{"id":2342,"date":"2018-12-03T11:57:39","date_gmt":"2018-12-03T15:57:39","guid":{"rendered":"https:\/\/solutionsreview.com\/security-information-event-management\/?p=2342"},"modified":"2018-12-04T12:25:49","modified_gmt":"2018-12-04T16:25:49","slug":"lessons-marriott-breach-gates-marshall-compliancepoint","status":"publish","type":"post","link":"https:\/\/solutionsreview.com\/security-information-event-management\/lessons-marriott-breach-gates-marshall-compliancepoint\/","title":{"rendered":"Lessons From The Marriott Breach with Gates Marshall of CompliancePoint"},"content":{"rendered":"

\"Lessons<\/p>\n

The Marriott Breach\u2014one of the largest breaches in the history of cybersecurity\u2014dominated headlines over the weekend. 500 million customers had their vital personal identifying information exposed and potentially stolen, with the breach dwelling on the network for years before being discovered. <\/span><\/p>\n

\t\t\t

<\/a><\/p>\n<\/div>\n\t\t<\/div><\/div><\/p>\n

Now is the time to ask the real questions: what can enterprises learn from the Marriott Breach? How can they fortify their own networks to prevent a breach of this proportion? What compliance issues will this breach cause? \u00a0<\/span><\/p>\n

To gain more perspective on these questions, we spoke with Gates Marshall, Director of Cyber Services at <\/span>CompliancePoint<\/span><\/a>. Here\u2019s our conversation, edited slightly \u00a0\u00a0<\/span><\/p>\n

Solutions Review: How could a security issue this big go unaddressed and undetected for so long? \u00a0<\/b><\/h4>\n

Gates Marshall: From what has been disclosed, it appears this breach started in 2014, prior to the Marriott acquisition of [Starwoods Properties]. In theory, this should have been identified as part of a cyber risk assessment conducted during the M&A activities. It\u2019s likely that the different corporate entities had different levels of security maturity and this issue was obscured as the company worked to merge systems. Whatever detective controls were in place, like security alerts, may not have been applied to all assets. There was a purported breach of the Marriott incident response team in 2017 that should have triggered a thorough review which may have identified this. In the end, attackers can be very advanced and the commotion around M&A homogenization activities created enough fog for this incident to last for 4 years.<\/span><\/p>\n

SR: What information security or penetration testing tactics, capabilities, or strategies could have helped Marriott avoid this breach? Could anything have stopped the Marriott Breach?<\/b>
\n<\/span><\/h4>\n

GM: At the end of the day, a criminal needs three things to breach something:<\/span><\/p>\n

    \n
  1. \u00a0A way in<\/span><\/li>\n
  2. Access to the data cookie jar<\/span><\/li>\n
  3. A way to get the data back in attacker control to sell etc.<\/span>
    \n<\/span><\/li>\n<\/ol>\n

    Vulnerability scanning and penetration testing can help detect \u201cways in\u201d so that they can fix the issue before a breach occurs. <\/span>
    \n<\/span><\/p>\n

    Implementing cyber resiliency controls, which assume a compromise has occurred and are designed to limit the scope of the breach, would have made it harder to get to the data cookie jar and\/or impossible to get there without detection. \u00a0<\/span>
    \n<\/span><\/p>\n

    Implementing various alerting technologies<\/a> would generate alerts as the data was attempted to be exfiltrated back to the attackers’ control. The public statements by Marriott indicate that some data was encrypted by the attacker, which is a common tactic to mask the data as it\u2019s being sent back out the door. Preventing the attacker from being able to execute the encryption routine or other system hardening steps could be taken to make it harder to mask the data. Using data leak prevention technologies to detect and block the transmission of sensitive data types would have helped.<\/span><\/p>\n

    Creating fictitious records<\/a> in the customer database that should never be accessed for a legitimate reason and then configuring auditing on those records would also help. The attackers aren\u2019t selectively choosing records to export in most instances, they\u2019re getting them all. Having an alert mechanism of some sort for mass data transfers or sensitive record access would further alleviate the risk. <\/span><\/p>\n

    SR: What do you think the Marriott Breach will mean for corporate compliance initiatives overall? <\/b>
    \n<\/span><\/h4>\n

    Compliance is a focus of sectoral standards for the most part: \u201chealthcare does this, credit cards do that\u201d kind of logic. <\/span>
    \n<\/span><\/p>\n

