CIS 101 Lab

Exercise

Cybersecurity

Jiang zongying

Section 56
 Jiang 2

M00145995

Zj26s@[Link]
 Jiang 3

Capital One Data Breach

In March 2019, Capital One, a major banking institution in the United States, suffered a

significant data breach. This incident impacted about 100 million customers in the United

States and around 6 million customers in Canada, exposing sensitive information such as

names, addresses, dates of birth, social security numbers, and detailed bank account

information. This breach not only revealed weaknesses in Capital One’s cybersecurity

infrastructure but also highlighted broader concerns about data security in the age of cloud

computing. To understand how organizations can better protect themselves from similar

threats, it is crucial to examine the technical aspects of the breach, the compliance and

regulatory failures, deficiencies in risk management, and Capital One’s response and

recovery efforts.

The Capital One data breach was caused by specific technical vulnerabilities in its

infrastructure. The attacker exploited a misconfigured Web Application Firewall (WAF) on

Amazon Web Services (AWS), which enabled a Server-Side Request Forgery (SSRF) attack.

This type of attack deceives a web application into retrieving data from an internal server it

should not be able to access. Additionally, the attacker exploited overly permissive AWS

Identity and Access Management (IAM) roles to escalate privileges and access sensitive data

stored in S3 buckets. The breach was further facilitated by the absence of proper access

controls and network segmentation within Capital One's AWS environment. The attacker,

identified as Paige Thompson, a former Amazon Web Services (AWS) employee, used s tolen
 Jiang 4

credentials to access Capital One's AWS instance. Using these credentials, Thompson

executed commands that listed the buckets in the Simple Storage Service (S3), from which

she downloaded sensitive data. The SSRF vulnerability and misconfigured WAF indicate a

lapse in internal security controls and monitoring systems. The lack of proper encryption of

data at rest also contributed to the ease of data extraction by the attacker.

Despite stringent compliance controls and cybersecurity legislation, the Capital One data

breach in 2019 exposed significant vulnerabilities. This highlights the gap between static

regulatory frameworks, like GDPR and NIST, and the rapidly evolving threat landscape.

Compliance often focuses on meeting minimum standards rather than actively securing

systems, resulting in a false sense of security. Implementation gaps, such as the WAF

misconfiguration, and human error underscore the need for continuous monitoring and

validation of security controls. The complexity of IT environments and reliance on third-party

services like AWS add further challenges, necessitating stringent risk management practices.

Meanwhile, the breach resulted in significant scrutiny regarding Capital One's adherence to

GDPR, especially concerning data protection and the prompt reporting of the breach. GDPR

requires organizations to report data breaches within 72 hours, and any delay can result in

hefty fines. It also faced fines and legal actions, impacting its financial standing and

reputation. It proves that effective cybersecurity requires a proactive approach, including

regular risk assessments, robust incident response planning, and a commitment to continuous

improvement beyond mere compliance. The Capital One breach illustrates that compliance

controls and legislation, while necessary, are insufficient alone; organizations must actively

seek out and mitigate risks to protect sensitive data and prevent future breaches.
 Jiang 5

Effective risk management strategies can mitigate the impact of the breach. Regular and

thorough risk assessments could have identified the SSRF vulnerability and the WAF

misconfiguration before they were exploited. These assessments should include testing for

common vulnerabilities and misconfigurations, as well as evaluating the effectiveness of

existing security controls. At the same time, implementing strict access controls and

monitoring could also have prevented unauthorized access to sensitive data. Access controls

should be based on the principle of least privilege, ensuring that users only have access to the

data and resources necessary for their roles. Incident response plans and penetration testing

are good measures to proactively identify and mitigate similar risks. Developing and

maintaining an incident response plan ensures that organizations are prepared to quickly and

effectively respond to breaches. Regular penetration testing and vulnerability assessments can

help identify weaknesses in the security infrastructure. These tests simulate real-world attacks

to uncover vulnerabilities that might be exploited by attackers.

After the breach, capital one promptly fixed the configuration vulnerability and started a

comprehensive review of its cloud security practices. This included working with external

cybersecurity experts to conduct a thorough investigation and ensure that all vulnerabilities

were addressed. At the same time, the company notified affected customers and regulatory

bodies about the breach. They maintained transparency with its customers, explaining the

steps taken to secure their data and prevent future breaches. Capital One's transparency in

communicating the breach to the public and its customers was a crucial step in managing the

crisis and maintaining trust. In the future, capital one should enhance security posture,

investing in improving its security infrastructure, including better configuration management,

enhanced monitoring, and encryption of data. They also should improve training and

awareness. Regular training for employees on cybersecurity best practices and awareness

programs to recognize potential threats. Employee training programs are essential in building

a culture of security within the organization and ensuring that all staff members understand

their roles in protecting sensitive information.

The Capital One data breach serves as a stark reminder of the importance of robust

cybersecurity practices and compliance. By analyzing the technical failures, regulatory

inadequacies, risk management oversights, and response strategies, organizations can learn

valuable lessons to protect themselves against similar incidents. Continuous improvement in

security measures, adherence to compliance standards, and proactive risk management are

essential in safeguarding sensitive data in the digital age.