Data Integrity and Incident Response
What can companies do about integrity attacks? The answer is both simple and complex.
October 27, 2017 at 12:57 PM
6 minute read
Imagine the following: Cyber criminals attack a credit reporting agency, compromising 143 million American records—one of the largest data breaches on record. While the attack is incredibly impactful, these cyber criminals, looking to cripple the financial sector, use the data breach as a smoke screen to surreptitiously attack the credit reporting agency's data collection, analysis and reporting systems, which in totality ensure that no data produced by the reporting agency can be relied upon. Once discovered, the attack on the integrity of the agency's data causes all credit data to be rendered useless, utterly devastating the entire financial market and causing widespread distrust of financial institutions across the world.
While this may seem like a contrived example pulled from the pages of a Mr. Robot script, it is certainly a possibility that could have happened in the now infamous Equifax data breach, which was first disclosed on September 7, 2017. The skill required to successfully exfiltrate 143 million records, is certainly sufficient to successfully attack the integrity of that very same data. It is generally accepted that cyber criminals have not performed integrity attacks because there is a minimal profit motive: Records have a black-market value; in integrity attacks, there is no deliverable that can be sold.
This paradigm may be shifting. There are two key pressures causing this shift. First, as criminals become more sophisticated financial actors, they will be able to take significant, leveraged, short positions on a variety of securities, which they would know would crash on news breaking about the attack. In addition to this form of sophistication, cyber criminals are also learning and developing business strategies for black market goods. Ultimately, personal data such as credits are low profit endeavors, and cyber criminals looking to maximize returns, are creating more sophisticated, data driven attacks, such as identity hijacking and filing false tax returns. This development forces these criminals to more closely interact with and work with data, rather than merely stealing it. Second, the “hacker-for-hire” market is becoming more developed, and barriers for entry into those markets are falling. As such, unskilled groups that could benefit from a successful integrity (i.e., politically motivated groups or business competitors) will stimulate the market and create the profit motive for skilled cyber criminals to engage in these types of attacks. Furthermore, there are more than just cyber criminals acting in cyberspace. Nation-states have a different motivation altogether; their motivation can be to destabilize the economies of their potential enemies—a course of action that is far safer, and potentially more impactful, than a kinetic skirmish. It is important to note here, that while we use the Equifax breach as an illustrative example, integrity attacks can affect organizations of any size and in any industry. Simply put, anyone that uses data as an input or output in their business is vulnerable to an integrity attack.
What can companies do about integrity attacks? The answer is both simple and complex. Ensuring a good cybersecurity posture begins by understanding the threats your organization faces, and ends with preparing your organization for an inevitable successful cyber-attack. At both of these key planning stages, it is critical to understand the threats facing your organization. In order to be able to understand the threats to an organization, it is necessary to understand the ways in which criminals can attack the organization. Specific to this inquiry is understanding how criminals attack data. Once that is well understood, it is possible to plan for protection from those attack vectors, and it is then possible to prepare an incident response plan in the case of any one attack vector being successful.
Conventionally, the cybersecurity community has developed the C-I-A Triad to conceptualize the threats to data (and in turn what must be protected). 'C' stands for Confidentiality, 'I' stands for integrity, and 'A' stands for availability. These terms are defined in 44 U.S.C. § 3542:
- Confidentiality: “Preserving authorized restrictions on information access and disclosure, including means for protecting personal privacy and proprietary information . . .”
- Integrity: “Guarding against improper information modification or destruction, and includes ensuring information non-repudiation and authenticity . . .”
- Availability: “Ensuring timely and reliable access to and use of information . . .”
Each term represents a distinct quality of data that an attacker can target. Traditionally, confidentiality has been a favored attack vector, resulting in the rise of data breaches. Recently, cyber criminals have begun to turn towards attacking the availability of data, which has resulted in the recent surge of large-scale ransomware campaigns, such as WannaCry and NotPetya. One of the reasons these ransomware campaigns have been so successful is that they were not identified as threats at the beginning of many organization's cybersecurity cycles, and, in turn, were not focused on in incident response planning—the end of the cybersecurity cycle.
While organizations have begun preparing for availability attacks, attacks on the integrity of data have been largely ignored. As discussed in the earlier hypothetical presented above, the cost associated with an attack on data integrity can be devastating not only to the attacked organization, but to all organizations that rely on that data, which can fundamentally affect whole industries. Ultimately, mitigating availability, and even integrity attacks, comes down to having, and being able to efficiently use, full data backups. The only difficulty is knowing when to back up from. Knowing the date of compromise is critical because backing up before that date does nothing to mitigate the underlying attack, and risks leaving the backups vulnerable. Additionally, as cyber-attacks regularly go undetected for large periods time, the mean time to detection, as reported in the 2017 Cost of Data Breach Study was 191 days (with a range of 24 to 546 days), so organizations must be proactive, particularly in the integrity attack context, to active hunt for these threats or risk facing the consequences.