    I think companies need to go back to their drawing boards and define their non-regulatory needs, such as keeping customer loyalty or preparation for forthcoming cyber and privacy laws that aren\u2019t enforced yet. These should be integrated into the overall compliance initiatives being performed. Brand loyalty today is very important, and we\u2019ve seen a few recent loyalty program breaches. A breach is a great way to discourage continued usage of the brand loyalty programs. \u00a0<\/span>
    \n<\/span><\/p>\n

    This breach seems very relevant considering several fast food restaurants apps now. It\u2019s a new way to engage with the customer, but there\u2019s a fine line between customer interest and lost customers interest in the event of a breach. <\/span>
    \n<\/span><\/p>\n

    SR: What should companies take away from the Marriott Breach in terms of data storage, data security, and network visibility?<\/b>
    \n<\/span><\/h4>\n

    GM: If you don\u2019t need it, don\u2019t keep it. If you don\u2019t have the information to lose, your risk is eliminated. <\/span><\/p>\n

    Encryption is not just for credit card numbers. All PII is important. Consider expanding existing controls, such as those mandated by PCI for credit cards, to other non-payment related systems in the overall environment. \u00a0<\/span>
    \n<\/span><\/p>\n

    Implement a robust vulnerability management program. It\u2019s unknown if the attackers compromised an external website to get in or sent something as simple a phishing email<\/a>, but it\u2019s likely that after getting in they needed to do a series of exploits. Detecting potential weaknesses, validating those weaknesses, and fixing those weaknesses will make it much harder for an attacker to break in or move around once they\u2019re inside your systems. <\/span><\/p>\n

    SR: Do you think Marriott will run afoul of GDPR? And what will that look like?<\/b>
    \n<\/span><\/h4>\n

    It\u2019s unknown if EU natural person data was compromised. Based on the size of the breach it seems likely that some EU natural person data was also compromised. Marriott is likely working with their EU DPA representative to facilitate transparency and involvement by the supervisory authorities there. Another potential issue around GDPR is that the record set was so large. It\u2019s unknown if Marriott had a lawful basis to collect or maintain the various data elements that were disclosed to have been breached. \u00a0\u00a0<\/span>
    \n<\/span><\/p>\n

    Thanks to Gates Marshall, Director of Cyber Services at <\/b>CompliancePoint<\/b><\/a><\/span>, for his time and expertise on the Marriott Breach.<\/b><\/h4>\n


    Widget not in any sidebars
    \u00a0<\/span><\/p>\n","protected":false},"excerpt":{"rendered":"

