How your Data Gets Leaked
Data leaks in any company or organization is disastrous. The leak could be credentials used to hack the network, confidential information such as salaries or financial numbers, proprietary designs that if leaked to competitors will wipe away competitive edge, and the list goes on and on. A fundamental part of cybersecurity is the prevention of such data leaks. If not adequately accounted for, data can leak in a number of ways.
One typical way attackers use is common ports to exfiltrate the data. Because the ports are common the network does not sense anything strange, even though the outbound data exfiltration is happening at 3 am. If there is no standard monitoring mechanism, the data gets leaked and no one notices.
Sometimes data can leak through insiders who copy data into personal email drafts, a ChatGPT prompt or a USB. This eventually leads to data being leaked out typically against policy. While users may do this without thought, the results can be problematic down the road. Pasting into ChatGPT (or other LLMs) can particularly be dangerous since what is pasted is used to train more models which means the data gets to reside in third-party servers in all cases.
Another way is through insecure vendors. A company naturally shares data with its vendor for the service they provide. If that vendor gets hacked your data gets leaked. The risk is slightly different but the ultimate outcome is the same. This is why many organizations mandate certain security accreditations and certifications before being registered in their vendor list.
Data leaks can also occur due to unintentional blunders. For example, an engineer configures a cloud storage bucket and sets it to “Public” for testing purposes. When done the setting remains public instead of being private or completely dismantled. The result? The data on the storage gets indexed by Google and anyone searching for these data items can easily find them.
Shadow IT can also be a source of data leaks. Employees who use applications (Slack, Whatsapp, etc...) that share files or data will essentially get data out of the boundaries that are supposed to keep them. Since these applications are beyond IT’s visibility and control, all sorts of unauthorized activities can occur.
Preventing such data leaks entails a number of precautionary actions. Here are some of the most important:
- Data Discovery and Classification: Protection starts with knowledge. Identify all repositories and conduct a comprehensive scan on them to compile all data that exists within the company. Classify such data in terms of confidentiality such that data protection policies can be placed and enforced.
- Data Loss Prevention: This includes monitoring the network for irregular activities (such as the 3 am outbound data transfer mentioned earlier) and preventing USB, personal email or cloud writes that eventually leads to the data leak.
- Cloud Security Posture Management: Complete scan on all cloud assets to ensure nothing is set to “Public” and shut down any that were meant to be temporary.
- Identity and Access Governance: Promote Just-In-Time access such that people are granted temporary access for specific tasks that get revoked once the task is done. This ensures lean management of access and that no credentials are left out unnecessarily.
- Vendor Risk Management: Conduct regular audits on your key vendors to ensure that they do not become a security risk for you. Ask for their security reports, demand they get certifications and ensure your contract has clauses that protect you from malpractice or negligence on their part.
- User Education: The human firewall is arguably the most important aspect of any security framework, since people (especially uneducated or uninformed ones) will represent the biggest threat to any organization.
There is no moat around your castle anymore. Data lives in the cloud, on endpoints, in emails, and with vendors. To stop leaks, you must stop thinking about "walls" and start thinking about "Data-Centric Security" —protecting the data itself, regardless of where it travels and where it resides. Broadening your data protection horizons is the only way you can achieve complete and comprehensive data security.