Tag: data breach

What is the Most Vulnerable Data My Company Holds?

Posted on by eugene evdokimov

Data security is on every priority list in 2022. With the frequency of breaches never higher, many businesses assess their situation and ask cybersecurity questions.

With cybersecurity policy, everything boils down to risk. Ultimately, every decision-maker wants to know, “how likely are we to be attacked?”

Many believe cybercriminals only target certain kinds of data. Sensitive information, high-value financial data, and medical records are all widely accepted to carry a high risk.

The misconception? That storing none of the above means little-to-no risk. Almost every document stored on your company servers is a potential target for cybercriminals in today’s threat landscape. 

We will break down the data types that carry the highest risk, so you’ll finally know how much potential threat is stored in your servers.

The scale of data theft

Data and information theft have always accounted for a large portion of cybercrime. Some estimates have the frequency at 44 records stolen per second. That’s 3,809,448 per day globally. Less conservative figures put the number as high as 22.5 million.

Whether the actual figure is closer to three or twenty-two million is irrelevant. Both ends of the scale are high. What matters is that every day your data and records are at risk of being stolen.

Why do cybercriminals want my company data and records?

The reason data theft remains a favorite pastime of cybercriminals is primarily financial. While this is obvious for certain kinds of data (such as customer payment information), the financial incentive for theft isn’t as straightforward as others.

Hackers and cybercriminals can turn almost any stolen data into a profit. Even seemingly meaningless information is valuable to somebody, somewhere, making it worth stealing. Sometimes stolen data is sold on the dark web, and for others, it is used for ransom attacks. The list of ways cybercriminals can capitalize on stolen data is almost as long as one of the ways they can steal it.

Remember, not all hackers are after huge sums. Many small businesses are severely disrupted by cybercriminals seeking to walk away with as little as a few hundred dollars (and some by thrill-hackers who aren’t financially motivated).

As a rule of thumb, never assume your data and records are safe because they don’t seem financially valuable. No matter how much you believe your data to be “worth” to a hacker, it is still at risk, and the costs of a breach to your business are always high.

The types of data most vulnerable to attempted theft

Now that we’ve covered the scale of data theft let’s break down the highest-risk types of data and records that businesses like yours may have on their servers.

Payment data.

71% of all data breaches are financially motivated. It’s unsurprising then that payment data is the type of record most targeted by hackers.

This is why many small businesses’ belief about their size makes them unappealing to cybercriminals is so dangerous.

Stolen customer credit cards, visa debits, PayPal, or other payment credentials are a source of easy income for hackers. There are many high-profile incidents where gigabytes of customer payment information were stolen from companies and sold on the black market.

One of the most notorious examples is the Adobe breach of 2013. Hackers stole nearly 3 million credit card numbers from a compromised database of 38 million Adobe users. The costs to Adobe were known to reach at least $1.1million, but the exact total when the (undisclosed) settlements with former users are factored in is still unknown.

It’s clear why 3 million credit card numbers are an enticing prospect for a cybercriminal. While there are few companies with as many users as Adobe, the high-profile breach they experienced was far from an isolated incident.

Why the Adobe breach wasn’t an isolated incident

Selling stolen data on the black market is risky and isn’t the goal for most hackers. Most stolen payment information is used to skim small amounts, directly purchase goods, or open new credit lines to be drained into separate accounts controlled by cybercriminals.

This makes small businesses incredibly vulnerable. If your aim isn’t to sell millions of payment details, there’s little incentive to hack a corporation like Adobe with a dedicated cybersecurity team.

Most cybercriminals are likely to target less-protected payment records held by SMEs. Not only are these easier to obtain, but they’re also far less likely to attract attention (meaning the operation can continue another day).

It’s highly unlikely you will have no customer payment info on your servers in 2022. Whether dealing with three or three million users, you must keep their payment data secure.

Authentication Details

Authentication details are perhaps the most dangerous records to lose in a breach. All it takes is one compromised login for cybercriminals to browse your systems at their leisure. Once they have access, it’s only a matter of time before further data (like customer financial records) is seized.

