(bright percussive music)
-: The name Ashley Madison may sound innocent,
but with the byline on their website,
life is short, have an affair,
this online dating organisation is anything but.
It's not surprising that, in 2015,
it became the target of a cyber attack,
where customers' real names, credit card details,
and secret fantasies were revealed on the internet.
This security breach left Ashley Madison
and its customers red in the face.
So what went wrong?
A few things.
Ashley Madison didn't protect the privacy
of their customers' data,
and so hackers were able to get through
the inadequate password protection technology
that was in place.
It's estimated that 15 million passwords
were vulnerable to hackers because they had not implemented
strong password hash encryption technology.
Like many websites, Ashley Madison could be accessed
with a user name and password.
This is called advanced authentication.
Unfortunately, many of Ashley Madison's customers
had weak passwords, which increased the risk
of unauthorised access and use of their personal data.
While security technology can be in place,
users also need to use good security protocol
when setting up passwords.
In addition to the absence of appropriate data security,
Ashley Madison did not comply with regulatory requirements
to delete records when requested by its customer.
In this example, customer details
that should've been deleted were stolen
and posted on the internet.
This malicious attack on Ashley Madison has legal impacts
that would've also affected the company's reputation.
Now if you are a hacker,
your favourite method is to put malicious attachments
in email messages and see who takes the bait.
You might do this to slow down their computer
and interrupt their access to the internet.
But a greater prize to you is the ability
to gain access to an organization's network
and then modify their programmes, take data,
upload fake data, or corrupt the data on their system.
What can organisations do to combat this?
At a basic level, internet security software
should be on all devices.
Where centralised networks exist,
you need a firewall to act as a gateway
between your organization's network and the internet.
For some organisations, like government departments,
information is kept on their own servers,
secured in a physical location
where only authorised personnel can access.
Multi-factor authentication
requires identification of the user in multiple ways.
The most simple method is, after you put in a password,
the system sends you a code to your mobile phone
as secondary authentication.
Biometric authentication
was something we saw in the film, "Gattaca" many years ago,
but now, it's standard on nearly every new mobile phone.
Back to being a hacker.
Another hassle we like to cause is a website crashing.
To do this, we need to call on
all the computers we have infected with our computer virus.
These slave computers are located across the world
and there might be hundreds of thousands of them.
You execute some code that calls on all of these computers
to send simultaneous requests to a website server.
It is like a lightning strike of messages
which increases the load instantly
and causes the whole website to crash.
This is called a distributed denial of service attack.
You don't steal any data during it.
You just frustrate a company by crashing their site.
Ironically, the largest in a DDOS attack was on GitHub,
a software platform for developers.
1.35 terabytes of data was sent per second, which is a lot.
To recap, most organisations use software, the internet,
and other digital forms to run their business operations
and deliver products and services.
With the increasing use of big data to better understand
and personalise the customer experience,
there is always a risk of data security
and unauthorised system access.
There are lessons to be learned from Ashley Madison
about the importance of having
appropriate internet security software.
Organisations also need to have in place
data security policies and procedures
and train their staff on how to comply
with safe data security practises.
And most importantly of all,
don't make your password abc123.