Sony Pictures: Inside the Hack of the Century, Part 1

[InfoSec News <alerts () infosecnews org>]

https://fortune.com/sony-hack-part-1/

By Peter Elkind
Fortune.com
June 25, 2015

A cyber-invasion brought Sony Pictures to its knees and terrified 
corporate America. The story of what really happened—and why Sony should 
have seen it coming. A special three-part investigation.

On Monday, Nov. 3, 2014, a four-man team from Norse Corp., a small 
“threat-intelligence” firm based in Silicon Valley, arrived early for an 
11:30 a.m. meeting on the studio lot of Sony Pictures Entertainment, in 
the Los Angeles suburb of Culver City. They were scheduled to see Sony’s 
top cybersecurity managers to pitch Norse’s services in defending the 
studio against hackers, who had been plaguing Sony for years.

After a quick security check at the front gate and then proceeding to the 
George Burns Building on the east side of the Sony lot, the Norse group 
walked straight into the unlocked first-floor offices of the information 
security department, marked with a small sign reading info sec. There was 
no receptionist or security guard to check who they were; in fact, there 
was no one in sight at all. The room contained cubicles with unattended 
computers providing access to Sony’s international data network.

The visitors found their way to a small sitting area outside the office of 
Jason Spaltro, Sony’s senior vice president for information security, 
settled in, and waited. Alone. For about 15 minutes.

“I got a little shocked,” says Tommy Stiansen, Norse’s co-founder and 
chief technology officer. “Their Info Sec was empty, and all their screens 
were logged in. Basically the janitor can walk straight into their Info 
Sec department.” Adds Mickey Shapiro, a veteran entertainment attorney who 
helped set up the meeting and was present that day: “If we were bad guys, 
we could have done something horrible.”

[...]

--
Evident.io - Continuous Cloud Security for AWS.
Identify and mitigate risks in 5 minutes or less.
Sign up for a free trial @ https://evident.io/