Credential-based attacks aren’t rare. 81% of breaches in 2020 utilized stolen and/or weak passwords. Authentication details and credentials are obtained in many ways. Keylogging software is one, but targeting employees to deceive them into handing over login information is a common method.

Compromised login details are a huge security risk. Once a cybercriminal is in your systems under the guise of a valid user, they can operate more or less undetected. This leaves them free to steal further data, deploy malware, or take your systems offline entirely.

How many stolen passwords are out there?

In 2020, an audit of several known dark web black markets revealed there were at least 15 billion individual login credentials available for sale. These weren’t only for popular platforms like Facebook and online banks but also private company servers.

The same report found that these domain administrator accounts were auctioned for an average of $3,139, with some going for as much as $120,000. Your business’s authentication data is a target for theft in this context, isn’t it?

If you’re an SME, you’re seen as an easy target. Staff are less likely to be trained in online safety, for one thing. According to IBM, human error is a ‘major contributing cause’ in 95% of data breaches. Password hygiene, multi-factor authentication, and secure login credentials are essential, especially for small businesses.

It’s almost certain that those 15 billion black market credentials included hundreds, maybe even thousands, of businesses like yours.

Medical records, customer documents, and other sensitive information

It’s no secret that sensitive and confidential records like medical documents are a target for cybercriminals. There have been many high-profile healthcare data breaches. In 2015 the second largest healthcare insurer in the US, Anthem Inc, had records of 80 million customers stolen. This irreparably damaged their reputation, which led to Anthem paying a $39 million settlement.

The stolen data contained no medical treatment records. The hackers seized names, dates of birth, addresses, employment information, and Social Security numbers. Why is that important? Because they’re records that almost every company will hold.

The customer information on your database doesn’t have to be medical treatments, criminal records, or personal conversations (like any app with a message function, for example). If your customers, users, or clients leave any personal details in your care, cybercriminals want them.

Which sector is most at risk of customer data theft?

While no treatment records were stolen in the Anthem breach, the fact remains that healthcare is one of the most at-risk sectors. Some estimates claim that as many as 1 in 8 US citizens have had medical records compromised in a breach.

It’s a misconception that the healthcare sector is at risk exclusively because of the sensitivity of medical records. This is only partially correct. It’s also because healthcare is one of the world’s largest (and accessible) industries.

This is why retail and accommodation/tourism are just as vulnerable to data theft as finance, healthcare, and the public sector. E-commerce records aren’t compromising or sensitive, but they exist in abundance. It’s not only sensitive records at risk; any record from any industry is a target.

So, is ANY of my data safe?

The short answer? No. If the message we’re trying to send isn’t clear, all the data your company holds is vulnerable. There are no records or information stored in your data centers that aren’t a potential hackers’ target.

As all cybersecurity professionals will tell you, the question isn’t if you’ll be a target of data theft; it’s when.

Modern solutions for modern threats

Fortunately, it is possible to keep your data secure in 2022. The problem many face is applying 20th-century thinking to the 21st-century threat landscape.

Your data security solution shouldn’t start with the question, “what specifically is at risk.” In so many of the examples above, successful data thieves exploited “low risk” vulnerabilities.

21st-century cybersecurity should be built on a system of assumed risk and total system visibility. Every KB of network traffic could contain the next threat, and every PDF scan, line of code, or customer database is a possible target.

Observability: A Cybersecurity Essential

Keeping all of your data records secure means ensuring the entire system they’re in is observable. That’s why platforms like ours are essential. Almost every data breach we’ve used as an example could have been avoided if the cybercriminals couldn’t operate undetected.

A fully visible system means no hidden blind spots for hackers to exploit. The answer to this piece’s titular question is “all of it.” It’s paramount your security solution reflects this.

