pre-empt intruders, and mimic the path followed by them to detect tangible threat. Penetration testers must also validate the threats identified and distinguish between false positives and false negatives initiate remediating measures for real security threats to IT infrastructure.

Improper input and output validation measures, single factor authentication, non-implementation of SSL, lack of adherence to security audit, lack of training, improper patch management, lack of proper implementation of IT security policy and non-validation of identified threats are some of the factors that cause vulnerabilities, and allow attackers to breach the security of the IT infrastructure. Organizations must place emphasis on effective implementation of IT security policies, regular security audits and employee training programs to reduce instances of security breach incidents. Mandatory online degree and e-learning programs may help employees in understanding security threats and implementing best practices in information security. IT professionals must be encouraged to undertake security certifications and online university degree courses to update themselves on latest security practices and improve the defenses of the IT infrastructure.