Lockbit Boeing Data Breach

docx

School

George Mason University *

*We aren’t endorsed by this school

Course

320

Subject

Information Systems

Date

Apr 3, 2024

Type

docx

Pages

Uploaded by roberts6edgeorellana

Lockbit Boeing Data Breach November 26, 2023 By Robert Orellana Part 1: Report of the incident 1. The Company Boeing is a global American multinational firm that designs, develops, and markets aircraft, helicopters, rockets, satellites, communication equipment, and missiles all over the world (Bernal, 2022). It was founded in 1916 and is currently the third-biggest defense contractor globally as well as the largest aircraft producer in the world ( Wayback Machine , n.d.). The Dow Jones Industrial Average includes Boeing's shares. In 1997, the business amalgamated with McDonnell Douglas, with Philip M. Condit serving as the CEO and chairman at the time ( Wayback Machine , n.d.). The company's corporate offices are located in Arlington, Virginia as of 2023. Four divisions comprise the company: Boeing Capital, Boeing Global Services, Boeing Defense, Space & Security (BDS), and Boeing Commercial Airplanes (BCA). Boeing's revenues in 2021 were $62.3 billion ( Boeing’s Worldwide Revenue 2022 | Statista , 2023). It comes in at number 121 on the Global 500 ( Boeing , n.d.) and number 54 on the Fortune 500 lists ( Global 500 , 2021). 2. Instruments Ransomware A Russian cybergang group called Lockbit told Boeing that if the Boeing does not pay the ransom by November 2nd, tons of sensitive data will be leaked ( Boeing Assessing Lockbit

Hacking Gang Threat of Sensitive Data Leak , n.d.). The type of rensomeware that Lockbit use is Ransomware-as-a-service (RaaS). Boeing should be aware that they are working with criminals, though, and that even in the event that the ransom is paid, there's always a chance they won't get their information back. In many nations, it is forbidden to pay ransom to ransomware gangs (Muncaster, 2023). 3. The events The 2022 Interim Cyber Threat Report from Deep Instinct states that 44% of all ransomware attacks were spearheaded by the LockBit Ransomware-as-a-Service (Raas) organization. The study emphasizes how threat organizations like Agent Tesla and NanoCore are using obfuscated Visual Basic macros more frequently (Mascellino, 2022). The exploitability of Linux and Windows systems is also highlighted in the research, with vulnerabilities such as DirtyPipe, Follina, and SpoolFool leading to surges every three to four months. Threat actors are also utilizing data exfiltration to seek a ransom for data leaks that have fewer alternatives for recovery. According to the research, by the end of the year, threat actors will still be searching for weak points, "protestware" will become more prevalent, and more vulnerabilities will remain unpatched.

( Boeing Breach , 2023) Boeing has acknowledged a cyberattack that targeted the information systems and parts business of its global services division ( Boeing Confirms Cyberattack; Lockbit Claims Responsibility , 2023). The assault targeted the parts and distribution division. The assault was ascribed to Lockbit, a well-known Russian cybercrime outfit that is well-known for demanding ransoms for data encryption and decryption. In conjunction with law enforcement, regulatory agencies, and quick forensic investigations, Boeing is now undertaking an inquiry. Lockbit, a company well-known for locking files and extorting payments, threatened to expose a substantial amount of Boeing data if their ransom demand was not satisfied by November 2. Prioritizing system repair and preserving business continuity, Boeing is informing suppliers and customers about the security compromise. The attack and the creation of a global coalition to counter ransomware threats occur at the same time.