In response to this potentially catastrophic cost, organizations do not have the luxury, as they did with availability attacks, to wait until headlines fill with reports of these attacks. They must proactively prepare risk assessments and incident response plans for dealing with attacks on data integrity. Integrity attacks must be included in risk assessments, and they must be planned for in an incident response plan. Organizations must actively hunt for integrity attacks, as they can remain latent and undiscovered until all of an organization's targeted data is corrupted, or even worse, if the faulty data is used as an input in a larger project, whether it be credit reporting, largescale public works, or the prescription drug industry, countless dollars and lives are put at risk when the threat is not appreciated.
Benjamin Dynkin is a law clerk at Grauman Law Group in their cybersecurity practice group. Barry Dynkin is the head of the cybersecurity practice group. E.J. Hilbert is a seasoned cybercrime expert and has held various positions in public and private service.
This content has been archived. It is available through our partners, LexisNexis® and Bloomberg Law.
To view this content, please continue to their sites.
Not a Lexis Subscriber?
Subscribe Now
Not a Bloomberg Law Subscriber?
Subscribe Now
NOT FOR REPRINT
© 2025 ALM Global, LLC, All Rights Reserved. Request academic re-use from www.copyright.com. All other uses, submit a request to [email protected]. For more information visit Asset & Logo Licensing.
You Might Like
View AllIn-House Lawyers Are Focused on Employment and Cybersecurity Disputes, But Looking Out for Conflict Over AI
As AI-Generated Fraud Rises, Financial Companies Face a Long Cybersecurity Battle
AI Adoption, Data Center Building Boom Opening More Doors for Cybercriminals, Many of Them Teenagers
Trending Stories
- 1Uber Files RICO Suit Against Plaintiff-Side Firms Alleging Fraudulent Injury Claims
- 2The Law Firm Disrupted: Scrutinizing the Elephant More Than the Mouse
- 3Inherent Diminished Value Damages Unavailable to 3rd-Party Claimants, Court Says
- 4Pa. Defense Firm Sued by Client Over Ex-Eagles Player's $43.5M Med Mal Win
- 5Losses Mount at Morris Manning, but Departing Ex-Chair Stays Bullish About His Old Firm's Future
Who Got The Work
J. Brugh Lower of Gibbons has entered an appearance for industrial equipment supplier Devco Corporation in a pending trademark infringement lawsuit. The suit, accusing the defendant of selling knock-off Graco products, was filed Dec. 18 in New Jersey District Court by Rivkin Radler on behalf of Graco Inc. and Graco Minnesota. The case, assigned to U.S. District Judge Zahid N. Quraishi, is 3:24-cv-11294, Graco Inc. et al v. Devco Corporation.
Who Got The Work
Rebecca Maller-Stein and Kent A. Yalowitz of Arnold & Porter Kaye Scholer have entered their appearances for Hanaco Venture Capital and its executives, Lior Prosor and David Frankel, in a pending securities lawsuit. The action, filed on Dec. 24 in New York Southern District Court by Zell, Aron & Co. on behalf of Goldeneye Advisors, accuses the defendants of negligently and fraudulently managing the plaintiff's $1 million investment. The case, assigned to U.S. District Judge Vernon S. Broderick, is 1:24-cv-09918, Goldeneye Advisors, LLC v. Hanaco Venture Capital, Ltd. et al.
Who Got The Work
Attorneys from A&O Shearman has stepped in as defense counsel for Toronto-Dominion Bank and other defendants in a pending securities class action. The suit, filed Dec. 11 in New York Southern District Court by Bleichmar Fonti & Auld, accuses the defendants of concealing the bank's 'pervasive' deficiencies in regards to its compliance with the Bank Secrecy Act and the quality of its anti-money laundering controls. The case, assigned to U.S. District Judge Arun Subramanian, is 1:24-cv-09445, Gonzalez v. The Toronto-Dominion Bank et al.
Who Got The Work
Crown Castle International, a Pennsylvania company providing shared communications infrastructure, has turned to Luke D. Wolf of Gordon Rees Scully Mansukhani to fend off a pending breach-of-contract lawsuit. The court action, filed Nov. 25 in Michigan Eastern District Court by Hooper Hathaway PC on behalf of The Town Residences LLC, accuses Crown Castle of failing to transfer approximately $30,000 in utility payments from T-Mobile in breach of a roof-top lease and assignment agreement. The case, assigned to U.S. District Judge Susan K. Declercq, is 2:24-cv-13131, The Town Residences LLC v. T-Mobile US, Inc. et al.
Who Got The Work
Wilfred P. Coronato and Daniel M. Schwartz of McCarter & English have stepped in as defense counsel to Electrolux Home Products Inc. in a pending product liability lawsuit. The court action, filed Nov. 26 in New York Eastern District Court by Poulos Lopiccolo PC and Nagel Rice LLP on behalf of David Stern, alleges that the defendant's refrigerators’ drawers and shelving repeatedly break and fall apart within months after purchase. The case, assigned to U.S. District Judge Joan M. Azrack, is 2:24-cv-08204, Stern v. Electrolux Home Products, Inc.
Featured Firms
Law Offices of Gary Martin Hays & Associates, P.C.
(470) 294-1674
Law Offices of Mark E. Salomone
(857) 444-6468
Smith & Hassler
(713) 739-1250