    The Marriott Breach\u2014one of the largest breaches in the history of cybersecurity\u2014dominated headlines over the weekend. 500 million customers had their vital personal identifying information exposed and potentially stolen, with the breach dwelling on the network for years before being discovered. Now is the time to ask the real questions: what can enterprises learn from […]<\/p>\n","protected":false},"author":41,"featured_media":1062,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"footnotes":""},"categories":[551],"tags":[353,56,95,338,743,145,112,86,915,920,21,57,22],"acf":[],"yoast_head":"\nLessons: The Marriott Breach with Gates Marshall of CompliancePoint<\/title>\n<meta name=\"description\" content=\"Now is the time to ask the real questions: what can enterprises learn from the Marriott Breach? We spoke with Gates Marshall of CompliancePoint for more.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/solutionsreview.com\/security-information-event-management\/lessons-marriott-breach-gates-marshall-compliancepoint\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Lessons: The Marriott Breach with Gates Marshall of CompliancePoint\" \/>\n<meta property=\"og:description\" content=\"Now is the time to ask the real questions: what can enterprises learn from the Marriott Breach? We spoke with Gates Marshall of CompliancePoint for more.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/solutionsreview.com\/security-information-event-management\/lessons-marriott-breach-gates-marshall-compliancepoint\/\" \/>\n<meta property=\"og:site_name\" content=\"SIEM Tools & Security Event Management | Solutions Review\" \/>\n<meta property=\"article:published_time\" content=\"2018-12-03T15:57:39+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2018-12-04T16:25:49+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/solutionsreview.com\/security-information-event-management\/files\/2017\/10\/Untitled-1.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"800\" \/>\n\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Ben Canner\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Ben Canner\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"5 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/solutionsreview.com\/security-information-event-management\/lessons-marriott-breach-gates-marshall-compliancepoint\/\",\"url\":\"https:\/\/solutionsreview.com\/security-information-event-management\/lessons-marriott-breach-gates-marshall-compliancepoint\/\",\"name\":\"Lessons: The Marriott Breach with Gates Marshall of CompliancePoint\",\"isPartOf\":{\"@id\":\"https:\/\/solutionsreview.com\/security-information-event-management\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/solutionsreview.com\/security-information-event-management\/lessons-marriott-breach-gates-marshall-compliancepoint\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/solutionsreview.com\/security-information-event-management\/lessons-marriott-breach-gates-marshall-compliancepoint\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/solutionsreview.com\/security-information-event-management\/files\/2017\/10\/Untitled-1.jpg\",\"datePublished\":\"2018-12-03T15:57:39+00:00\",\"dateModified\":\"2018-12-04T16:25:49+00:00\",\"author\":{\"@id\":\"https:\/\/solutionsreview.com\/security-information-event-management\/#\/schema\/person\/357f925262827fcf840b4341920a1541\"},\"description\":\"Now is the time to ask the real questions: what can enterprises learn from the Marriott Breach? We spoke with Gates Marshall of CompliancePoint for more.\",\"breadcrumb\":{\"@id\":\"https:\/\/solutionsreview.com\/security-information-event-management\/lessons-marriott-breach-gates-marshall-compliancepoint\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/solutionsreview.com\/security-information-event-management\/lessons-marriott-breach-gates-marshall-compliancepoint\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/solutionsreview.com\/security-information-event-management\/lessons-marriott-breach-gates-marshall-compliancepoint\/#primaryimage\",\"url\":\"https:\/\/solutionsreview.com\/security-information-event-management\/files\/2017\/10\/Untitled-1.jpg\",\"contentUrl\":\"https:\/\/solutionsreview.com\/security-information-event-management\/files\/2017\/10\/Untitled-1.jpg\",\"width\":800,\"height\":350,\"caption\":\"FireEye and Mandiant Security Validation Find Limited Cybersecurity Effectiveness\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/solutionsreview.com\/security-information-event-management\/lessons-marriott-breach-gates-marshall-compliancepoint\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/solutionsreview.com\/security-information-event-management\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Lessons From The Marriott Breach with Gates Marshall of CompliancePoint\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/solutionsreview.com\/security-information-event-management\/#website\",\"url\":\"https:\/\/solutionsreview.com\/security-information-event-management\/\",\"name\":\"SIEM Tools & Security Event Management | Solutions Review\",\"description\":\"Evaluating Enterprise SIEM Systems, Log Management Analytics & SOAR Platforms.\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/solutionsreview.com\/security-information-event-management\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/solutionsreview.com\/security-information-event-management\/#\/schema\/person\/357f925262827fcf840b4341920a1541\",\"name\":\"Ben Canner\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/solutionsreview.com\/security-information-event-management\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/63f68345052a446ce0cc9c802dd3f373?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/63f68345052a446ce0cc9c802dd3f373?s=96&d=mm&r=g\",\"caption\":\"Ben Canner\"},\"description\":\"Ben Canner is an enterprise technology writer and analyst covering Identity Management, SIEM, Endpoint Protection, and Cybersecurity writ large. He holds a Bachelor of Arts Degree in English from Clark University in Worcester, MA. He previously worked as a corporate blogger and ghost writer. You can reach him via Twitter and LinkedIn.\",\"url\":\"https:\/\/solutionsreview.com\/security-information-event-management\/author\/bcanner\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Lessons: The Marriott Breach with Gates Marshall of CompliancePoint","description":"Now is the time to ask the real questions: what can enterprises learn from the Marriott Breach? We spoke with Gates Marshall of CompliancePoint for more.