Your preview ends here

Eager to read complete document? Join bartleby learn and gain access to the full version

Access to all documents
Unlimited textbook solutions
24/7 expert homework help

4. Outcomes Ransom removed At first, LockBit was threatening to reveal 4 GB of Boeing data on the dark web on November 1, 2023, LockBit now intends to release an additional 500 GB of data over time. But LockBit suddenly strangely took Boeing off their list of targets, implying that talks could still be in progress. Negative price-to-earnings ratio Based on real-time data from InvestingPro, Boeing (BA) has been displaying some intriguing characteristics. As of Q3 2023, sales growth had accelerated at a rate of 23.34% over the previous twelve months, bringing the company's market valuation to a noteworthy $118.0 billion ( Boeing Faces Cybersecurity Breach, Ransomware Group LockBit Threatens Data Leak , 2023). On the other hand, the company's P/E Ratio, which stands at -41.42, suggests that it has not turned a profit during that time. Part 2: What I have learned 1. Ethics Analysis

Although this data brach did not affect avianton or consumer finances, It left a big hole for cyber thieves to attack. Many inicent and simple task and collaborations made Boeing an easy Target for LockBit. There are many things that Boeing has done right with the data breach but there a few things that if Boeing was a bit more concerned, the data breach incident would have been less surious. Citrix Systems, Inc. is a global provider of virtualization and cloud computing technologies. Its products include networking, software as a service (SaaS), server, application, and desktop virtualization. Since its founding in 1989, it has developed into a leading company in the thin client technology sector. To further enter the server and desktop virtualization, cloud computing, infrastructure as a service, and software as a service markets, Citrix bought Sequoia Software Corp. in 2001 and ExpertCity in 2003 (Sharwood, 2022). It purchased Framehawk in 2014 in an effort to enhance virtual desktop delivery on wireless networks. Under the Cloud Software Group, Citrix and TIBCO Software combined in 2022, and the rebranded Citrix ADC was separated as Netscaler, a stand-alone company (Millward, 2022). I mentioned and introduced Citrix because Boeing uses Citrix for cloud computing. One of the main weakness for Citrix is bleed vulnerability. Citrix released a fix for the issue on October 10th (Pol, 2023). Hackers can infiltrate a compromised machine and take sensitive data via memory by using the Citrix Bleed vulnerability. The main advantage for hackers were "session tokens," which don't require a password to identify and authorize users of a certain website or service. In order for Boeing to prevent another data breach from using cloud computing, it would be best to hire grey hat hackers. If grey hat hacker was hired at Boeing to check on Citrix, they

probably would do some illegal hacking to simulatea black hat hacker. Once a vulnerbility has been found, Boeing and the general public will be notified about the vulnerability. In order to simulate a data breach with actually having a data breach, Boeing should also hire red hat hackers. There two positive outcome if red hat hackers are hired; the vulnerability will be imitated to make sure Boeing is prepared when a data breach occurs and black hat hackers will be attacked by red hat hackers if a data breach occurs. It was a smart idea for Beoing to not pay the ransom. LockBit is a crimminal organization and even if the ransom is paid, the data can still be leaked or the data can still be in LockBits database even if LockBit said to Boeing that the data is deleted. The mostly likely reason why the ransom was removed was because Boeing made a negotiation with LockBit. LockBit may member that perform IT the same or much better than Boeing employees. The two main reasons why LockBit members decide to use their IT skills for crimminal hacking instead of for good in a company is because it pays more and there are limited legal opportunities in the places they live. LockBit is based in Russia so legal hacking pays so low and there are limited jobs available. It is easier and pays more to hack illegally. 2. Recommendations 1) Policy point of view Boeing is dedicated to upholding integrity in its operations and has zero tolerance for bribery or corruption. The corporation has released an internal policy that outlines the standards for stakeholders, the board of directors, and staff with regard to anti-corruption and anti-bribery. Aside from requiring yearly training and offering guidance on reporting methods, Boeing also offers comprehensive procedures for adhering to the Foreign Corrupt Practices Act of the United

Your preview ends here

Eager to read complete document? Join bartleby learn and gain access to the full version

