In cybersecurity and infosec, it’s common to assume that hackers are behind all data breaches and major security events. But how do they gain access in the first place? Most of the time, well-meaning everyday people are the real source of data insecurity.
Accidental data loss continues to plague IT teams, especially as more organizations are rapidly moving to the cloud. While it’s important to prioritize action against outside threats, make sure to include a strategy to minimize the damage from accidental breaches as well.
This list of five common sources of accidental data leaks will help you identify the problems that could be lurking in your systems, apps, and platforms. Use these examples to prepare tighter security controls and keep internal problems from becoming major issues across your entire organization.
1# Exposing Secrets in Code Repositories like GitHub
In January 2020, a security researcher found Canadian telecom company Rogers Communications had exposed passwords, private keys, and source code in two public accounts on GitHub. As the investigation into the Rogers breach went on, the researcher found five more public folders on GitHub containing Rogers customer data, including personally identifiable information (PII) like phone numbers.
Businesses looking for a secrets detection solution for GitHub should consider Nightfall Radar for GitHub. It’s a fast and easy way to prevent data loss in the platform and avoid problems like exposing sensitive data in code repos, with automated scanning and customizable alerts, and reporting to help you take control of your company’s data.
#2: Leaking data from misconfigured buckets in AWS S3
Like GitHub, AWS S3 can be a source of accidental data insecurity. All it takes is one improperly configured bucket in the cloud server to expose huge amounts of data. AWS S3 is different from GitHub in one big way here: GitHub repos allow users to set sharing permissions right away, with “public” set as the default choice. In today’s usage, AWS buckets are private by default. This means user error is behind most major AWS data leaks when data is exposed in these public buckets.
Outpost 24 cloud security director Sergio Lourerio, spoke to Computer Weekly in a January 2020 interview on the rising danger of data leakage through public AWS S3 buckets. He pointed to the nature of us all working in the early days of cloud infrastructure security allowing for the prevalence of opportunistic attacks on publicly accessible AWS S3 data buckets. “You’d be amazed to see the data you can find there just by scanning low-hanging data in cloud infrastructures,” Lourerio said. “And it only takes a couple of API calls to do it. With a lot of data being migrated to the cloud for use cases like data mining and lack of knowledge of security best practices on [Microsoft] Azure and AWS, it is very simple to get something wrong.”
User error among developers and infosec professionals can lead to some of the most egregious security events. The cloud isn’t the only source to blame, however. Sometimes negligence can be an IT team’s worst enemy.
#3: Compromising millions of records through expired security certificates
The 2017 Equifax breach is one of the worst data leaks in history, with over 143 million records exposed containing PII like names, addresses, dates of birth, Social Security numbers, and driver’s license numbers. These records were stolen by hackers who exposed a vulnerability in Apache Struts, a common open-source web server. The unpatched server allowed the attackers to gain access to Equifax’s systems for over two months.
A strong security posture starts by securing your systems wherever you find a vulnerable point. The next step is to critically examine the entities you do business with — third-and fourth-party exposure can be just as devastating in a data breach.
#4: Leaving the door open with Unsecured third- and fourth-party vendors
An organization that is doing everything right by controlling data exfiltration in the cloud with DLP, securing AWS S3 buckets, and maintaining current certificates on their website can still be at risk of data exposure through unsecured third- and fourth-party vendors. Damage control is hard enough when it’s just one source to deal with. But when you have to investigate and remediate a data breach that results from vendors and other business partners, there’s a lot more work to do.
Companies can accidentally leak as much as 92% of their data via URLs, cookies, or improperly configured storage. This exposure on its own is a major security problem. When you add third- and fourth-party vendors and services on these websites, that means the leaked information could be exposed to any of those services embedded into a compromised page.
Third-and fourth-party vendors provide essential services for the parent company, like expedited checkout portals with payment processors. Third-party vendors often rely on fourth-party services just as the parent company relies on outside help to maximize operations — on average, 40% of services on a website are powered by fourth parties.
With all these avenues covered — code repos, website containers, and other vendors — you may think your security job is done. You must take on email security for your employees, as this is a much easier fix to a problem that can do severe damage.
#5: Giving up on security standards with lax email policies
Email scams are the oldest trick in the cybercrime book. As some of us are still falling for phishing scams from Nigerian princes, many more well-meaning people fail at email security every day, just from inadequate email security practices.
Poor password hygiene for email accounts (using “password” for your login credentials), not using multi-factor authentication when signing into accounts, or a lack of employee training and clear policies are contributing factors to the rapid rise in business email compromise (BEC).
According to the FBI, losses from BEC attacks total over $26 billion. More scammers are using COVID-19 to make their way into inboxes and systems. Even with tougher regulations in place like the California Consumer Privacy Act (CCPA), which carries heavy penalties for noncompliance, BEC is still a major threat to any organization. Email users should take extra security steps to ensure their accounts are safe.
It’s hard to fight back against thieves, cyber criminals, and scammers — especially when your own people can do most of the damage right there inside the organization. Work with your teams to determine where security vulnerabilities exist within your networks, platforms, and systems, and train everyone on best practices for securing their own logins and access points. It could also help to back up all your hard work with a DLP solution like Nightfall that caches data you may have missed even before it can leave your network.
~ Guest Blog
“This article was published at nightfall.ai”
Sanghamitra Roychoudhary
Latest posts by Sanghamitra Roychoudhary (see all)
- 7 Best Practices for an Effective DevSecOps Implementation - April 26, 2024
- Top Impacts of IoT on Businesses - July 21, 2023
- Impact of Cryptocurrency on the Indian Economy - June 20, 2023
I like what you guys are up also. Such clever work and reporting! Keep up the superb works guys I抳e incorporated you guys to my blogroll. I think it will improve the value of my web site 🙂
Thank you so much for visiting my website & reading my blog!
Please share my webpage in your circle.