Possible Responses (Case Study - Sony Pictures)

1. What were the key challenges in conducting a thorough investigation into the Sony Pictures hack?

• • The Sony Pictures hack investigation faced complexities due to the involvement of sophisticated state-sponsored actors, raising challenges in attribution and cooperation with international law enforcement agencies.

2. How did Sony's logging and monitoring activities contribute to detection, or lack thereof, during the cyberattack, and what improvements could have been made to enhance real-time threat visibility?

• • Sony's logging and monitoring activities were insufficient to detect the cyberattack promptly. Improved real-time threat visibility, enhanced anomaly detection, and proactive response mechanisms could have mitigated the impact. Evaluate Sony's incident management practices during the hack.

3. What were the strengths and weaknesses in their response, and how could incident response plans have been refined to minimize the impact?

• • Sony's incident management demonstrated weaknesses in communication and coordination. A more robust and well-practiced incident response plan could have expedited the containment and recovery processes.

4. Analyze the impact of the Sony Pictures hack on the company's business continuity. How well-prepared was Sony to recover its operations, and what measures could have been taken to enhance business resilience in the face of such a significant cyber incident?

• • The Sony Pictures hack disrupted critical business operations, revealing gaps in business continuity planning. Strengthening backup strategies, offsite data storage, and comprehensive recovery plans could have minimized downtime and operational losses.