All organizations increasingly rely on Information Technology, and the Internet. While on the other side the threat of Cyber-attacks and data breaches are also real and on the rise. We are no longer a question this, but rather when one will be the target.
Data breach is an event that exposes confidential or sensitive information as a result of malicious activities toward corporate network or any computing devices, to steal confidential data. This delicate information might be your Social Security number, bank account or credit card numbers, personal health information, passwords or email. If anyone who is not expressly authorized to view such information, the company charged with guarding that information is said to have experienced a data breach.
In general, a data breach categorized as intentional or accidental. Intentionally, cybercriminals may hack the web or any online-system of a company where you’ve shared your personal information. Accidentally, an employee at one organization may inadvertently expose your private information on the Internet. Either way, criminals may access your vital personal details and profit from them at your expense.
If data breach events in identity theft and a violation of either government or industry compliance mandates; the offending party may face penalties, civil, or criminal prosecution. Some industries guidelines mandate strict governance of sensitive data to avoid data breaches. Payment Card Industry Data Security Standard (PCI DSS) governs who may manage and use delicate information, i.e., bank account and credit card numbers, and PINs in connection with names and locations. In a healthcare context, the Health Insurance Portability and Accountability Act (HIPAA) governs who may view and utilize PHI such as full name, birth date, Social Security Number, including any health history information. More than 50 percent of all breaches on 2017 have a target in business, followed by healthcare and medical institutions.
May 2017 – Zomato – affected over 17 million users records
Zomato has over 90 million visits per month. According to Alexa ranking, Zomato holds 945th position in the world and 155th most visited sites in India. On May 2017, Zomato has suffered a security breach with affected over 17 million user records containing the email address and hashed passwords. An online identity handle named “nclay” is declaring to have hacked Zomato and selling the stolen of credentials data of its 17 million registered users on a modern Dark Web marketplace for USD 1,001.43 (BTC 0.5587). This seller also shared a screen print of sample data to demonstrate that the data is legit.
In response, Notwithstanding promises that raised levels of anticipations were made to protect users’ data, Zomato, as a preventive action, has reset the passwords for all users. Zomato declared that credit card information is secure and stored in a different location with extremely secured vault for PCI Data Security Standard (DSS) compliant.
29 July 2017 – Equifax – affected 143 million users records
Equifax is leading nationwide credit-reporting firms that rate the financial history of an individual. This company gets its data from banks (saving and credit cards), retailers, and lenders — or even sometimes without the consent of this person. According to Equifax, as many as 143 million consumers in the US, including 209,000 U.S. customers credit card numbers were hit and stolen by the data breach happened between mid-May and July. Followed by U.K. and Canada were also impacted by this breach but the numbers are not available to the public. The firm said it found no proof that customers in other countries were affected other than the U.S., U.K., and Canada. The hackers obtained personal information such as consumer names and date of birth, their Social Security numbers, home or office addresses, credit card information, and the numbers of some driver’s licenses. The breach discovered on July 29 but just informed to the public on September 7.
In response, Equifax said it would send notices in the e-mail to consumers whose credit card numbers or dispute records breached.
August 2017 – Taringa – affected over 28 million users records
Taringa or “The Latin American Reddit” known as a popular social network which has users all over the Spanish-speaking world for sharing thousands of daily posts on general interest topics. That the data breach seems to happen in August 2017, but the company did not publicly disclose it. The company only announced the data breach to users who logged into the website. The breached that occurs affected 28,722,877 registered users for their usernames, email address, and hashed passwords. Later found that the hashing algorithm used is MD5 (128 bit) – which considered outdated even before 2012 – has eased the cracking process and leaving the users open to hackers. It is worse by, in this case, Taringa users chose easy to guess credentials such as 123456789, 123456, 1234567890, 000000, 12345, and 12345678. Most passwords were six alphanumeric long; this fact implies the Taringa platform did not require users to choose strong passwords.
In response, Taringa has utilized a password reset as well as advising consumers to evaluate their use of login credentials for other websites (to make sure they are not using the same) passwords.
Prevention and Mitigation Strategy
Data breaches are a real threat. It can be to your business, the organization that you work for, or even to your owned computer system or devices. We might feel like hackers are keep coming up with new ways to steal data from our production network. This feeling is incorrect. They mostly remain consistent in related with the attack method and targeting at least users account login and password; including the hashes. By understanding what hackers are doing and what they are targeting, we can leverage our security to prevent the possibility and at the same time mitigate the loss exposure to its lowest point.
Follow these four tips to promote data security in your organization:
1. Implement Data Encryption
Handling sensitive data such as credit card details or medical information required a sufficient data encryption mechanism. The data encryption process will scramble the text in a file to ensure the file unreadable by anyone other than the intended recipient. The encryption means to protect the file during transit or other data theft occurrence. It can work both for traffic and saved files.
2. Two-factor authentication
A good way to prevent unauthorized access to your online services is to enable and require your customers including your employees to use two-factor authentication before they can log-in. In addition to asking for a username and password, a two-authentication mechanism will ask for an input code sent via SMS or using Google Authenticator. The data thief cannot proceed without gain access to their target users’ mobile device.
3. Data Security Training
Providing sophisticated and robust security system will not stop a data breach if your employees don’t follow company policies and procedures. They may still use weak passwords, or at the worst one password for all type of access. Or they may copy sensitive data onto USB flash drive so they can work at home. Including leaving their laptops and mobile devices in the place where criminals can access them. Training sessions can leverage their awareness and thus reduce individual irresponsible acts. By giving proper education and awareness to employees on the importance of data security, the organizations may have a direct positive impact on a possibility for cyber risk to occurs.
4. Do a Segmentation
Eventually, skillful and resolute cybercriminals may break into the highly protected security systems on the organization. Business must have a plan in place to reduce the exposure of damage if a data breach occurs. Segmentation process may require installing a variety of security software which separated the network including logging mechanism to alert administrators immediately for any potential threat. By summarizing the alert administrators can immediately take prevention by doing re-route as many as possible for the malicious traffic. Segmentation can also work to divide the critical customer’s information to mitigate the exposure when a breach occurs.