Access to all documents
Unlimited textbook solutions
24/7 expert homework help

States and other international anti-corruption regulations. The company's anti-corruption program is divided into nine risk categories and consists of comprehensive controls that are evaluated yearly by external evaluations, internal audits, and self-evaluation ( Boeing: Compliance & Ethics , n.d.). There are mechanisms for anonymous and confidential reporting, and it is expressly forbidden to take revenge on those who report anything. In order to shield staff members from reprisals for disclosing any misconduct by American contractors or subcontractors, Boeing additionally informs them of their legally protected whistleblower rights. Boeing is dedicated to preserving system security and safety as well as the privacy of its users' data. To report possible security flaws, send an encrypted email to vulnerability disclosure with the relevant details. Boeing promises to preserve and secure personal data while looking into and fixing the problem ( Boeing: Compliance & Ethics , n.d.). The business doesn't take part in any actions that could be harmful, disruptive, or illegal. With the first disclosure honored in Boeing's Security Hall of Fame, the company has initiated a recognition program for responsibly disclosed and confirmed vulnerabilities. 2) Technological point of view Boeing began implementing a unified strategy for all digital initiatives in order to promote our upcoming product line inside a digital ecosystem. Together, the creation of new goods, manufacturing systems, including the supply chain, and support systems will be made possible by the full digital environment, which offers stability and predictability. Long into the future, this collaborative endeavor will influence the way we develop, test, and maintain our products ( Boeing: Innovation , n.d.). With the same level of technical rigor as the airplane itself, model-based engineering manufacturing processes will be created. This helps us better forecast

both of their performances by enabling us to observe how changes in one impact the other. In the end, we want to flatten the conventional idea of a learning curve and create a new paradigm for aircraft production. Boeing has strengthened its digital future by announcing new collaborations with Google Cloud, Amazon Web Services (AWS), and Microsoft. Boeing will be able to use digital twin technology to test systems and airplanes hundreds of times before to deployment thanks to these agreements ( New Cloud Partnerships Strengthen Boeing’s Digital Foundation , n.d.). Boeing's cloud solutions will free developers from infrastructure constraints, streamline workflows, and let them create apps quickly. Boeing's dedication to innovation, sustainable operations, and clean relationships is further strengthened by cloud usage. Boeing's carbon footprint will be lessened with the use of digital tools and testing, simplified data centers, and more energy-efficient equipment. The project advances both Boeing's Enhanced Product Team and its growing strategic alliance with Dell Technologies. 3) Organizational point of view As one of the top aerospace companies in the world, Boeing designs, develops, and maintains space systems, defense equipment, and commercial aircraft for clients in over 150 nations. The firm, a leading exporter from the United States, enhances economic opportunities, sustainability, and community impact by utilizing the skills of a worldwide supplier network ( The Boeing Company: General Information , n.d.). The diverse workforce at Boeing is dedicated to driving sustainability via innovation and fostering a culture that is centered around the company's guiding principles of integrity, quality, and safety. Boeing has a long history of being

a pioneer in aerospace innovation. To address changing client demands, the business is growing its service and product offerings. Its wide variety of competencies includes developing new, more effective commercial aircraft, designing, constructing, and integrating defense and military platforms, developing cutting-edge technological solutions, and setting up creative finance and service arrangements for clients. Boeing has more than 140,000 employees in the US and more than 65 other countries. The company has corporate headquarters close to Washington, D.C. This is one of the most creative, skilled, and varied workforces you will ever find. We also take use of the skills of hundreds of thousands of other highly qualified individuals who work for Boeing suppliers throughout the globe ( The Boeing Company: General Information , n.d.). Commercial Airplanes, Defense, Space & Security, and Boeing Global Services are the three business units that make up Boeing. Global financial solutions provider Boeing Capital Corporation supports these entities. Functional groups operating throughout the corporation also concentrate on information technology, safety, finance, quality and productivity improvement, advanced design and manufacturing systems, engineering and program management, technology and development, and program execution. 3. Conclusion In conclusion, Boeing, a multinational corporation based in the United States, is the world's third-largest defense contractor and the biggest manufacturer of airplanes. With $62.3 billion in sales in 2021, the firm came in at number 121 on the Global 500 and number 54 on the Fortune 500 rankings. Boeing revealed a cyberattack on its worldwide services business in 2023, which was attributed to the Russian criminal organization Lockbit. If their ransom demand was

