Your IT Support Experts

We partner with many types of businesses in the area, and strive to eliminate IT issues before they cause expensive downtime, so you can continue to drive your business forward. Our dedicated staff loves seeing our clients succeed. Your success is our success, and as you grow, we grow.

Free Consultation

Interested in seeing what we can do for your business? Contact us to see how we can help you! Sign Up Today

  

USA Computer Services Blog

USA Computer Services has been serving small and medium sized businesses since 2012, providing IT Support such as technical helpdesk support, computer support and consulting.

The Disney Menu Debacle Can Teach Your Business a Lesson About Access Control

The Disney Menu Debacle Can Teach Your Business a Lesson About Access Control

The Disney brand centralizes its efforts on magic and wonder, but its parks’ food is one aspect that has recently been subject to concerning developments. A former Disney employee managed to access a menu-planning app and make changes to prices, add foul language, and change menu information. Since we live in a world with food allergies, you can already see where this is going.

The Federal Bureau of Investigation has issued this statement on the matter:

“The threat actor manipulated the allergen information on menus by adding information to some allergen notifications that indicated certain menu items were safe for individuals with peanut allergies, when in fact they could be deadly to those with peanut allergies.”

Thankfully, Disney nipped the issue in the bud before the menus were distributed, and there is no evidence that customers ever saw them. Additionally, there is no indication that these events are related to a prior event in 2023 when a death occurred at a Disney-owned restaurant due to allergens.

These Changes Could Have Been Prevented

This problem stems from a simple issue with network security: someone had permission when they shouldn’t have.

The FBI has reported that the accused individual, a former Disney employee and menu production manager named Michael Schuer, used his Disney credentials to access the menu-planning app to make changes. He was also able to use his old logins to access the app developer’s server. It’s a real case of a former employee doing despicable things with old login credentials.

What gave the “hack” away was the use of the Wingdings font. This is when Disney employees caught the issue and pulled the app. Before this, though, many employee accounts had been locked because the accused used scripts to automate logins. More than a dozen accounts exceeded their allowed login attempts, which made logging in difficult.

The complete criminal complaint offers more details about this event and the inciting attacks.

Pay Attention to User Permissions and Access Logs for Suspicious Activity

It might be a bit blunt of us to say, but this entire situation could (and should) have been prevented.

When an employee leaves your business or organization, you take away their login credentials right as they walk out the door. This is a standard and accepted best practice. It’s a part of ensuring proper access control for your business.

It’s easy to overlook a user’s profile when they leave your business, but you never know what baggage they’re leaving with—baggage that might cause them to lash out in unanticipated ways. We recommend that you practice the Principle of Least Privilege, where you only grant access as needed. There’s no reason that anyone who leaves your business should retain access to data, anyway, and the fewer entry points to your system for hackers (and other potential threats), the better.

To shore up your defenses and control access to your business, give USA Computer Services a call at (704) 665-1619.

Does Artificial Intelligence Provide Artificial Ho...
Mobile Device Management Can Improve Your Business...
 

Comments

No comments made yet. Be the first to submit a comment
Guest
Already Registered? Login Here
Guest
Friday, December 06, 2024

Captcha Image

Customer Login

Contact Us

Learn more about what USA Computer Services can do for your business.

Headquarters:
525 North Tryon St. #1600
Charlotte, NC 28202

Additional Location:
859 Willard St #400
Quincy, MA 02169
Additional Location:
60 State Street #700
Boston, MA 02129