Question 1
Download Government Accountability Office’s report from this URL: https://www.gao.gov/assets/700/694158.pdf
If the link is no longer available, then do a web search by using the term “GAO Actions Taken by Equifax and Federal Agencies in Response to the 2017 Breach”.
Please read the pages 10-17 of the document. (Start reading from this section: “Attackers Exploited Vulnerabilities That Equifax Subsequently Reported Taking Actions to Address” until this section: “Equifax Reported Taking Steps to Identify Affected Individual”)
1) Categorize the actions of the hackers by using the cyber kill chain method by filling out the table below. Note that if you cannot find any specific action for a step within the GAO document, you can use external resources or use your judgment on which methods the hackers might have used.
Cyber Kill Chain Step Actions of Hackers
Reconnaissance
Weaponization
Delivery
Exploitation
Installation
Command & Control
Actions on Objectives
Question 2
For the Equifax 2017 case, please provide two components of the attack surface by providing justifications. Please describe the attack vector that leads to the compromise of millions of SSNs.
Question 3
As a senior security engineer, what defense-in-depth actions would be the most suitable for minimizing the Equifax’s exposure to this attack? Explain each action and provide the rationale to support using each specific action.
Question 4 – Weekly Learning and Reflection
In two to three paragraphs of prose (i.e., sentences, not bullet lists) using APA style citations if needed, summarize and interact with the content that was covered this week in class. In your summary, you should highlight the major topics, theories, practices, and knowledge that were covered. Your summary should also interact with the material through personal observations, reflections, and applications to the field of study. In particular, highlight what surprised, enlightened, or otherwise engaged you. Make sure to include at least one thing that you’re still confused about or ask a question about the content or the field. In other words, you should think and write critically not just about what was presented but also what you have learned through the session. Questions asked here will be summarized and answered anonymously in the next class.
