External Intrusion of the PlayStation Network, Case Study Example

The outage of the PlayStation Network was the effect of an external interruption on the PlayStation Network and Qriocity services of Sony, whereby individual details from about seventy-seven million accounts were stolen and prevented PlayStation Portable consoles and PlayStation 3 users from playing online using the service. The attack took place between the 17^th of April and 19^th of April, 2011, coercing Sony to switch off the PlayStation Network on 20^th April. On 4^th May, there was a confirmation by Sony on information, which was individually identified from all the seventy seven million accounts seemed to be stolen. The outage was existent for twenty-four days (Richmond, 2011).

An explanation was given by the officials of Sony that there existed a disparity in timing between when the intrusion was identified, and when there was knowledge of the data of consumers being compromised. Sony learned that an intrusion occurred on 19^th April and the services were subsequently shut down. Outside experts were then brought to help Sony know how the intrusion took place, and carry out an inquiry to find out the scope and nature of the occurrence. There was a necessity to conduct many days of forensic scrutiny, and it took Sony experts until 20^th of April to know the breach’s scope. The information was then shared with the company’s consumers and publicly announced that afternoon. This was Sony’s explanation for the amount of time that had gone by from the attack’s start to when the public was told about the details (Buchanan 2011).

The right forensic analytical action the moment the attack was exposed would amount to denying the intruder access, probably by cutting off the system, which is affected from the network, and closing up the system through replicating a line dropout. However, this is dependent on the site and the conditions within which this can be performed ought to be expressed in the Incident Response Plan (IRP). After that, the Incident Response Team (IRT) should be given a report on the occurrence for them to act as the point of coordination for getting in touch with other locations that may have also been affected by interruptions coming from the same source. Then the interruption should be controlled and the intruder’s actions limited through holding the cybercriminal off, and making a determination of what other things ought to be done. Finally, Sony should go on with the operation of gathering additional information through examination of the trespasser in real time, and reinstate the system, which was affected (Casey and Altheide, 2010).

The forensic teams of Sony could have offered a speedy analysis of the occurrence and the incurred damage. This is for the reason that a warning was given by Sony almost one week after the early external interruption followed by the turning off of the Network. The possibility that information, which was individually identifiable, like the username of the PlayStation Network account, home addresses, email addresses, and passwords had been compromised in addition to taking of credit card data, could not be ruled out (Buchanan, 2011). This places the finances and lives of persons in danger and as a result, Sony could have given a warning to the users of possible theft of data earlier that 26^th April. This is because their slow reaction raises concerns over PCI compliance violations and the failure to give a notification to users instantly. The moment the breach is determined is a suitable amount of period before the affected persons are notified.

References

Buchanan, W. (2011). Introduction to Security and Network Forensics. Boca Raton, FL: CRC Press.

Casey, E., & Altheide, C. (2010). Handbook of digital forensics and investigation. Burlington, Mass: Academic Press.

Richmond, S (2011). “Millions of internet users hit by massive Sony PlayStation data theft“. London: Telegraph. Retrieved 9^th Nov. 2013. http://www.telegraph.co.uk/technology/sony/8475728/Millions-of-internet-users-hit-by-massive-Sony-PlayStation-data-theft.html