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/solutionsreview.com\/security-information-event-management\/lessons-marriott-breach-gates-marshall-compliancepoint\/","og_locale":"en_US","og_type":"article","og_title":"Lessons: The Marriott Breach with Gates Marshall of CompliancePoint","og_description":"Now is the time to ask the real questions: what can enterprises learn from the Marriott Breach? We spoke with Gates Marshall of CompliancePoint for more.","og_url":"https:\/\/solutionsreview.com\/security-information-event-management\/lessons-marriott-breach-gates-marshall-compliancepoint\/","og_site_name":"SIEM Tools & Security Event Management | Solutions Review","article_published_time":"2018-12-03T15:57:39+00:00","article_modified_time":"2018-12-04T16:25:49+00:00","og_image":[{"width":800,"height":350,"url":"https:\/\/solutionsreview.com\/security-information-event-management\/files\/2017\/10\/Untitled-1.jpg","type":"image\/jpeg"}],"author":"Ben Canner","twitter_misc":{"Written by":"Ben Canner","Est. reading time":"5 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/solutionsreview.com\/security-information-event-management\/lessons-marriott-breach-gates-marshall-compliancepoint\/","url":"https:\/\/solutionsreview.com\/security-information-event-management\/lessons-marriott-breach-gates-marshall-compliancepoint\/","name":"Lessons: The Marriott Breach with Gates Marshall of CompliancePoint","isPartOf":{"@id":"https:\/\/solutionsreview.com\/security-information-event-management\/#website"},"primaryImageOfPage":{"@id":"https:\/\/solutionsreview.com\/security-information-event-management\/lessons-marriott-breach-gates-marshall-compliancepoint\/#primaryimage"},"image":{"@id":"https:\/\/solutionsreview.com\/security-information-event-management\/lessons-marriott-breach-gates-marshall-compliancepoint\/#primaryimage"},"thumbnailUrl":"https:\/\/solutionsreview.com\/security-information-event-management\/files\/2017\/10\/Untitled-1.jpg","datePublished":"2018-12-03T15:57:39+00:00","dateModified":"2018-12-04T16:25:49+00:00","author":{"@id":"https:\/\/solutionsreview.com\/security-information-event-management\/#\/schema\/person\/357f925262827fcf840b4341920a1541"},"description":"Now is the time to ask the real questions: what can enterprises learn from the Marriott Breach? We spoke with Gates Marshall of CompliancePoint for more.","breadcrumb":{"@id":"https:\/\/solutionsreview.com\/security-information-event-management\/lessons-marriott-breach-gates-marshall-compliancepoint\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/solutionsreview.com\/security-information-event-management\/lessons-marriott-breach-gates-marshall-compliancepoint\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/solutionsreview.com\/security-information-event-management\/lessons-marriott-breach-gates-marshall-compliancepoint\/#primaryimage","url":"https:\/\/solutionsreview.com\/security-information-event-management\/files\/2017\/10\/Untitled-1.jpg","contentUrl":"https:\/\/solutionsreview.com\/security-information-event-management\/files\/2017\/10\/Untitled-1.jpg","width":800,"height":350,"caption":"FireEye and Mandiant Security Validation Find Limited Cybersecurity Effectiveness"},{"@type":"BreadcrumbList","@id":"https:\/\/solutionsreview.com\/security-information-event-management\/lessons-marriott-breach-gates-marshall-compliancepoint\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/solutionsreview.com\/security-information-event-management\/"},{"@type":"ListItem","position":2,"name":"Lessons From The Marriott Breach with Gates Marshall of CompliancePoint"}]},{"@type":"WebSite","@id":"https:\/\/solutionsreview.com\/security-information-event-management\/#website","url":"https:\/\/solutionsreview.com\/security-information-event-management\/","name":"SIEM Tools & Security Event Management | Solutions Review","description":"Evaluating Enterprise SIEM Systems, Log Management Analytics & SOAR Platforms.","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/solutionsreview.com\/security-information-event-management\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/solutionsreview.com\/security-information-event-management\/#\/schema\/person\/357f925262827fcf840b4341920a1541","name":"Ben Canner","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/solutionsreview.com\/security-information-event-management\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/63f68345052a446ce0cc9c802dd3f373?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/63f68345052a446ce0cc9c802dd3f373?s=96&d=mm&r=g","caption":"Ben Canner"},"description":"Ben Canner is an enterprise technology writer and analyst covering Identity Management, SIEM, Endpoint Protection, and Cybersecurity writ large. He holds a Bachelor of Arts Degree in English from Clark University in Worcester, MA. He previously worked as a corporate blogger and ghost writer. You can reach him via Twitter and LinkedIn.","url":"https:\/\/solutionsreview.com\/security-information-event-management\/author\/bcanner\/"}]}},"_links":{"self":[{"href":"https:\/\/solutionsreview.com\/security-information-event-management\/wp-json\/wp\/v2\/posts\/2342"}],"collection":[{"href":"https:\/\/solutionsreview.com\/security-information-event-management\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/solutionsreview.com\/security-information-event-management\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/solutionsreview.com\/security-information-event-management\/wp-json\/wp\/v2\/users\/41"}],"replies":[{"embeddable":true,"href":"https:\/\/solutionsreview.com\/security-information-event-management\/wp-json\/wp\/v2\/comments?post=2342"}],"version-history":[{"count":0,"href":"https:\/\/solutionsreview.com\/security-information-event-management\/wp-json\/wp\/v2\/posts\/2342\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/solutionsreview.com\/security-information-event-management\/wp-json\/wp\/v2\/media\/1062"}],"wp:attachment":[{"href":"https:\/\/solutionsreview.com\/security-information-event-management\/wp-json\/wp\/v2\/media?parent=2342"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/solutionsreview.com\/security-information-event-management\/wp-json\/wp\/v2\/categories?post=2342"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/solutionsreview.com\/security-information-event-management\/wp-json\/wp\/v2\/tags?post=2342"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}