5 Cybersecurity Tools to Safeguard Your Business

Posted on by eugene evdokimov

With the exponential rise in cybercrimes in the last decade, cybersecurity for businesses is no longer an option — it’s a necessity. Fuelled by the forced shift to remote working due to the pandemic, US businesses saw an alarming 50% rise in reported cyber attacks per week from 2020 to 2021. Many companies still use outdated technologies, unclear policies, and understaffed cybersecurity teams to target digital attacks.

So, if you’re a business looking to upgrade its cybersecurity measures, here are five powerful tools that can protect your business from breaches.

1. Access Protection

Designed to monitor outgoing and incoming network traffic, firewalls are the first layer of defense from unauthorized access in private networks. They are easy to implement, adopt, and configure based on security parameters set by the organization.

Among the different types of firewalls, one of the popular choices among businesses is a next-generation firewall. A next-generation firewall can help protect your network from threats through integrated intrusion prevention, cloud security, and application control. A proxy firewall can work well for companies looking for a budget option.

Even though firewalls block a significant portion of malicious traffic, expecting a firewall to suffice as a security solution would be a mistake. Advanced attackers can build attacks that can bypass even the most complex firewalls, and your organization’s defenses should catch up to these sophisticated attacks. Thus, instead of relying on the functionality of a single firewall, your business needs to adopt a multi-layer defense system. And one of the first vulnerabilities you should address is having unsecured endpoints.

2. Endpoint Protection

Endpoint Protection essentially refers to securing devices that connect to a company’s private network beyond the corporate firewall. Typically, these range from laptops, mobile phones, and USB drives to printers and servers. Without a proper endpoint protection program, the organization stands to lose control over sensitive data if it’s copied to an external device from an unsecured endpoint.

Softwares like antivirus and anti-malware are the essential elements of an endpoint protection program, but the current cybersecurity threats demand much more. Thus, next-generation antiviruses with integrated AI/ML threat detection, threat hunting, and VPNs are essential to your business.

If your organization has shifted to being primarily remote, implementing a protocol like Zero Trust Network Access (ZTNA) can strengthen your cybersecurity measures. Secure firewalls and VPNs, though necessary, can create an attack surface for hackers to exploit since the user is immediately granted complete application access. In contrast, ZTNA isolates application access from network access, giving partial access incrementally and on a need-to-know basis. 

Combining ZTNA with a strong antivirus creates multi-layer access protection that drastically reduces your cyber risk exposure. However, as we discussed earlier, bad network actors who can bypass this security will always be present. Thus, it’s essential to have a robust monitoring system across your applications, which brings us to the next point…

3. Log Management & Observability

Log management is a fundamental security control for your applications. Drawing information from event logs can be instrumental to identifying network risks early, mitigating bad actors, and quickly mitigating vulnerabilities during breaches or event reconstruction.

However, many organizations still struggle with deriving valuable insights from log data due to complex, distributed systems, inconsistency in log data, and format differences. In such cases, a log management system like Coralogix can help. It creates a centralized, secure dashboard to make sense of raw log data, clustering millions of similar logs to help you investigate faster. Our AI-driven analysis software can help establish security baselines and alerting systems to identify critical issues and anomalies. 

A strong log monitoring and observability system also protects you from DDoS attacks. A DDoS attack floods the bandwidth and resources of a particular server or application through unauthorized traffic, typically causing a major outage. 

With observability platforms, you can get ahead of this. Coralogix’s native Cloudflare integrations combined with load balancers give you the ability to cross-analyze attack and application metrics and enable your team to mitigate such attacks. Thus, you can effectively build a DDOS warning system to detect attacks early.

Along with logs, another critical business data that you should monitor regularly are emails. With over 36% of data breaches in 2022 attributed to phishing scams, businesses cannot be too careful.

4. Email Gateway Security

As most companies primarily share sensitive data through email, hacking email gateways is a prime target for cybercriminals. Thus, a top priority should be robust filtering systems to identify spam and phishing emails, embedded code, and fraudulent websites. 

