Cyber Legality

Does BA Data Breach Smoking Antique Gun Raise Questions for You?

Security research firm RiskIQ believes it has found the cause of the British Airways (BA) data breach, and that is 22 lines of JavaScript.

While it is good to have some answers as to how this might have occurred, what is worrying is the similarity between the RiskIQ’s announcement and the earlier Ticketmaster breach.

A clear lesson here for system owners and administrators is not to neglect the more mundane aspects of cybersecurity in the face of newer and more sophisticated attacks.

In the light of these findings, can you answer some basic questions about your server environment?

  • What measures are in place to prevent an unauthorized person from gaining access to the operating system or application code and configuration?
  • Do I have a notification process to tell me when something has changed to verify that the change is authorized and to reverse it if it is not?
  • What controls are in place to prevent my software or servers initiating unauthorized calls to external destinations?
  • Do I have a notification process to tell me of unusual communications activity from my servers, and to initiate an investigation to determine if further action is required?

You may be wondering why this might be an antique smoking gun. Malicious code injection is one of the oldest exploit types there are, but just because it is old school does not mean we should not be guarding against it.

Related Articles

Back to top button

We use cookies on our website

We use cookies to give you the best user experience. Please confirm, if you accept our tracking cookies. You can also decline the tracking, so you can continue to visit our website without any data sent to third party services.