On November 24, 2014, an incident almost pulled right out of a 90’s hacker movie
transformed into a massive computer hack.
A group calling itself The Guardians of Peace
(GOP) managed to breach Sony Pictures Entertainment and bring their systems down to a
screeching halt. Resulting from this breach the GOP claims to have stolen over 100
terabytes of data containing Social Security numbers, salaries, movies, and other
personally identifiable information. Within days, the stolen data was posted on the
Internet along with demands from the GOP group that included not releasing The
Interview. This paper will point out some of the Critical Controls that could have been
utilized to minimize the impact the GOP had on the Sony breach. Utilizing even a few of
the Critical Controls such as malware defenses, monitoring, audit logs, encryption,
controlled use of administrative credentials, and incident response could have provided
the necessary implementations required to prevent a 90’s hacker movie from turning into
reality.