ISRM

Team 8 Presented by:

Aanchal Pareek 22BM63001
Anshul Kaushik 22BM63019
Anurag Sharma 22BM63021
Guneet Singh 22BM63051
Ninad Bhagat 22BM63080
Pankaj Kaushik 22BM63081
Cyber attack
on Maersk

Information Security and Risk Management - Team 8

 Why attack was successful
Affected 150
locations
Infected Maersk's entire
global network spanning
across 150 locations. All
domain controllers that
controlled access to
Maersk's IT infrastructure
were compromised.
Interrupted Data Loss Lost Revenue
Operations
Maersk had to replace The attack cost Maersk
Caused a company-wide
45,000 PCs and 4,000 around $300 million in
outage of Maersk's IT
servers. Locally stored expenses and lost
systems including email,
data that was not backed revenue. Shipping
phones, applications etc.
up was permanently lost. volumes declined 20%
during disruption
Information Security and Risk Management - Team 8
 Evaluating Maersk’s Response
What went Right?

Quick Realization Backups War Rooms

- Quick realization of the attack and - Having offline backups helped recover - Emergency operations center with IT
coordinated global shutdown prevented critical components like Active Directory consultants/partners was set up for
further spread of malware across entire even though it took weeks. managing recovery and clearing
infrastructure. backlogs.

Communication Compensation
- Compensated customers for added
- Alternate communication channels costs during disruption; focused on
(personal phones/emails) enabled restoring customer services first.
collaboration.

Information Security and Risk Management - Team 8

 Evaluating Maersk’s Response
What went Wrong?

Reactive Recovery

- Failure to act on warnings about - Lack of recovery planning, spare

outdated systems and vulnerabilities capacity, security hardening increased
earlier led to successful breach. downtime after attack.

Continuity Plan Redundancy

- Absence of crisis management plans for - Domain controller redundancy was

large attacks led to delays and confusion ineffective due to similarities making all
post-attack. controllers vulnerable.

Information Security and Risk Management - Team 8

 Thank you

Information Security and Risk Management - Team 8