Ipremier Case 122m27

iPremier Case •

A story about managing security and trust in the Internet world.

iPremier Company A HARVARD BUSINESS SCHOOL CASE

The Attack on iPremier • • •

Many unknowns Various concerns “Ha” emails received every second

Summary of iPremier •

•

Founded in 1996 • One of a few web-commerce success stories • Sells luxury, rare, and vintage goods online • INTERNET RELIABILITY IS CRITICAL!! Fiscal Year 2006 • Profits were $2.1 million • Sales of $32 million

If You Experienced a Computer Attack, What Would You Do?

So, What Would You Do? A. B. C.

Ignore the problem, it will go away Implement Disaster Recovery Plan Other, “Oh, do we have a plan?”

Agenda •

•

•

Technical Information • Firewalls • Hackers, Viruses, Worms Attack on iPremier • Key and iPremier Network • Management and Key Employees • Aftermath of Attack Disaster Recovery

How Do Firewalls Work? • •

A firewall provides a single point of defense between two networks— it protects one network from the other Firewalls are frequently used to prevent unauthorized s from accessing private networks connected to the Internet (~5 min.)

What Can’t a Firewall Do? Most firewalls cannot:

• • • •

Protect a company against encrypted data or viruses Protect against carelessness or employee misconduct Be the only means of network protection

Hackers

Hackers •

• •

•

People who break into a computer system and inform the company that they have done so. They are often either concerned employees or security professionals who are paid to find vulnerabilities. A security professional invited by Microsoft to find vulnerabilities in Windows. A person who breaks into a computer system with the purpose of inflicting damage or stealing data. An amateur who tries to illegally gain access to a computer system using programs (scripts) that others have written.

Computer Attack Overview 

A computer attack is any malicious activity directed at a computer system or the services it provides

Types of Attacks

• • • • • •

Virus Use of system by unauthorized individual Denial of service (DoS) Probing of a system to gather information Physical attack of computer hardware

Computer Viruses Virus: a segment of self-replicating code planted illegally in a computer program, often to damage or shut down a system or network.







A virus that “worms” its way through either the computer’s memory or a disk and alters data that it accesses. Worms burrow through and between networks. A virus that attaches itself to seemingly innocent programs. It does not necessarily replicate, but it opens doors so that an attacker can enter undetected at a later date. A virus that is activated or triggered after or during a certain event. This virus usually lies in wait until a specific action is undertaken.

QData

•

Steady provider of:

• • • • • • •

•

Key

basic floor space power connectivity environmental control physical security and high-level “management services”

Hosted most of iPremier’s computer equipment

“Colo”

• •

QData’s hosting facility close to office

Network Operations Center (NOC)

• •

Secured Monitoring Location

iPremier Network

iPremier: Culture • • • •

Mix of talented young people “Intense” work environment Balanced approach to growth and profitability “Whatever it takes”

The Attack on iPremier 

4:31 AM: Leon Ledbetter reports the website is locked up, customer is receiving calls and has been getting “ha” emails.



5:27 AM: Joanne Ripley realized shortly after she reached a Qdata console that iPremier was the recipient of a SYN flood from multiple sites that was directed at the router that runs the firewall.

iPremier’s Choices

At the time of the attack, pull the plug?

• • •

Could lose logging data Only way to assure credit card data is not being stolen

After the attack: rebuild the system?

• • •

Would shut down business for, at a minimum, 24-36 hours “The only way to be sure”

Ending The Attack 

 

Every time Joanne tried to shut off the attacking IP address it would automatically trigger attack from two other “zombie” sites The emails stopped at 5:46 AM Computer security experts consulted after the attack suggested that the denial of service attack could have been a misdirection tactic, to avert attention from hacking

After the Attack •

iPremier instituted several security measures after the DoS attack: • Restarted all production equipment • File-by-file examination • Plan to move to more modern hosting facility • Created an incident-response team

Aftermath   

Two weeks after iPremier was attacked, the Company received a call from an FBI special agent in Washington, D.C. Over the previous two hours the Company’s largest competitor, MarketTop, was experiencing a denial of service attack. The attack was being conducted from inside iPremier’s production computing instillation.

This attack proved iPremier’s firewall had been penetrated

Open Options

1.

Implementation of a Comprehensive Rebuild of all Productions Platforms



Resistance • MarketTop attack could be the full extent of crime • Could be seen as the destruction of evidence

Open Options

2.

MarketTop’s Potential Lawsuit Against iPremier or its Apparent Role



Resistance • Negative attention for both companies

3.

Open Options

Public Disclosure  Compromised database serve contained credit card numbers



Two Opinions • CIO, Bob Turley, wanted to disclose what might have happened. • Senior Finance Staff Member, Linda Kliewer, offered a different point of view.

•

Disaster Recovery Plan: “Some Binder” Precautions to take so the effects of a disaster will be minimized in an effort to:

Maintain or Quickly Resume Mission-Critical Functions Appropriate plans vary from one enterprise to another

•

Variables to consider:

• • • •

type of business processes involved level of security needed

What are the Major Concerns? • • • • •

Legal Aspect Public Relations Impact on Stock Price Customer Privacy Network Security

The End.

What implications do you see for: a. Social Media companies b. Companies using social media systems