Email gateways act as a firewall for all email communications at the network level — scanning and auto-archiving malicious email content. They also protect against business data loss by monitoring outgoing emails, allowing admins to manage email policies through a central dashboard. Additionally, they help businesses meet compliance by safely securing data and storing copies for legal purposes. 

However, the issue here is that sophisticated attacks can still bypass these security measures, especially if social engineering is involved. One wrong click by an employee can give hackers access to an otherwise robust system. That’s why the most critical security tool of them all is a strong cybersecurity training program.

5. Cybersecurity Training

Even though you might think that cybersecurity training is not a ‘tool,’ a company’s security measures are only as strong as the awareness among employees who use them. In 2021, over 85% of data breaches were associated with some level of human error. IBM’s study even found out that the breach would not have occurred if the human element was not present in 19 out of 20 cases that they analyzed.

Cybersecurity starts with the people, not just the tools. Thus, you need to implement a strong security culture about security threats like phishing and social engineering in your organization. All resources related to cybersecurity should be simplified and made mandatory during onboarding. These policies should be further reviewed, updated, and re-taught semi-annually in line with new threats. 

Apart from training, the execution of these policies can mean the difference between a hackable and a secure network. To ensure this, regular workshops and phishing tests should also be conducted to identify potential employee targets. Another way to increase the effectiveness of these training is to send out cybersecurity newsletters every week. 

Some companies like Dell have even adopted a gamified cybersecurity training program to encourage high engagement from employees. The addition of screen locks, multi-factor authentication, and encryption would also help add another layer of security. 

Upgrade Your Cybersecurity Measures Today!

Implementing these five cybersecurity tools lays a critical foundation for the security of your business. However, the key here is to understand that, with cyberattacks, it sometimes just takes one point of failure. Therefore, preparing for a breach is just as important as preventing it. Having comprehensive data backups at regular intervals and encryption for susceptible data is crucial. This will ensure your organization is as secure as your customers need it to be —  with or without a breach!

5 Common Elasticsearch Mistakes That Lead to Data Breaches

Posted on by eugene evdokimov

Avon and Family Tree aren’t companies you would normally associate with cybersecurity, but this year, all three were on the wrong side of it when they suffered massive data breaches. At Avon 19 million records were leaked, and Family Tree had 25GB of data compromised. What do they have in common? All of them were using Elasticsearch databases.

These are just the latest in a string of high profile breaches that have made Elasticsearch notorious in cybersecurity.  Bob Diachenko is a cybersecurity researcher. Since 2015, he’s been investigating vulnerabilities in NoSQL databases. 

He’s uncovered several high profile cybersec lapses including 250 million exposed Microsoft records. Diachenko’s research suggests that 60% of NoSQL data breaches are with Elasticsearch databases. In this article, I’ll go through five common causes for data breaches and show how the latest Elastic Stack releases can actually help you avoid them.

1. Always Secure Your Default Configuration Before Deploying

According to Bob Diachenko, many data breaches are caused by developers forgetting to add security to the default config settings before the database goes into production. To make things easier for beginner devs, Elasticsearch traditionally doesn’t include security features like authentication in its default configuration. This means that when you set up a database for development, it’s accessible to anyone who knows the IP address.

Avoid Sitting Ducks

The trouble starts as soon as a developer pushes an Elasticsearch database to the internet. Without proper security implementation, the database is a sitting duck for cyberattacks and data leaks. Cybersecurity professionals can use search engines like Shodan to scan for open IP ports indicating the presence of unsecured Elasticsearch databases. As can hackers. Once a hacker finds such a database, they can freely access and modify all the data it contains.

Developers who set up Elasticsearch databases are responsible for implementing a secure configuration before the database goes into production. Elasticsearch’s official website has plenty of documentation for how to secure your configuration and developers need to read it thoroughly.