Your preview ends here

Eager to read complete document? Join bartleby learn and gain access to the full version

Access to all documents
Unlimited textbook solutions
24/7 expert homework help

not met by November 2, Lockbit threatened to make a significant quantity of Boeing data public. Boeing has initiated an investigation including law enforcement, regulatory bodies, and expeditious forensic examinations. With sales growth growing at a pace of 23.34% over the preceding twelve months, Boeing has been exhibiting some remarkable features. This has led to the company's market valuation reaching an impressive $118.0 billion. The company's P/E Ratio, however, is -41.42, indicating that it has not made a profit during that period. Cybercriminals now have a large opening to exploit due to this data leak. A bleed vulnerability is the primary weakness of Citrix Systems, Inc., a multinational supplier of virtualization and cloud computing technology. Using the Citrix Bleed vulnerability, hackers can get access to a compromised system and steal confidential information by use of memory. "Session tokens," which identify and authorize users of a particular website or service without the need for a password, are the primary benefit for hackers. Boeing should use "grey hat" hackers to pose as "black hat" hackers and alert the public to the vulnerability in order to stop another data breach involving cloud computing. Boeing ought to employ red hat hackers as well, in order to mimic a data breach without really experiencing one. Red hat hackers will exploit vulnerabilities to ensure Boeing is ready for any data breach, and if a breach does occur, they will fight black hat hackers. These are two benefits of hiring red hat hackers. It was wise of Boeing to refuse to pay the ransom because LockBit is a criminal enterprise and even in the event that the ransom is paid, data may still be in LockBits database or may be disclosed, despite LockBit's claims to the contrary. Because it pays more and there are fewer legal options available where they reside, LockBit members mostly choose to utilize their IT abilities for illegal hacking rather than for

good in a firm. Boeing is committed to maintaining honesty in its business practices and does not accept any kind of bribery or corruption. Because there are few legal options and significant remuneration in their own countries, LockBit members frequently employ their IT expertise for illegal hacking. One of the top aerospace companies, Boeing, is committed to maintaining integrity and does not tolerate corruption or bribery. An internal policy of the corporation delineates principles of anti-corruption and anti-bribery for workers, the board of directors, and stakeholders. Nine risk categories make up Boeing's anti-corruption program, which also contains extensive controls that are yearly assessed by internal audits, external assessments, and self-evaluation. Employees can report any security vulnerabilities by sending encrypted emails to vulnerability disclosure along with the necessary information. While looking into and resolving the issue, Boeing pledges to protect and safeguard personal data. The business doesn't do any unlawful, disruptive, or damaging acts. A program to recognize vulnerabilities that have been duly disclosed and verified has been launched by Boeing. In order to market its next product line inside a digital ecosystem, Boeing has established a consistent approach for all digital efforts. This joint project will have an impact on how Boeing designs, tests, and maintains its products. The development of model-based engineering manufacturing processes will enable more accurate performance forecasts and a reduction in the traditional learning curve. By announcing new partnerships with Google Cloud, Amazon Web Services (AWS), and Microsoft, Boeing has fortified its digital future. Through these partnerships, Boeing will be able to test aircraft and systems hundreds of times before they are put into service using digital twin

technology. Boeing's cloud solutions will enable developers to swiftly design apps, liberate them from infrastructure limitations, and optimize workflows. The diversified workforce at Boeing is committed to advancing sustainability via innovation and cultivating a culture that revolves on the organization's core values of integrity, quality, and safety. With its corporate headquarters near to Washington, D.C., the corporation employs over 140,000 people in the US and more than 65 other countries. Additionally, Boeing employs hundreds of thousands of highly skilled people who work for Boeing suppliers around the globe. Commercial Airplanes, Defense, Space & Security, and Boeing Global Services are the three business divisions that comprise Boeing. These entities are supported by Boeing Capital Corporation, and the company's functional groups concentrate on information technology, safety, finance, innovation and productivity enhancement, advanced design and manufacturing systems, engineering and program management, technology and development, and program execution.

