These breaches are exposing private data at an alarming rate:
70% of the reported breaches exposed email addresses, and 64% exposed passwords. Once acquired, these credentials can open numerous doors for mischief by hackers...just think of all the re-used usernames and password combinations 'guarding' valuable data!
Additionally, 89% of the breaches were by malicious hackers outside the organisation, but a growing number of 'inside' attacks came from misconfigured databases or outdated software. As always, human error and a lack of careful planning can lead to doors being left wide open for data to be accessed or stolen.
We've done some digging into the biggest data breaches this year, highlighting the mistakes made and steps your firm can take to prevent a similar attack! Although the fear of a breach can be paralysing, we believe that with accurate information and the help of a strategic managed IT security partner you can protect your business from the biggest cyber threats of today.
Biometric security firm Suprema offers an online security tool called Biostar 2, which is used by many companies and organisations including the UK Metropolitan Police to store biometric data for security access, including fingerprints, names, photographs and records of when users had accessed secure areas. Reports revealed that an outside firm discovered they were able to access this data in August 2019. They claim that nearly 23 GB of data containing nearly 30 million records were exposed on a publicly-accessible unencrypted database. Suprema are cooperating with authorities to investigate the breach of data.
A new strain of malware is targeting the manufacturing sector, paralysing entire businesses whose machinery is controlled by computers. Manufacturers in France, Norway and the USA have been crippled by the malware, which likely relies on stolen credentials in order to gain access to the highest levels of security and shut down the entire system. The hackers seem motivated by profit in this particularly bad strain of ransomware. They are often rewarded because the businesses have no other way to regain control of their systems and resume operations.
According to reporting by Wired, hackers compromised the software update tool used by computer company Asus, sending out 'tainted' software to nearly 1 million computers, which accepted the code because it was signed with an authentic Asus certificate, "used to verify the legitimacy and trustworthiness of new code." Attackers then seemed to target a narrower segment of the 1 million affected machines with a second wave of attacks.
This is what's referred to as a 'supply chain' breach, which exploits a single organisation with the intent of spreading to many more.
The USA's Federal Emergency Management Agency acknowledged in March 2019 that they had inadvertently leaked data from 2.3 million individuals to a third party contractor. While the contractor has reassured FEMA and governing bodies that the data was not accessed or used unlawfully, this is still a significant data breach with potentially harmful consequences.
As one report stated, "unnecessary and unauthorised data sharing is dangerously common in both the corporate and government arenas."
One of this summer's biggest stories, the USA-based credit card company Capital One revealed that more than 100 million of their customers' personal details were accessed by a rogue employee with access, credentials and knowledge to exploit the internal security systems.
The Suprema data breach (#1 above) is an example of how external vulnerability scanners or penetration testers can expose weaknesses in your network that you didn't even know were there.
While you can never predict what a rogue employee may do in the future, the Capital One data breach (#5 above) is a prime example of how limiting user access can prevent exploitation and fraud within your business. Consider requiring multiple users to authenticate certain processes where critical data or business functions are concerned.
Although the story of the Asus breach (#3 above) would seem to contradict this advice, it was actually a security flaw in their systems which allowed the hackers to enter their network and push the malicious security update out to users.
In most cases, frequent security updates will be one of the simplest and important ways to protect your network from hackers.
A managed IT security provider can take the burden of remembering security updates off your shoulders. For example, SysGroup technicians have expertise in the best cyber security tools available, like firewalls, endpoint security, secure Wi-Fi, two factor authentication and more.
With so many threats against your personal and business data, it is crucial to change passwords frequently and be vigilant about what information you share online. As a business, enforce 2FA or MFA to ensure that your team members' credentials are used appropriately and changed frequently.