Your data is everywhere and it's being bought and sold every
day by others who are not you, your email, phone number,
address, banking card, information, age, shopping preferences,
even the path you take for an afternoon walk.
It's all out there.
Odds are that your personal data has been stolen at least once.
And you can be sure that it's not going to be used for good.
Welcome to another episode of Cautionary Tales from the Dark Side,
where we delve into some infamous case files and see just what lessons
they have to teach us. In today's tale,
we'll be exploring one of the largest data breaches in history
and how poor data security practices turned a bad situation
into a catastrophic one. This is code name, Cipher.
One of the very first examples of encryption was a device called the Scytale.
And it was used by the ancient Greeks to communicate during military campaigns,
it worked by wrapping a strip of paper around a rod of a specific diameter.
Then writing a message.
The recipient needed to have the same diameter rod in order to make sense of the
message while modern encryption uses complex mathematics,
rather than a wooden rod,
the principle is still the same and encryptions goal is to obscure the
underlying data for anyone who doesn't have the right decryption keys.
However, as we'll see encryption by itself, isn't enough
In 2018 global hospitality company discovered a
massive data breach. How massive?
383 million people massive.
This wasn't something found quickly either after checking out a seemingly
innocuous alert,
investigators dug their way down and eventually found a breach that had been
exploited for over four years,
tracing back to the systems of a company they had acquired two years
earlier. The perpetrators likely made off with the usual names,
addresses and phone numbers,
but also more sensitive data like date of birth, travel itineraries,
passport numbers, and credit card numbers. Now on the upside,
some of the data was encrypted, but on the downside,
the keys needed to decrypt were stored in the same location
as the encrypted data.
That's the same as writing your password on a sticky note,
attached to your monitor or leaving your house key,
hanging on a nail by the front door.
This oversight effectively nullified any benefit of encryption.
Regulators issued the company a fine of over $100 million
and a large class action lawsuit was also filed against the company.
All this top of the reputational damage already done.
While four years may sound like a long time for a data breach to be active.
It may be more common than you think. In 2018,
IBM reported that a breach can take on average 197 days
to even be detected by the besieged organization.
It then takes on average and other 67 days to contain the breach.
Many data breaches are never found until the data pops up for sale on the dark
web. If we were breached today,
what could an attacker do in the six months before we noticed it?
So how can we protect ourselves? For starters,
we should encrypt all the things by encrypting our data.
It will stay safe,
even if it falls into the wrong hands provided we don't leave the encryption
keys lying around.
Encryption at rest refers to making sure our data is encrypted when it's just
sitting around on the cloud, on premise, on someone's laptop.
Examples of this are file encryption like PGP or a full disk
encryption like BitLocker.
Encryption in transit means that we use secure channels when transferring data
here and there HTTPS on our browser is a
method of encryption in transit.
And so is using a VPN using both of these encryption types
together should be part of our normal operating procedures.
Next when architecting our it systems ensure that security is a
foundational component designed in from the beginning,
rather than an afterthought ad-on.
Older legacy systems sometimes present a challenge and that that may not play
well with modern encryption algorithms. In this case,
consider a tokenization strategy where you can offload the storage
of sensitive data to more capable systems. As we've seen,
it's not just about encrypting the data. Rather our processes,
practices and guidelines have to create a sustained environment for data
protection and continuous vigilance.
Finally consider the cloud to help improve your security and encryption gain
while it may be counterintuitive,
many companies find their security posture actually improves after a
migration to the cloud.
Usually encryption at rest and in transit is mouse click
easy on most cloud providers.
As long as data has value,
there will be people trying to steal it for personal gain for espionage,
for blackmail. While encryption isn't the perfect way to protect data.
It does make things more challenging for the would be a salient and
hopefully they will go hunting for an easier target.
You do not want to be that easier target. If you enjoyed this episode,
do give us a thumbs up and reach out in the comments below.
We'd love to hear from you. I'm Scott Pletcher,
and this has been Cautionary Tales from the Dark Side.