Elasticsearch to the Rescue

That being said, let’s not put all the blame on lazy programmers! Elasticsearch acknowledges that the fast-changing cybersecurity landscape means devs need to take their documentation with a pinch of salt. Users are warned not to read old blogs as their advice is now considered dangerous. In addition, Elasticsearch security can be difficult to implement. Developers under pressure to cut times to market won’t necessarily be incentivised to spend an extra few days double checking security.

To combat the threat of unsecured databases, Elasticsearch have taken steps to encourage secure implementation as a first choice. Elastic Stack 6.8 and 7.1 releases come with features such as TLS encryption and Authentication baked into the free tier. This should hopefully encourage “community” users to start focussing on security without worrying about bills. 

2. Always Authenticate

In 2018, security expert Sebastien Kaul found an Elasticsearch database containing tens of millions of text messages, along with password information. In 2019, Bob Diachenko found an Elasticsearch database with over 24 million sensitive financial documents. Shockingly, neither database was password protected.

So why are so many devs spinning up unauthenticated Elasticsearch databases? On the internet! In the past, the default configuration didn’t include authentication. Devs used the default configuration because it was convenient and free.

To rub salt on the wound, Elasticsearch told users to implement authentication by placing a Nginx server between the client and the cluster. This approach had the downside that many programmers found setting up the correct configuration much too difficult for them.

Recognising the previous difficulties, Elasticsearch has recently upgraded the free configuration. It now includes native and file authentication. The authentication takes the form of role based access control. 

Elasticsearch developers can use Kibana to create users with custom roles demarcating their access rights.  This tutorial illustrates how role based access control can be used to create users with different access rights.

3. Don’t Store Data as Plain Text

In his research, Bob Dianchenko found that Microsoft had left 250 million tech support logs exposed to the internet. He discovered personal information such as emails had been stored in plain text.  

In 2018, Sebastien Kaul found an exposed database containing millions of text messages containing plain text passwords.

Both of these are comparatively benign compared to Dianchenko’s most recent find, a leaked database containing 1 billion plain text passwords. With no authentication protecting it, this data was ripe for hackers to plunder. Access to passwords would allow them to commit all kinds of fraud, including identity theft.

Even though storing passwords in plain text is seriously bad practice, many companies have been caught doing it red handed. This article explains the reasons why.

Cybersecurity is No Laughing Matter

In a shocking 2018 twitter exchange, a well-known mobile company admitted to storing customer passwords in plain text. They justified this by claiming that their customer service reps needed to see the first few letters of a password for confirmation purposes.

When challenged on the security risks of this practice, the company rep gave a response shocking for its flippancy.

“What if this doesn’t happen because our security is amazingly good?”

Yes, in a fit of poetic justice, this company later experienced a major data breach.  Thankfully, such a cavalier attitude to cybersecurity risks is on the wane.  Companies are becoming more security conscious and making an honest attempt to implement security best practice early in the development process. 

Legacy Practices

A well-known internet search engine stored some of it’s account passwords in plain text. When found out, they claimed the practice was a remnant from their early days. Their domain admins had the ability to recover passwords and for this to work, needed to see them in plain text.

Although company culture can be slow to change, many companies are undertaking the task of bringing their cybersecurity practices into the 21st century.

Logging Sensitive Data

Some companies have found themselves guilty of storing plain text passwords by accident. A well-known social media platform hit this problem when it admitted it had been storing plain text passwords. The platform’s investigation concluded:

“…we discovered additional logs of [the platform’s] passwords being stored in a readable format.”

They had inadvertently let their logging system record and store usernames and passwords as users were typing the information. Logs are stored in plain text, and typically accessible to anyone in the development team authorised to access them. Plain text user information in logs invited malicious actors to cause havoc.

On this point, make sure to use a logging system with strong security features. Solutions such as Coralogix are designed to conform to the most up to date security standards, guaranteeing the least risk to your company.

Hashing and Salting Passwords

In daily life we’re warned to take dodgy claims “with a pinch of salt” and told to avoid “making a hash of” something. Passwords on the other hand, need to be taken with more than a pinch of salt and made as much of a hash of as humanly possible.

