Part I: The Biggest Breaches
The goal of this part is to explain, in plain English, the biggest breaches in recent years, focusing on what has resulted in everything from exposure of the majority of American consumers' financial identities to a foreign power more than significantly "influencing" the election of our most recent President. The breaches will be covered in reverse chronological order of the years in which the breaches were made public (even though some of them occurred prior), and in the summary section, I'll also comment on the relevance and implications of the actual years in which the breaches took place.
Chapter 1: The Five Key Root Causes
This chapter reviews the five basic root causes that we'll see in all the mega-breaches that will be reviewed in subsequent chapters.
- Phishing
- Malware
- Third-party compromise (suppliers, customers, and partners, as well as acquisitions)
- Software Vulnerabilities (application security as well as third-party vulnerabilities)
- Inadvertent employee mistakes
Chapter 2: The Capital One Breach in 2019
On July 29, 2019, court documents were released regarding a security breach at Capital One that exposed data for over 105 million people. A lone hacker gained access to highly sensitive data including names, social security numbers, addresses, and dates of birth. This hack is just one example in which over a hundred million customer records have been exposed to the entire Internet.
- The Modern Day Datacenter: The Cloud and Hybrid Clouds
- Erratic: Former Amazon Web Services employee
- The Firewall Hack
- The Ex-Filtration
- The Simple Mistakes
- The Charges & The Fallout
Chapter 3: Cambridge Analytica & Facebook
The goal of this chapter is to cover two issues that both involved Facebook. The first issue is how Cambridge Analytica, a data analytics firm that assisted President Trump's presidential campaign, abused Facebook to harvest data on 70 million U.S. consumers to create psychographic profiles of them and target ads to influence voting. The second issue is how a vulnerability in Facebook's "View As" feature (that allows users to see how their profiles look to the public) was exploited to allow for the take over of approximately 50 million Facebook accounts. The sections in this chapter will also set the groundwork for the Facebook hacking of the 2016 election by the Russians. - How Facebook Works
- How Facebook Makes Money Through Ads
- Political Ads
- Security Challenges with Ads: Abusive Targeting, Bad Ads, Malvertising, and Click Fraud
- Facebook's Third-Party Apps and APIs
- Cambridge Analytica Harvesting
- Bungled Remediation of Harvested Data
- The "View As..." Vulnerability
- Remediation of the "View As..." Vulnerability
Chapter 4: The Marriott Hack in 2018
The Marriott hack disclosed in 2018 has been the second largest breach of all time as it involved 383 million records, and is only second to Yahoo's hack of 3 billion email accounts which we'll describe in see Chapter 8. Passport numbers, and the location history of hundreds of millions of people was amongst the data stolen in the breach. Combined with stolen data from the US Government's Office of Personnel Management breach (described in Chapter 7), one can even derive the location histories or potentially even impersonate some CIA agents and spies. - Marriott and Starwood
- DBA Account Takeover
- Malware: Remote Access Trojan and Mimikatz
- Starwood Guest Reservation Database Exfiltration
Chapter 5: The Equifax
About the Author: Dr. Neil Daswani is Co-Director of the Stanford Advanced Security Certification program, and is President of Daswani Enterprises, his security consulting and training firm. He has served in a variety of research, development, teaching, and executive management roles at Symantec, LifeLock, Twitter, Dasient, Google, Stanford University, NTT DoCoMo USA Labs, Yodlee, and Telcordia Technologies (formerly Bellcore). At Symantec, he was Chief Information Security Officer (CISO) for the Consumer Business Unit, and at LifeLock he was the company-wide CISO. Neil has served as Executive-in-Residence at Trinity Ventures (funders of Auth0, New Relic, Aruba, Starbucks, and Bulletproof). He is an investor in and advisor to several cybersecurity startup companies and venture capital funds, including Benhamou Global Ventures, Firebolt, Gravity Ranch Ventures, Security Leadership Capital, and Swift VC. Neil is also co-author of Foundations of Security: What Every Programmer Needs to Know (Apress).
Neil's DNA is deeply rooted in security research and development. He has dozens of technical articles published in top academic and industry conferences (ACM, IEEE, USENIX, RSA, BlackHat, and OWASP), and he has been granted over a dozen US patents. He frequently gives talks at industry and academic conferences, and has been quoted by publications such as The New York Times, USA Today, and CSO Magazine. He earned PhD and MS degrees in computer science at Stanford University, and he holds a BS in computer science with honors with distinction from Columbia University.
Dr. Moudy Elbayadi has more than 20 years of experience and has worked with a number of high-growth companies and across a variety of industries, including mobile and SaaS consumer services, and security and financial services. Having held C-level positions for leading solution providers, Dr. Elbayadi has a unique 360-degree view of consumer and enterprise SaaS businesses. He has a consistent track record of defining technology and product strategies that accelerate growth.
As CTO of Shutterfly, Dr. Elbayadi oversees all technology functions including product development, cybersecurity, DevOps, and machine learning/AI R&D functions. In this capacity he is leading the technology platform transformation. Prior to Shutterfly, Dr. Elbayadi held the position of SVP, Product & Technology for Brain Corp, a San Diego-based AI company creating transformative core technology for the robotics industry.
As advisor, Dr. Elbayadi has been engaged by CEOs and senior executives of companies ranging from $10M to $2B in revenues. Representative engagements include public cloud strategy, platform integration and M&A strategy. He has advised numerous VC firms on technology and prospective investments.
Dr. Elbayadi earned a doctorate in leadership and change from Antioch University, a master's degree in organizational leadership from Chapman University, and a master's degree in business administration from the University of Redlands.
