Notes - MCS
Robust Software
Notes - MCS
Robust Software
  • Robust Software
  • Secure Software Design Principles
    • Motivation
    • Secure and Resilient/Robust Software
    • Best Practices for Resilient Applications
    • Designing Applications for Security and Resilience
    • Architecture for the Web/Cloud
  • Software Security Lifecycle
    • Motivation
    • Secure Development Lifecycle
    • Software Security Touchpoints
    • Software Assurance Forum for Excellence in Code (SAFECode)
    • Secure SW Lifecycle Processes Summary
    • Adaptations of the Secure Software Lifecycle
    • Assessing the Secure Software Lifecycle
    • Recommendations
  • Software Quality Attributes
    • Motivation
    • Software Quality Assurance
    • Software Quality Standards
    • Software Quality Attributes
    • Extra Software Quality Assurance Properties
  • Security Requirements
    • Motivation
    • Security Requirements
    • Threats
    • Defenses
    • Confidentiality
    • Integrity
    • Availability
    • What about other goals/properties?
    • Security Requirements Engineering
    • Types of Security Requirements
    • Security Policy
    • Precision
    • Completeness and Consistency
    • Examples of Non-Functional Requirements
    • Goals and Requirements
    • Measures
    • Requirements Interaction
    • Natural Language Requirements
    • Best Practices
  • Common Software Attacks
    • Objectives
    • 10 Major Cyber-Attacks of 21st Century
    • Software Security Basics
    • Defenses Methods
    • SANS SWAT Checklist
  • Safe Programming
    • Secure Coding Practices
    • Top 10 Secure Coding Practices (CERT/SEI)
    • 7 Pernitious Kingdoms
  • Robustness, PenTest, Fuzzy and Static Code Analysis
    • Security/Robustness Testing
    • Robustness Tests Checklist Example
    • Penetration Testing
    • Penetration Testing Roadmap
    • Tools
    • Fuzz Testing
    • Static Code Analysis
    • Side Channels
  • Safety (and Security)
    • Safety
    • A safety Lifecycle Example
    • Risk Management Process
    • System Definition
    • Hazard Identification and Classification
    • Desk-based Hazard Identification
    • Workshop-based Hazard Identification
    • HAZOP
    • Hazard Identification and Classification
      • Broadly acceptable risks
    • Risk Evaluation and Risk Acceptance
    • Use of codes of practice
    • Use of reference system
    • Explicit risk estimation
    • Qualitative risk estimation
    • Quantitative risk estimation
    • Safety measures
    • Safety requirements
    • Hazard Management
    • Hazard life cycle
    • Independent Assessment
    • Safety Plan
    • Safety Case
    • FMEA Example
    • DevSecOps
Powered by GitBook
On this page
  • 1. Cyber-Attack on Yahoo!
  • 2. eBay Cyber-Attack
  • 3. Equifax Cyber Attack
  • 4. Target Stores Data Breach
  • 5. Uber Cyber-Security Breach
  • 6. JP Morgan Chase Data Breach
  • 7. US Office of Personnel Management – The OPM Data Breach
  • 8. Cyber Attack on Sony PlayStation Network
  • 9. RSA Security Attack
  • 10. Adobe Cyber Attack
  1. Common Software Attacks

10 Major Cyber-Attacks of 21st Century

1. Cyber-Attack on Yahoo!

  • Personal info, passwords, security questions, and answers of 3 billion users.

  • The Yahoo group once valued at $100 billion was sold to Verizon for $4.48 billion.

2. eBay Cyber-Attack

  • User’s database hacking by using corporate employee’s accounts.

  • May 2014.

  • Complete access to the network for 229 days.

  • Personal info, and encrypted passwords of around 145 million users.

  • The financial data of the customers was not compromised.

  • Criticism of the company and losses.

3. Equifax Cyber Attack

  • US credit bureau.

  • Major blow - data of 143 million customers hacked.

  • Personal and sensitive access.

  • The credit card information of around 209,000 consumers was stolen.

  • An application vulnerability on their site resulted in a data attack.

  • The attack was exposed on July 29, 2017, but probably started mid-May.

4. Target Stores Data Breach

  • December 2013.

  • A data breach compromised the Credit/debit card details and/or contact information of around 110 million people.

  • Access to the private network by exploiting a vulnerability through a third-party vendor for the HVAC system to POS payment card readers.

  • Cyber-attacks cost around $162 million.

  • CEO and CIO resigned.

5. Uber Cyber-Security Breach

  • Discovered in late 2016, and publicized 1 year later.

  • The data breach resulted in compromising the personal info of 57 million Uber users and 600,000 Uber driver’s driver license numbers.

  • Uber offered the hackers $100,000 to destroy the data without verifying they did.

  • Loss of reputation and finances of the company.

  • The company was in negotiation to sell its stakes to Softbank, at the time the breach was announced. The value of the deal lowered from $68 billion to $48 billion.

6. JP Morgan Chase Data Breach

  • July 2014.

  • Compromised info of 6 million households and 7 million small businesses.

  • No monetary losses.

  • The hackers gained privileges over 90 bank servers.

7. US Office of Personnel Management – The OPM Data Breach

  • Intrusion through a third-party contractor.

  • Started in 2012 – discovered March 20, 2014.

  • Another in May 2014, discovered almost 1 year later.

  • Security clearance data and fingerprint information of over 22 million current and past federal workers.

8. Cyber Attack on Sony PlayStation Network

  • April 20, 2011.

  • Biggest data breach in the gaming industry.

  • 77 million Network accounts. These accounts had 12 million accounts that had unencrypted credit card numbers.

  • Personal info, logins, and passwords.

  • Losses are estimated at $171 million.

  • Initial $15 million reimbursement in a lawsuit over the breach.

9. RSA Security Attack

  • March 2011.

  • Cyber-security breach of the mighty security giant’s SecurID authentication tokens of the company RSA.

  • Phishing attacks on RSA employees and impersonated as individuals and intruded into the network of the company.

  • Estimated to have stolen 40 million employee records.

10. Adobe Cyber Attack

  • October 2013.

  • Personal info, IDs, passwords, and debit and credit card information of over 38 million users.

  • Adobe paid $1 million as legal fees to resolve prerogatives of violating the Customer Records Act and biased business practices.

Last updated 1 year ago