Sony must secure networks, analysts say
Continuing breaches suggest company's networks may be more porous than assumed
Computerworld - The apparent ease with which hackers have breached Sony networks in recent days shows how much work is still needed to fully secure the company's networks, analysts say.
Sony, along with three external security firms, has been working frantically to shore up its systems since the company uncovered two breaches in mid-April that compromised data of nearly 100 million members of its PlayStation Network and Sony Online Entertainment network.
About 10 days ago, Sony announced that it had fixed all problems with its PSN and SOE networks and partially restored services.
Since then, there have been at least three separate -- and relatively minor -- attacks reported against Sony systems.
The relative ease with which hackers were able pull off the most recent intrusions is surprising, given the heightened attention to security at Sony since the widely publicized PSN hack.
"The original attacks [on the PlayStation Network and Online Entertainment networks] were probably quite targeted and quite skilled," said Chester Wisniewski, senior security adviser at security firm Sophos. "Now it seems to be that every random hacker out there has jumped on the bandwagon" to attack Sony.
Wisniewski cited an attack against Sony BMG's site in Greece, where hackers uploaded a database containing nonsensitive user information to a public site.
The attack was not sophisticated and involved a pretty simple exploit of a SQL injection flaw, analysts said. "I'm surprised they wouldn't have cleaned up something like this by now," Wisniewski said.
The attacks suggest that Sony may have more work to do securing its networks than it might have bargained for, said Phil Lieberman, CEO of Lieberman Software.
The company's hard-line stance on copyright protection has earned it several enemies within the hacker community. Many of them are taking advantage of the publicity surrounding the Sony intrusions to try to further embarrass Sony, he said.
"Taking a baseball bat to a hornet's nest is never an advisable strategy. Sony's strategy in defending its intellectual property was heavy-handed and has triggered the 'nuclear option' with those that it engaged," Lieberman said.
While Sony focused heavily on protecting IP and enforcing copyright protections, the company appears to have done little to protect its massive presence on the Internet, Lieberman said. "I think Sony's beginning to understand that they horribly underinvested in security. It's simply not in their DNA."
- Major companies, like Target, often fail to act on malware alerts
- The new security perimeter: Human Sensors
- Snowden advocates at SXSW for improved data security
- Joomla receives patches for zero-day SQL injection vulnerability, other flaws
- NSA used 'European bazaar' to spy on EU citizens
- Target CIO resigns following breach
- Evan Schuman: Mobile IT Roach Motel: Data checks in, but it won't check out
- Sears finds no evidence of data breach -- yet
- Gameover malware is tougher to kill with new rootkit component
- Mobile app for RSA Conference exposes personal data
- Best iPhone, iPad Business Apps for 2014
- 14 Tech Conventions You Should Attend in 2014
- 10 Desktop Apps to Power Your Windows PC
- How to Add New Job Skills Without Going Back to School
- Slideshow: 7 security mistakes people make with their mobile device
- iOS vs. Android: Which is more secure?
- 11 sure signs you've been hacked
- The 12 PCI DSS 3.0 requirements addressed by Peer 1 Hosting This handy quick reference outlines the 12 PCI DSS 3.0 requirements, who needs to be compliant and how Alert Logic solutions address the...
- Defense Throughout the Vulnerability Life Cycle This whitepaper provides insight into how to leverage threat and log management technologies to protect your IT assets throughout their vulnerability life cycle.
- Alert Logic for PCI DSS Compliance To achieve PCI DSS compliance, you must identify and remediate all critical vulnerabilities detected during PCI scans. Threat Manager streamlines this process by...
- Cybersecurity Imperatives Reinvent Your Network Security With Palo Alto Networks The Rise of CyberSecurity
- Live Webcast On-demand webinar: "Mobility Mayhem: Balancing BYOD with Enterprise Security" Check out this on-demand webinar to hear Sophos senior security expert John Shier deep dive into how BYOD impacts your enterprise security strategy...
- Live Webcast Endpoint Backup & Restore: Protect Everyone, Everywhere Arek Sokol from the bleeding-edge IT team at Genentech/Roche explains how he leverages cross-platform enterprise endpoint backup in the public cloud as part...
- Streamline Software Asset Management, Compose a software Management Symphony Keeping track of your organization's software is easy with effective software management solutions from CDW. View the videos in our software solutions channel
- Druva inSync: Endpoint Data Protection & Governance CLICK HERE to watch this video about protecting corporate data on laptops and mobile devices, sponsored by Druva. All Security White Papers | Webcasts