Due to great success of TW since it was acquired in 2016, the CEO of The New York Times Mark Thompson acquired more online firms doing the same kind of product recommendations to expand TW’s capacity and market reach: BuzzFeed, The Strategist, and Reviewed.com. TW has an IT staff that is overseeing the IT platforms of the original TW firm and those of the recently acquired firms. At the time of the acquisition of the last three online firms, TW’s IT performed the most basic tasks involved to ensure that information and data could be exchanged among the multiple platforms. Security concerns were addressed, but only, at the most basic level. TW, at the time of the most recent acquisitions, also did not really have a dedicated security team within the IT staff. In today’s marketplace that supports intense competition, there are frequent corporate mergers and acquisitions taking place. Thus, multiple diverse IT platforms often need to be managed by IT staffs of the resultant merged firms. The skills needed, though, to competently “splice” a hodge podge of IT platforms are not widely available. Usually, members of typical IT staffs are trained in understanding basic networking concepts and practices, and are usually familiar with one IT environment under a dominant networking vendor platform. It is truly difficult to find skilled networking specialists trained across networks operating under various platforms such as Windows, Mac OS, Linux, Unix, mainframe systems, etc. In addition, network security, by itself, is a different skill set altogether. An ideal security staff member should have a foundation in basic security concepts related to networking and built-in security mechanisms of each platform and how it behaves within the context of a specific vendor solution. The onset of mobile computing and ubiquity of mobile devices such as laptops, tablets, and smartphones has also exacerbated the security challenges in multi-platform heterogeneous networks. TW Network Breach On March 15, 2017, a TW customer made a frantic telephone call to the customer support service line of TW and reported that she was seeing a random scrolling list of customers on the TW homepage. The information that scrolled dynamically up and down the homepage included customer names, payment details such as credit card numbers, contact information such as cell and phone numbers, addresses, transaction history, etc. The customer support staff immediately contacted Ronald Stewart, the Chief Information Officer (CIO) of TW, who, then, convened his staff for an urgent meeting to assess the situation and do whatever it took to prevent any more damage. The IT staff’s initial step was to shut down TW’s network temporarily. The team unanimously attributed the incident, now brewing into a disaster, to the firm’s new challenge of dealing with multi-platform IT environments. The timing for the attack was also fortuitous --- it took place immediately after the acquisitions. Clearly, the hackers figured out that if they jumped the gun, TW wouldn’t have enough time to retrofit a solid enough security plan that would effectively glue the holes in what was clearly a patchwork of IT systems they would have had to deal with. In the meantime, TW Ronald Stewart swiftly advised the TW CEO to approve a formal statement to the press in order to protect the integrity of the firm’s brand name, which the firm has so well built up and invested in since 2016. A statement was quickly crafted by the firm’s public relations staff and released two days later. Take the role of a consultant contacted by Ronald Stewart to study what happened to TW. You are asked to do the following: 1. Evaluate possible causes for the security incident at TW. 2. Recommend a comprehensive course of action that TW and its IT staff should seriously consider undertaking to be better prepared to face future security threats and attacks.
Due to great success of TW since it was acquired in 2016, the CEO of The New York Times Mark Thompson acquired more online firms doing the same kind of product recommendations to expand TW’s capacity and market reach: BuzzFeed, The Strategist, and Reviewed.com.
TW has an IT staff that is overseeing the IT platforms of the original TW firm and those of the recently acquired firms. At the time of the acquisition of the last three online firms, TW’s IT performed the most basic tasks involved to ensure that information and data could be exchanged among the multiple platforms. Security concerns were addressed, but only, at the most basic level. TW, at the time of the most recent acquisitions, also did not really have a dedicated security team within the IT staff.
In today’s marketplace that supports intense competition, there are frequent corporate mergers and acquisitions taking place. Thus, multiple diverse IT platforms often need to be managed by IT staffs of the resultant merged firms. The skills needed, though, to competently “splice” a hodge podge of IT platforms are not widely available. Usually, members of typical IT staffs are trained in understanding basic networking concepts and practices, and are usually familiar with one IT environment under a dominant networking vendor platform. It is truly difficult to find skilled networking specialists trained across networks operating under various platforms such as Windows, Mac OS, Linux, Unix, mainframe systems, etc. In addition, network security, by itself, is a different skill set altogether. An ideal security staff member should have a foundation in basic security concepts related to networking and built-in security mechanisms of each platform and how it behaves within the context of a specific vendor solution.
The onset of mobile computing and ubiquity of mobile devices such as laptops, tablets, and smartphones has also exacerbated the security challenges in multi-platform heterogeneous networks.
TW Network Breach
On March 15, 2017, a TW customer made a frantic telephone call to the customer support service line of TW and reported that she was seeing a random scrolling list of customers on the TW homepage. The information that scrolled dynamically up and down the homepage included customer names, payment details such as credit card numbers, contact information such as cell and phone numbers, addresses, transaction history, etc. The customer support staff immediately contacted Ronald Stewart, the Chief Information Officer (CIO) of TW, who, then, convened his staff for an urgent meeting to assess the situation and do whatever it took to prevent any more damage. The IT staff’s initial step was to shut down TW’s network temporarily. The team unanimously attributed the incident, now brewing into a disaster, to the firm’s new challenge of dealing with multi-platform IT environments. The timing for the attack was also fortuitous --- it took place immediately after the acquisitions. Clearly, the hackers figured out that if they jumped the gun, TW wouldn’t have enough time to retrofit a solid enough security plan that would effectively glue the holes in what was clearly a patchwork of IT systems they would have had to deal with.
In the meantime, TW Ronald Stewart swiftly advised the TW CEO to approve a formal statement to the press in order to protect the integrity of the firm’s brand name, which the firm has so well built up and invested in since 2016. A statement was quickly crafted by the firm’s public relations staff and released two days later.
Take the role of a consultant contacted by Ronald Stewart to study what happened to TW. You are asked to do the following:
1. Evaluate possible causes for the security incident at TW.
2. Recommend a comprehensive course of action that TW and its IT staff should seriously consider undertaking to be better prepared to face future security threats and attacks.
Step by step
Solved in 2 steps
