2019 Guide to avoid the Top 3 causes of data breaches
Cybercrime estimated that poor cybersecurity will do global damages that will pass $6 billion until 2021.
Now, we will present you the top 3 causes of data breaches 2019:
Misconfigured Cloud Storage
Not a day passes by without a cybersecurity incident involving unprotected AWS S3 storage, Elasticsearch, or MongoDB.
A recent report shows that only 30% of companies are protecting their data in a cloud. Even worse is the fact that, according to the same report, more than 50% of the companies still do not use encryption or tokenization to protect sensitive data in the cloud.
The main reason for this security flaw? Some of the most common cloud database implementations ships with no security or access control as standard at the start.
This year the global average cost of a breach was $3.92 million per. The main reason for this is attributed to the fact that many cybersecurity and IT professionals still believe that cloud providers are responsible for protecting their data in the cloud.
If you think about using a cloud system remember that all major cloud and IaaS providers have experienced law firms. Most users or SME companies don’t even carefully read the terms, which translates in that you will be the only one to blame and punish for misconfigured or abandoned cloud storage and a resultant data breach.
Unprotected Code Repositories
For example, it was found that 100,000 GitHub repositories have been leaking secret API tokens and cryptographic keys, with thousands of new repositories exposing secrets on a daily basis. The biggest company affected by this kind of unwanted behavior is the Canadian banking giant Scotiabank who recently publicly admitted that they were storing internal source code, login credentials, and access keys for months in publicly open and accessible GitHub repositories.
Why is this such a bad practice?
Because. Cybercriminals are well aware of this. Cyber gangs specialized in OSINT data discovery meticulously crawl existing and new code repositories in a continuous mode, carefully scraping the data.
Vulnerable Open Source Software
Another recent report showed that 97 out of the 100 largest banks are vulnerable and have poorly coded web and mobile apps. For example, the oldest unpatched vulnerability found was known and publicly disclosed since 2011.
Few companies properly track and maintain an inventory of countless OSS and its components built into their enterprise software.
How to protect:
Follow these five recommendations to reduce your risks in a cost-efficient manner:
1. Maintain everything up2date
Software, hardware, data, users, and licenses should be continuously monitored, classified, and risk-scored. Just update everything as soon as one is available.
2. Constant monitor your network from outside and from inside
Many organizations spend money on auxiliary or even theoretical risks, ignoring their numerous outdated, abandoned, or simply unknown systems accessible from the Internet. Remember hackers are smart and pragmatic; they won’t assault your network if they can silently get.
3. Implement patch management and automated patching
Hackers will systematically search for the weakest link in your defense perimeter to get in, and even a tiny outdated JS library may be enough for them to have a successful cyber attack. Implement, test, and monitor a robust patch management system for all your systems and applications.
4. Prioritize your testing and remediation
Deploy continuous security monitoring for all your external assets. Setup monitoring for any anomalies with rapid notifications.
5. Always search Dark Web for data leaks
Continuous monitoring Dark Web for incidents may save millions of dollars and, most importantly, your reputation and goodwill.