Sussex Police Breach Incident Score: Analysis & Impact (SUS1769125781)

In this Rankiteo incident briefing, we review the Sussex Police breach identified under incident ID SUS1769125781.

The analysis begins with a detailed overview of Sussex Police's information like the linkedin page: https://www.linkedin.com/company/sussex-police, the number of followers: 13223, the industry type: Law Enforcement and the number of employees: 2004 employees

After the initial compromise, the video explains how Rankiteo's incident engine converts technical details into a normalized incident score. The incident score before the incident was 766 and after the incident was 693 with a difference of -73 which is could be a good indicator of the severity and impact of the incident.

In the next step of the video, we will analyze in more details the incident and the impact it had on Sussex Police and their customers.

UK Law Enforcement recently reported "Former Police Officers Admit to Unauthorized Data Access and Sharing", a noteworthy cybersecurity incident.

Two former police officers, Sean Picton and Anthony Bolaños, pleaded guilty to charges of unlawfully obtaining and sharing personal data without consent between October 2022 and January 2023.

The disruption is felt across the environment, and exposing Personal and sensitive information.

Formal response steps have not been shared publicly yet.

The case underscores how Concluded, teams are taking away lessons such as Importance of access controls and monitoring in law enforcement to prevent unauthorized data access and sharing, and recommending next steps like Implement stricter access controls, regular audits, and enhanced monitoring of sensitive data access within law enforcement agencies.

Finally, we try to match the incident with the MITRE ATT&CK framework to see if there is any correlation between the incident and the MITRE ATT&CK framework.

The MITRE ATT&CK framework is a knowledge base of techniques and sub-techniques that are used to describe the tactics and procedures of cyber adversaries. It is a powerful tool for understanding the threat landscape and for developing effective defense strategies.

Rankiteo's analysis has identified several MITRE ATT&CK tactics and techniques associated with this incident, each with varying levels of confidence based on available evidence. Under the Initial Access tactic, the analysis identified Valid Accounts (T1078) with high confidence (90%), supported by evidence indicating picton accessed sensitive information without authorization. Under the Credential Access tactic, the analysis identified Credentials In Files (T1552.005) with moderate to high confidence (70%), supported by evidence indicating unauthorized access to sensitive information by insider. Under the Collection tactic, the analysis identified Data from Local System (T1005) with high confidence (90%), supported by evidence indicating picton accessed sensitive information without authorization and Data from Information Repositories (T1213) with moderate to high confidence (80%), supported by evidence indicating personal and sensitive information compromised. Under the Exfiltration tactic, the analysis identified Exfiltration Over C2 Channel (T1041) with moderate to high confidence (70%), supported by evidence indicating shared it with Bolaños, who then disclosed it to a third party and Transfer Data to Cloud Account (T1537) with moderate confidence (50%), supported by evidence indicating data exfiltration confirmed, method unspecified. Under the Impact tactic, the analysis identified Data Destruction (T1485) with lower confidence (30%), supported by evidence indicating no evidence of data destruction, but risk of misuse and Stored Data Manipulation (T1565.001) with lower confidence (40%), supported by evidence indicating unauthorized sharing of sensitive information. Under the Defense Evasion tactic, the analysis identified Valid Accounts (T1078) with moderate to high confidence (80%), supported by evidence indicating used legitimate access to evade detection initially and Hidden Users (T1564.002) with moderate confidence (50%), supported by evidence indicating insider threat with authorized access. These correlations help security teams understand the attack chain and develop appropriate defensive measures based on the observed tactics and techniques.