Vegas Casinos Slowly Recover After Hit By Crippling Cyberattacks
The MGM and Caesars breaches have many CISOs worried that their own company’s security efforts may need shoring up.
One would hope that what happens in Vegas stays in Vegas.
For cybercriminals, however, successful attacks are gambles that continuously pay off. Some of the biggest hotels on the strip are only now recovering from severe cyberattacks launched earlier this month.
On 9/10, MGM’s computer systems reportedly went down suddenly and out of the blue, freezing ATMs, slots machines, elevators, escalators, and various other IT-controlled services.
In a statement released on 9/14 the company said:
“MGM Resorts recently identified a cybersecurity issue affecting some of the Company’s systems. Promptly after detecting the issue, we quickly began an investigation with assistance from leading external cybersecurity experts. We also notified law enforcement and took prompt action to protect our systems and data, including shutting down certain systems.”
The MGM attack mirrored a cyberattack on Caesars Entertainment in August. The Caesars incident was a ransomware attack where the hackers reportedly acquired a treasure trove of driver’s license numbers and Social Security numbers that they threatened to release online. According to the AP, Caesars is widely reported to have paid $15 million of a $30 million ransom sought by a group called Scattered Spider.
Keeping a casino running at an optimized profit requires a huge data analytics operation. Customer identities and personal customer data are among the most valuable assets a gaming company has. Protecting this data-set is a key concern. Attracting high rollers is an issue that has been more exhaustively studied than eliminating world poverty. All that juicy data sits on a cloud, making such cloud a tempting target of opportunity.
There are many reasons to take note of what is happening to our great casino fat cats. If a cyberattack can penetrate even the vaunted defenses of MGM and Caesars, how do you stop your ethically-challenged competitors and other bad actors from stealing confidential corporate data that you thought was safely nestled in the cloud?
Permiso Security, based in Palo Alto, bills itself as “a cloud detection and response startup that finds evil in cloud environments.” Just a couple months ago, Permiso’s Principal Security Researcher, Daniel Bohannon, announced via LinkedIn the results of its 2023 Cloud Detection and Response Survey. A poll of 500 security, IT and engineering professionals indicated both widespread over-reliance on risky and outdated cloud security practices, and cocksure overconfidence that their organizations’ cloud security practices are fully adequate to the growing challenges of today’s cybersecurity environment.
Permiso Co-Founder and Co-CEO Paul Nguyen summarized one troubling aspect of the survey’s findings: “We found that most respondents (70%) would characterize their response time to an attack to be between 12 and 24 hours. Data from actual production environments and incident responses show that the number is more than two weeks (16 days). There is a significant disconnect within the survey data we collected and even more significant disparity when you compare that with actual data from cloud environments.”
Cyber Defense Advisors can help you plug the gaps in your cloud security that your in-house team does not see or acknowledge. Our experienced cloud protection experts can save you money by pinpointing which of your legacy systems are redundant, outdated, ineffective or otherwise useless. At the same time, we can help ensure that your company is better prepared for the cyberthreats of the future, plugging gaps in your modern cloud security and in-house systems.
Contact Cyber Defense Advisors today to learn more.
