Poor Cyber Security Led to Houston Astros Hack

Baseball may be America’s favorite pastime, but from the Black Sox scandal to Pete Rose to the “Steroid Era,” cheating schemes have long tarnished the game. Sadly, it was only a matter of time before cheating went high-tech. Last summer, former St. Louis Cardinals executive Chris Correa was sentenced to 46 months in prison for violating federal hacking laws after breaching the Houston Astros’ database and stealing proprietary information such as scouting reports and trade negotiation notes. How and Why the Houston Astros Hack Happened Most data breaches are not the result of hackers finding “backdoors” into systems; they are due to hackers getting hold of stolen login credentials, obtained either through a phishing scheme or by taking advantage of employee carelessness, such as employees using weak passwords or writing login credentials on sticky notes and leaving them in plain sight. The Houston Astros hack was the fault of simple carelessness on the part of a new employee (identified only as “Victim A” in court documents) whose previous employer was the Cardinals organization. When Victim A left the Cardinals to take a job with the Astros, he was told to return his work laptop, including its password information, to Correa. Correa got the idea to try to use this same password, and a few variations of it, to see if he could use it to access the Astros’ database, which was nicknamed “Ground Control.” Correa was right; Victim A had chosen a nearly identical password for use in his new job, and Correa was able to use it to walk right in the front door of Ground Control. Eventually, the Astros updated the Ground Control system and changed the login credentials, but that was only a bump in the road for Correa. The password still worked for Victim A’s email account – and the Astros had emailed new default login information to all employees. How Could the Astros Have Prevented the Breach? The Houston Astros hack resulted from poor cyber security practices on very basic levels: • Weak passwords chosen by the employee and used on multiple systems. No matter how many times people are told to use strong passwords, change them frequently, and not use the same passwords for multiple systems, most people simply don’t take this warning seriously. For this reason, organizations should not allow employees to choose their own passwords. They should be assigned strong passwords for each system, and the system should require that they be changed periodically. • Not requiring multi-factor authentication to access sensitive data. A user name and strong password may be fine for an email account, but systems that contain sensitive information should require multi-factor authentication for access. • Sending default login information through email. The Astros should not have sent employees new Ground Control login credentials through email; instead, the login credentials should have been given to employees in hard copy, and the system should have been set up to require that the credentials be changed as soon as the employee logged in for the first time. • Not monitoring networks for anomalous activity. Correa was lurking around in Ground Control for well over a year before he was discovered, and that only happened because confidential trade information was leaked online. Had the Astros been monitoring their system, they may have noticed user activity that deviated from baseline norms, such as the user logging in from an unusual location. Correa’s plea deal estimated that the Astros lost $1.7 million to this breach. The Astros need to take a hard look at their information security practices, and other organizations should learn from the Astros’ very expensive mistake. Proactive security measures that prevent cyber attacks are always cheaper than reactive cleanup after a breach has occurred.