More Related Content
Similar to Sensitive Data Exposure
Sensitive Data Exposure
- 1. SENSITIVE DATA AMBE R BODI FORD
- 2. AGENDA • SensitiveData • Data Exposure • Data Classification • Why Data Needs Protection • Laws that Protect Data • Minimizing Exposure • How is Data Exposed • Minimum Prevention • Threat Agents • Security Flaws • Technical Impacts • Business Impacts
- 3. SENSITIVE DATA •Information that must be protected from outside intruders. • Passwords • Addresses • Social Security Number • Credit Card Information
- 4. DATA EXPOSURE •When information is not protected properly from unauthorized users, intruders have the ability to exploit and steal data.
- 5. DATA CLASSIFICATION •Highly confidential – most sensitive; use within company • Sensitive – private information • Internal Use Only – sensitive, but accessible by a large audience
- 6. WHY DATA NEEDSPROTECTING • Because of new and innovative technologies, it allows unauthorized users an easier way to gain access to information allowing for identity theft, which leaves individuals vulnerable.
- 7. LAWS THAT PROTECTDATA • