1

IPREMIER(A) DENIAL OF SERVICE ATTACK – CASE STUDY PRESENTATION

XIAOYUE JIU, DAVID LANTER, SEONARDO SERRANO, ABEY JOHN, BRITT BOUKNIGHT, CAITLYN CARNEY

Based on: Austin, R.D. and Short, J.C. (2009) “iPremier (A): Denial of Service Attack (Graphic Novel Version), Harvard School of Business, 9-609-092

2

IPREMIER – BACKGROUND

• iPremier- high-end online sales company (mostly credit card transactions)

• October 2008- Bob Turley hired as new Chief Information Officer

• January 2009- Denial of service attack occurs

IPREMIER ORGANIZATION CHART

Jack Samuelson (CEO)

Bob Turley(CI

O)

Joanne Ripley

Leon Ledbette

r

Tim Mandel

Peter Stewart

Warren Spangler

HOW WELL DID IPREMIER PERFORM?

WHAT THEY DID WRONG

• Because of poor preparation iPremier could only react

• There was no chain of command

• There was no communication plan and no attempt to “pool knowledge”

• The emergency response “plan” was outdated and useless

• No one escalated the issue with Qdata until it was too late

• Analysis paralysis

WHAT WOULD YOU HAVE DONE?

WHAT THEY SHOULD HAVE DONE

• Take control of communications

• Create a conference call with all of the key decision makers to select a course of action ( this includes legal counsel)

• Disconnect from the Network/ Contact ISP/Shut the down system

• Escalate to a Qdata manager

• Analyze the attack in a more detailed manner

• Take action!

WERE THE COMPANY’S OPERATING PROCEDURE DEFICIENT IN RESPONDING TO THIS ATTACK?THE IPREMIER COMPANY CEO, JACK SAMUELSON, HAD ALREADY EXPRESSED TO BOB TURLEY HIS CONCERN THAT THE COMPANY MIGHT EVENTUALLY SUFFER FROM A ‘DEFICIT IN OPERATING PROCEDURES’.

IPREMIER’S CURRENT OPERATING PROCEDURES

• Follow emergency procedure

Although an emergency procedure plan existed it was outdated and the plan was not tested recently.

• Contact data center for real-time monitoring, physical access, and procedures for remediation

Although contact was made, physical access to ops center was initially denied. Qdata’s network monitoring staff were incompetent and their key staff was on vacation.

• Identify status of critical assets

Unsure about the status of customer and credit card information data.

IPREMIER’S CURRENT OPERATING PROCEDURES

• Contact key IT personnel and the processes they should follow

Although key IT personnel were contacted it was not followed through a reporting structure and senior management were contacted without having enough understanding of the situation

• Identify and prioritize critical services

• Understand the nature of the attack

Unsure if it was a DDoS or a hack / intrusion or both

• Summarize events

Provide summary about current status and next steps.

WHAT ADDITIONAL PROCEDURES MIGHT HAVE BEEN IN PLACE TO BETTER HANDLE THE ATTACK?IPREMIER HAD THE BAREBONES OF AN OPERATING PROCEDURE THAT WAS NOT ENFORCED NOR FOLLOWED.

ADDITIONAL PROCEDURES

• Conference call bridge with key IT personnel, iPremier executives, and key Qdata personnel

• Contact ISP for additional help

• Document everything, all actions taken with details

• Establish contact with law enforcement agencies

• Check configurations and logs on systems for unusual activities.

• Set up and configure a “temporarily unavailable” page in case the attack continues for a longer period of time

NOW THAT THE ATTACK HAS ENDED, WHAT CAN THE IPREMIER COMPANY DO TO PREPARE FOR ANOTHER SUCH ATTACK?

HOW TO PREPARE FOR THE FUTURE

• Develop and maintain Business Continuity & Incident Response Plan

• Establish when the plan should be put into action

• Develop clear reporting lines

• Know your infrastructure

• Know how to work with your infrastructure

• Know how to get back to Normal

• Training and Awareness

• Testing

• Revisions

• Get reputable hosting service

IN THE AFTERMATH OF THE ATTACK, WHAT WOULD YOU BE WORRIED ABOUT?

WHAT ACTIONS WOULD YOU RECOMMEND?

• Scope of the Attack:

• What data was compromised? (credit card information, customer information, email system)

• Was intrusion malware was installed onto systems?

• Was the attack a diversion attempt to mask criminal activity (i.e. fraud)?

• Will another attack occur in the near future?

• Business Impact:

• Public Disclosure Issues

• SEC guidelines for cyber-security risks and events (2011)

• Public Relations Issues

• Brand

• Reputation

• Shareholder Confidence

•   Potential Litigation

• Breach of contract

• Violation of SLAs

• Direct Revenue Loss

KEY AREAS OF CONCERN

IMMEDIATE RECOMMENDED ACTIONS

• Assemble an incident response team

• Conduct forensic analysis of attack

• Document incident details and lessons learned

• Adjust plans and defenses (address inadequate firewall)

• Hire independent auditor to identify vulnerabilities of current systems and processes

• Communicate with appropriate parties (legal, shareholders, customers, vendor, general public & media, regulatory agencies)

19

CONCLUSIONSNO IT GOVERNANCE RESULTED IN…

• Evidence indicating no IS policies, enforcement, support nor protection:

• IT infrastructure outsourced to Qdata, paying for “24/7 support” getting no 24/7 support on January 12, 2009

• IT staff expressed poor impression of quality of Qdata service to Bob on October 16, 2008, yet the firm remained outsourced 3 months later

• IT staff indicate senior management of firm not interested in spending on improving IT infrastructure

• IT staff using company resources for online gaming…