Analysis of the Sony Data Breach and Importance of Adversarial Mindset, Access Control, and Threat M

The Sony Data Breach Case Study and its Relation to Confidentiality and the CIA Triad

For the incident analysis, the chosen data breach case study is the Sony breach. The most applicable factor from the CIA triad for the case of Sony data breach is the confidentiality (Kamra & Scott, 2019). The hackers were able to gain the sensitive and confidential data of the company that included the various information such as emails, company documents, banking information, passwords and the PII of the staffs of the company. There was no access control for the users. Therefore, the unauthorized person was able to access and view the information. The adversarial mindset can be effectively used for analyzing the aim of the hackers for informing the attacks by allowing the information system analyst for viewing the incident through mind of the attackers.

 

For having he adversarial mindset, the analyst should think like the hacker (Srivatanakul & Annansingh, 2021). As the hackers are much more creative, practical and analytical, then the adversarial mindset of the analyst will be to have the same skills like the hackers so that they can predict the move of the hackers with their adversarial mindset, which can be achieved successfully. 

If I was in the place of the analyst in Sony, I would like to make some changes in the organization. First I would like to inform all the employees and the other person involved in this organization so that they also can be aware of the incident. I would arrange training for the employees so that they can be educated about the security. I would implement the access control in the organization so that any unauthorized person can not access the data. 

 

Threat modeling is the process to optimize the security of the network by describing the vulnerabilities and objectives that is used for identifying the methods and motivation, which the attacker or the hackers can use for exploiting the vulnerability or they can use this for threaten the system. Using the threat modeling, the organization will be more aware of the practices and protocols related to the security (Wuyts et al., 2018). This will also enhance the threat management of the organization. The threat modeling will provide the road map for the staffs and the employees of the company. This will also have the great impact on IT department of the organization. For understanding the effect of the threat modeling, the organization will need to be dissected. The organizational advantage beyond the security control, which may arise from the threat modeling can be updated exposure of the risk, help in identifying the responsibilities and roles as well as determining the way for making the decision, which will involve the attacks.

The threat modeling can be different within the various roles of IT as all the roles have the different list of the activities for focusing on (Xiong & Lagerström, 2019). The pen tester will be able to use the threat modeling as the guide on the attack type, which can occur in the system. The pen tester will be able to find the vulnerabilities, which have not suffered while the development of the system. The system analyst can use the threat modeling for analyzing threats and to determine how the threats can occur. This will also be helpful for the developers for creating the secure software.