You're sitting at your desk, going about your work day.
When the phone rings on the other end, it's a reporter who informs you,
that he's found hundreds of millions of your customer files completely
unprotected and exposed on the internet, then it gets worse.
They're hosted right there on your company's own website.
That is what I'd call a bad day.
Welcome to another episode of Cautionary Tales from the Dark Side,
where we delve into some infamous case files and see just what lessons they have
to teach us.
In today's tale we'll learn that it doesn't always take some outside attacker to
create security problems.
Sometimes we're our own worst enemy.
This is code name Icarus.
The US Department of Justice defines a data breach as follows "the loss of
control, compromise, or unauthorized disclosure, unauthorized acquisition,
access for unauthorized purpose or other unauthorized access to data.
Whether it be physical or electronic." Basically,
someone who shouldn't have seen your data has seen it.
There are many ways this could happen,
but often we think of attackers looking to obtain our data as outside
threats. That's not always the case.
These breaches can also be attributed to internal data breaches.
In 2018, 34% of data breaches involved internal parties.
Sometimes these are intentional actions by a disgruntled employee,
much more common though.
Exposing sensitive data is the result of simple human
error.
First reported in 2019, [Organization Identification Redacted]
unintentionally exposed 885 million
mortgage deal related documents dating back to 2003.
These documents sat in an unprotected and publicly accessible location.
For two years.
These documents contained all the sensitive information you'd expect from
mortgage documents; wire transfer instructions, bank account numbers,
social security numbers, and driver's license.
This kind of information is a gold mine for Business Email Compromise
scams. These scams impersonate real businesses,
such as title and escrow firms in order to trick property owners into
sending money to the scammers.
This data leak did not include any compromise of company servers or
malicious attacker.
It was a location that was created for use by company personnel,
except that it required no authentication and was located on an internet facing
system, making it accessible to anyone in the world.
Now you might say how many outsiders could have possibly found some
undocumented obscure, random link on a website? Well,
in reality, this type of thing happens more than you think.
And cybercriminals use scripts to scan websites,
searching for such hidden locations. According to distill networks,
almost 74% of all internet bot traffic in 2018
was comprised of scanners, like these.
The cost of data breaches goes beyond financial damages.
The breach can lead to loss of customer trust,
damage to brand reputation and loss of intellectual property.
According to cybercrime magazine,
60% of small companies go out of business six months after
falling victim to a breach or cyber attack.
So how can we reduce our risk of exposing internal data publicly?
First have a comprehensive information security policy and plan.
Define necessary protections and controls that are appropriate across all
classifications of data, confidential or not.
Be sure to periodically audit to those policies,
to uncover any gaps next,
implement additional login protections where possible,
such as two-factor authentication or geolocation.
This at least creates a more challenging barrier between your data and
perspective voyeurs. Employ the principle of least privilege.
This means that your default approach is to grant just enough access to only
those who need it. This could have prevented the case that we examined today.
The most important counter measure is training and education.
Data exposure is often the result of human error or because somebody didn't know
what they were doing.
Make sure your people are well-trained on the protection and controls afforded
by the platform and tools they use.
Data exposures, like the one mentioned here are unfortunately very common.
Similar situations have happened at
[This content contains sensitive information and has been redacted] and
many many more. There is a silver lining though.
Unlike many of the incidents that we've in this series,
this type of security threat is preventable and completely within our
control.
If you liked this episode, subscribe, set the notification, give us a thumbs up.
Leave us a comment down below. We'd love to hear from you. I'm Scott Pletcher,
and this has been Cautionary Tales from the Dark Side.