Sanitized Cases Stories

Collection of sanitized Cases for a wider Audience

To gather information on computer security incidents for public consumption is always a difficult task. Companies tend to keep any information on these secret, especially on severe incidents, due to the fear of losing reputation and trust. In this regard all companies that have to provide secure and reliable services (as banks, insurance companies or security consultants) are even more unwilling to give away any information.

Even if information is made available, privacy issues always have to be taken into consideration. So any released data has to be filtered for information about any individual or any further vulnerability of the affected systems. The process of filtering out information is complex and costly. And in the end after this process very often there is hardly any valuable information left or absolutely nothing left to be published at all.

Inspite of these problems there are a few sources on the internet that give valuable information, and specifically addresses the important question, how costly an incident might be.

Incident Cost & Analysis Modeling Projects (ICAMP) I

http://www.cic.uiuc.edu/groups/ITSecurityWorkingGroup/archive/Report/ICAMPReport1.pdf

This study, published in 1998, was funded by the Chief Information Officers of the Committee on Institutional Cooperation (CIC), the academic consortium of the Big Ten universities plus the University of Chicago. The study was conducted by Virginia Rezmierski and a team of researchers at the University of Michigan. The thirteen CIC schools participated. The objective of the study was to design a cost-analysis model for IT-related incidents and to gather and analyze a sample of such incidents. The following incidents were analyzed.

• The Bomb Squad
• Downtime on the web
• The Dropped Egg
• The Exposed SSNs
• Give Him an Inch, He' ll Take a Mile
• The Horse in the Public Site
• The Infamous Hacker Gang
• The Interrupted Uninterruptible Power Source
• The Invasion of the Body Swappers and Other Horrors
• The Juvenile Delinquent
• LAN Crash
• The Linux Crack
• The Mismanaged Machine
• The Missing Donors
• The Missing Multimedia
• The Night When the Lights Went Out
• The Overflowing Buffer
• The Phony FBI Agent
• The Politics Surrounding the Gopher
• The Posted Password
• The Spawning
• The StatD Overflow
• The Stolen Identity
• The Student Thas Was Threatened to Death
• The Swedish Bouncer
• The Swiped Buying Card
• The Telnet Demon
• The Unauthenticated Satellite
• The Unidentified Hacker
• The Upgrade Desaster

The project web site is at: http://www.cic.uiuc.edu/groups/ITSecurityWorkingGroup/archive/Report/ICAMP.shtml

Incident Cost & Analysis Modeling Projects (ICAMP) II

http://www.cic.uiuc.edu/groups/ITSecurityWorkingGroup/archive/Report/ICAMPReport2.pdf

This follow-up study, published in 2000, was funded by the USENIX Association and had two primary objectives. The first objective was to refine the costing model for calculating user costs for IT-related incidents. The second objective was to investigate the availability of incident frequency data and incident categorization schemes. The study was led by Virginia Rezmierski and researchers at the University of Michigan and involved data collection from the thirteen CIC schools and five other universities. The following incidents were analyzed.

• The Awake System Administrator Incident
• Be Aware of MP3 Sites!
• The Bungling Hacker
• A Case of Mistaken and (Obstinate) Identities
• The Expert's Lying
• The Jumping Hacker
• The "There & Back Again" Hack
• The Pinging Linux
• The Possessed Mouse
• Post Fourth of July Fireworks
• Searching for Warez Materials
• Server Sniffers
• A Standard's Day MP3
• A Teaching Opportunity Incident
• The Virtual - Non-Virtual Intruder

JANET-CERT Cases

On the basis of the ICAMP studies, JANET-CERT also prepared some case studies on the costs of incidents. The information is available from their web site.

http://www.ja.net/CERT/JANET-CERT/prevention/case-studies/

eCSIRT.net The European Computer Security Incident Response Team Network News | Sitemap | Imprint | Privacy Statement | Contact | Top Last changed: January 5, 2004 / AL Copyright © 2002-2003 by PRESECURE Consulting GmbH, Germany

Signed with PGP!