Your preview ends here

Eager to read complete document? Join bartleby learn and gain access to the full version

Access to all documents
Unlimited textbook solutions
24/7 expert homework help

References Bernal, K. (2022, December 29). What Are the Top Boeing Government Contracts? Executive Gov. https://executivegov.com/articles/what-are-the-top-boeing-government-contracts/ Wayback Machine . (n.d.). https://web.archive.org/web/20180508151641/http://www.boeing.com/resources/ boeingdotcom/history/pdf/Boeing_Chronology.pdf Hansen, Drew (February 21, 2023). " Boeing offers CEO Dave Calhoun more than $5M in additional stock awards to stay on ". American City Business Journals. https://www.bizjournals.com/washington/news/2023/02/21/boeing-dave-calhoun- compensation.html Boeing’s worldwide revenue 2022 | Statista . (2023, September 29). Statista. https://www.statista.com/statistics/264374/boeings-worldwide-revenue/ Boeing . (n.d.). Fortune. https://web.archive.org/web/20170630173450/http://fortune.com/fortune500/boeing/ Global 500 . (2021, August 1). Fortune. https://web.archive.org/web/20211116191448/https://fortune.com/global500/2020/search/? name=boeing Muncaster, P. (2023, October 30). Boeing Investigates LockBit Ransomware Breach Claims . Infosecurity Magazine. https://www.infosecurity-magazine.com/news/boeing-lockbit- ransomware-breach/

Mascellino, A. (2022, November 1). LockBit Dominates Ransomware Campaigns in 2022: Deep Instinct . Infosecurity Magazine. https://www.infosecurity-magazine.com/news/lockbit- dominates-ransomware/ Boeing Breach . (2023, October 28). Twitter. Retrieved November 28, 2023, from https://twitter.com/vxunderground/status/1718243288287764803 Boeing confirms cyberattack; Lockbit claims responsibility . (2023, November 2). Investing.com. https://www.investing.com/news/stock-market-news/boeing-confirms-cyberattack-lockbit- claims-responsibility-93CH-3218071?prefer_reader_view=1&prefer_safari=1 Boeing faces cybersecurity breach, ransomware group LockBit threatens data leak . (2023, November 6). Investing.com South Africa. https://za.investing.com/news/boeing-faces- cybersecurity-breach-ransomware-group-lockbit-threatens-data-leak-93CH-2921053 Millward, W. T. (2022, September 30). Citrix-Tibco Close $17B Deal, Uniting Virtualization And Enterprise Apps Vendors | CRN . CRN. https://www.crn.com/news/cloud/citrix-tibco-close- 17b-deal-uniting-virtualization-and-enterprise-apps-vendors Sharwood, S. (2022, October 4). NetScaler reclaims identity after Citrix, Tibco merge as ‘Cloud Software Group.’ https://www.theregister.com/2022/10/04/cloud_software_group_tibco_citrix/ Pol, F. H. (2023, November 20). Citrix Bleed vulnerability exploited before it was even discovered . Techzine Europe. https://www.techzine.eu/news/security/113466/citrix-bleed- vulnerability-exploited-before-it-was-even-discovered/

Boeing: Compliance & Ethics . (n.d.). https://www.boeing.com/principles/ethics-and- compliance.page#/conduct Boeing: Innovation . (n.d.). https://www.boeing.com/innovation/#/digital New cloud partnerships strengthen Boeing’s digital foundation . (n.d.). Boeing. https://onfirstup.com/boeing/BNN/articles/new-cloud-partnerships-strengthen-boeing-s-digital- foundation-1?bypass_deeplink=true The Boeing Company: General Information . (n.d.). https://www.boeing.com/company/general- info/

Your preview ends here

Eager to read complete document? Join bartleby learn and gain access to the full version

Access to all documents
Unlimited textbook solutions
24/7 expert homework help

Lockbit Boeing Data Breach

Related Documents