Which to me means that they can be open to attacks as they learn about

Discussion 2

.

Respond to two colleagues (BELOW): (Half a page each and please, provide each reference separately)

Discussion Topic

Install Wireshark. Looking at the exploit in your Data Breach Assignment, how would Wireshark help to mitigate this risk? Explain your rationale.

Post from colleague 1

Good morning Professor and classmates,

The exploit I am looking into for my assignment is one that happened in the healthcare field, this field interests me because they have been a bit slower in my area to take on more computerized roles due to the patient files. Which to me means that they can be open to attacks as they learn about how to install these security systems, and what works and doesn’t for this valuable field.

The attack that happened, in particular, occurred this year, 2020, in Oregon. And the affected party is the Health Share of Oregon where an estimated 654,000 patient files were stolen because of a laptop that was not properly secured. The interesting part though is that the laptop belonged to a third party helping the Health Share of Oregon company with what they had to do. There was never any word on what security measures the laptop had on it, to me what could’ve corrected this problem is that the laptop should’ve had security measures in place, and if the laptop could easily be accessed than Wireshark could’ve helped by identifying any problems with wifi and cloud sources. By verifying these problems the security teams could release a patch, or change settings they need in order to make sure that the laptop was secured at least from the outside.

Davis, J. (2020, July 8). In UPDATE: The 10 Biggest Healthcare Data Breaches of 2020, So Far. Retrieved from https://healthitsecurity.com/news/the-10-biggest-healthcare-data-breaches-of-2020-so-far

Post from colleague 2

Install Wireshark. Looking at the exploit in your Data Breach Assignment, how would Wireshark help to mitigate this risk? Explain your rationale.

There was a data breach caused by a ransomware attack at Cognizant, an IT service giant with close to 300,000 employees and over $15 billion in revenue. The attack was discovered around April, 2020, called the April Maze Ransomware attack. Cognizant is one of the largest IT managing services company that remotely manages clients to fix issues, install patches and monitor their security. A ransomware called maze attacked their computer system and network, compromising their network between the 9th and 11th April 2020. During the attack, it ‘exfiltrated a limited amount of data from the Cognizant’s system’ (Abrams, Lawrence, 2020). They stole unencrypted files and used it to threaten the company that if the ransom was not paid, it would be released publicly.

Wireshark, once downloaded on the computer is used as a network sniffer, can be used to filter out the packets by typing different information in the filter. It can be used to monitor the IP address and coming in and going out of your network, analyzing each traffic, by filter them out based on different protocols. With this Cognizant would located the IP address of the cyber-criminals and discovered whatever would have been sent out to them. Luckily a packet containing the encryption key would also have been found.

It is advisable to keep Wireshark running from another device, to enable it to catch the information on time and decrypt it.

References:

Abrams, L., (2020 June 17). IT gaint Cognizant confirms data breach after ransomware attack. Bleeping Computer. Retrieved from https://www.bleepingcomputer.com/news/security/it-giant-cognizant-confirms-data-breach-after-ransomware-attack/

Krastev, V., (2016 May, 19). Use Wireshark to Decrypt Encoded Files by Ransomware. Sensors. Retrieved from https://sensorstechforum.com/use-wireshark-decrypt-ransomware-files/