TalkTalk Hack Revisted

Now the dust has settled from the TalkTalk hack, what can be learnt to help other companies prevent a similar situation?

The impact of the hack on TalkTalk was rapid and dramatic; in one day its share price fell by 12% and in total an estimated £360 million was wiped off it’s value (stock value pictured). The direct one-off cost of dealing with the hack was reportedly more than £30 million.

A number of the alleged hackers have been arrested and it appears that rather than organised criminals or nation-state actors this hack was perpetrated by a group of teenagers ranging in age from 15 to 20.
 
Without belittling the skill of the teenagers, it is safe to say that of "threat actors" that concern corporations and governments, mischievous teenagers should sit somewhere near the bottom of the risk scale. The fact they appear to have been caught shows their lower level of expertise, and sets this hack apart from other notable cyber intrusions; such as Sony where it is still hotly debated who did it, let alone whether they will be brought to justice. Despite this, the hack showed just how much damage even a relatively unsophisticated group of hackers can still have on a company.

The publicity surrounding the hack was bad for TalkTalk’s share price, but at least TalkTalk identified they had been breached at all. One study found that in 2014 it took up to 205 days for most companies to discover a breach.

The same study also found that typically it takes hackers seconds to breach a system and only minutes to exfiltrate the data they are interested in. More often than not the public never knows about the many cyber intrusions that occur, making understanding the scale of the problem even more difficult.

In the Talktalk case the attackers reportedly used a simple vulnerability in the company website to launch what is known as a blind SQL injection attack; a way of querying and breaching the database sitting behind a website. This should not have been a difficult vulnerability to identify and fix. This was made worse by bad security procedures by TalkTalk; the creditials for one admin were found to be username: tim, password: tim.

The Teenagers in question are unlikely to have had a wider strategy for using, passing-on and profiting from the information they stole, which would undoubtedly already happened if the hack was carried out by an organised criminal group. A number of the hackers involved have already stated that it was actually done for “shits and giggles”.

This should give TalkTalk’s shareholders something to be happy about and the impact on customers and the data stolen is likely to be much lower than first suspected. In general the more public the hack, the easier it is to find what information has been stolen and easier to mitigate against any disclosure.

Suffering three public hacks in the space of a year makes it clear that TalkTalk is doing something wrong when it comes to cyber security. The latest hack was not a complex or difficult problem to fix and should have been identified if the company was employing ethical hackers and penetration testers.

There are extensive lists of procedures that can be put in place to increase cyber security, all which take money and staff. Ethical hacking is usually at the very end of most lists, and as one of the most expensive to be implemented it is often not done, this is a problem because it is potentially the most important to carry out. Without skilled professionals testing a network and system just like the real hackers would there is no way of knowing what holes there are left in your security infrastructure.

As Talktalk found the money spent trying to mitigate a cyber attack is vastly more than putting in effective procedures before it happens. The irony is that even if millions are spent on the highest level of cyber security it still does not guarantee that all attacks will be stopped. A good cyber security infrastructure will stop many attacks, including the one Talktalk was victim to but sadly complete security can never be guaranteed. Knowing this and preparing for what to do when breach does occur is another useful part of a complete cyber security strategy.

Max Vetter is a consultant, trainer, investigator and ethical hacker specialising in Cyber Security and the Dark Web

http://maxrvetter.com/

« Islamic State Launches A Cyber War Magazine
Ukrainian Power Grid Hack »

Infosecurity Europe
CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

Clayden Law

Clayden Law

Clayden Law advise global businesses that buy and sell technology products and services. We are experts in information technology, data privacy and cybersecurity law.

Practice Labs

Practice Labs

Practice Labs is an IT competency hub, where live-lab environments give access to real equipment for hands-on practice of essential cybersecurity skills.

ManageEngine

ManageEngine

As the IT management division of Zoho Corporation, ManageEngine prioritizes flexible solutions that work for all businesses, regardless of size or budget.

Authentic8

Authentic8

Authentic8 transforms how organizations secure and control the use of the web with Silo, its patented cloud browser.

IT Governance

IT Governance

IT Governance is a leading global provider of information security solutions. Download our free guide and find out how ISO 27001 can help protect your organisation's information.

Allen & Overy

Allen & Overy

Allen & Overy is an international law firm. Practice areas include Cybersecurity and Data Protection.

ATSEC Information Security

ATSEC Information Security

ATSEC is an independent, privately-owned company that focuses on providing laboratory and consulting services for information security.

Proact IT Group

Proact IT Group

Proact is Europe's leading independent data centre and Cloud services enabler. We deliver flexible, accessible and secure IT solutions and services.

S2 Grupo

S2 Grupo

S2 Grupo is the benchmark company in Europe and Latin America, for Cyber Intelligence and mission critical systems operations.

CyberArrow

CyberArrow

CyberArrow (formerly EBDAA) is a consultancy company providing high quality consultancy services in Risk & Compliance and Awareness & Education.

Intuity

Intuity

The Intuity suite of services provides companies with a complete awareness of their security status and helps them in an efficient, efficient and sustainable improvement process.

Ensighten

Ensighten

Ensighten is a leader in Website Security & Privacy Compliance. Protect your website from malicious attacks, monitor & detect vulnerabilities, protect consumer data.

Secuvant

Secuvant

Secuvant is an independent IT Security firm providing enterprise-grade IT security services to mid-market organizations.

CWSI

CWSI

CWSI provide a full suite of enterprise mobility, security and productivity solutions to many of Ireland and the UK’s most respected organisations across a wide range of industry and public sectors.

TWC IT Solutions

TWC IT Solutions

Since 2011, TWC IT Solutions has offered managed IT Support, Cybersecurity, Disaster Recovery, Contact Centre and Business Connectivity services to clients across 24 countries globally.

SecureOps

SecureOps

SecureOps is transforming the Managed Security Service Provider industry by providing tailored cybersecurity solutions proven to protect organizations from cyberattacks.

Digital Element

Digital Element

Digital Element is a global IP geolocation and intelligence leader with unrivaled expertise in leveraging IP address insights to deliver new value to companies.

Protect AI

Protect AI

Protect AI is a cybersecurity company focused on AI & ML systems. Through innovative security products and thought leadership in MLSecOps, we help our customers build a safer AI powered world.

Flotek

Flotek

Flotek is an IT & Comms service provider delivering SMEs with trusted, innovative and cost effective cloud technology, with confidence, clarity and clout.

Secure Enterprise Engineering (SEE)

Secure Enterprise Engineering (SEE)

SEE provides disruptive cybersecurity system engineering, architecture, and operational capabilities to make our customer’s missions execute faster, smarter, and more securely.

DeepTempo

DeepTempo

At DeepTempo, we build AI models and related software that protect enterprises and service providers from sophisticated cyber threats.