Salting is the process of adding extra letters and numbers to your password to make it harder to decode. For example, imagine you have the password “Password”. You might add salt to this password to make it “Password123” (these are both terrible passwords by the way!)

Once your password has been salted, it then needs to be hashed. Hashing transforms your password to gibberish. A company can check the correctness of a submitted password by salting the password guess, hashing it, and checking the result against the stored hash. However, cybercriminals accessing a hashed password cannot recover the original password from the hash.

4. Don’t Expose Your Elasticsearch Database to the Internet

Bob Diachenko has made it his mission to find unsecured Elasticsearch databases, hopefully before hackers do!  He uses specialised search engines to look for the IP addresses of exposed databases. Once found, these databases can be easily accessed through a common browser.

Diachenko has used this method to uncover several high profile databases containing everything from financial information to tech support logs. In many instances, this data wasn’t password protected, allowing Diachenko to easily read any data contained within. Diachenko’s success dramatically illustrates the dangers of exposing unsecured databases to the internet.

Because once data is on the web, anyone in the world can read it. Cybersecurity researchers like Bob Diachenko and Sebastien Kaul are the good guys. But the same tools used by white-hat researchers can just as easily be used by black-hat hackers.

If the bad guys find an exposed database before the good guys do, a security vulnerability becomes a security disaster. This is starkly illustrated by the shocking recent tale of a hacker who wiped and defaced over 15000 Elasticsearch servers, blaming a legit cybersecurity firm in the process. 

The Elasticsearch documentation specifically warns users not to expose databases directly to the internet. So why would anyone be stupid enough to leave a trove of unsecured data open to the internet?

In the past, Elasticsearch’s tiering system has given programmers the perverse incentive to bake security into their database as late as possible in the development process. With Elastic Stack 6.8 and 7.1, Elasticsearch have included security features in the free tier. Now developers can’t use the price tag as an excuse for not implementing security before publishing, because there isn’t one.

5. Stop Scripting Shenanigans

On April 3 2020, ZDNet reported that an unknown hacker had been attempting to wipe and deface over 15,000 Elasticsearch servers. They did this using an automated script.

Elasticsearch’s official scripting security guide explains that all scripts are allowed to run by default. If a developer left this configuration setting unchanged when pushing a database to the internet, they would be inviting disaster.

Two configuration options control script execution, script types and script contexts. You can prevent unwanted script types from executing with the command script.allowed_types: inline. 

To prevent risky plugin scripts from running, Elasticsearch recommends modifying the script contexts option using script.allowed_contexts: search, update.  If this isn’t enough you can prevent any scripts from running you can set script.allowed_contexts to “none”.

Elasticsearch takes scripting security issues seriously and they have recently taken their own steps to mitigate the problem by introducing their own scripting language, Painless. 

Previously, Elasticsearch scripts would be written in a language such as JavaScript. This made it easy for a hacker to insert malicious scripts into a database.  Painless brings an end to those sorts of shenanigans, making it much harder to bring down a cluster.

Summary

Elasticsearch is one of the most popular and scalable database solutions on the market. However, it’s notorious for its role in data breaches. Many of these breaches were easily preventable and this article has looked at a few of the most common security lapses that lead to such breaches.

We’ve seen that many cases of unsecured databases result from developers forgetting to change Elasticsearch’s default configuration before making the database live. We also looked at the tandem issue of unsecured databases being live on the web, where anyone with the appropriate tools could find them.  

Recently, Elasticsearch have taken steps to reduce this by including security features in their free tier so programmers are encouraged to consider security early. Hopefully this alone provides developers a powerful incentive to address the above two issues.

Other issues we looked at were the worryingly common habit of storing passwords as plain text instead of salting and hashing them and the risks of not having a secure execution policy for scripts. These two problems aren’t Elasticsearch specific and are solved by common sense and cybersecurity best practice.

In conclusion, while Elasticsearch has taken plenty of recent steps to address security, it’s your responsibility as a developer to maintain database security.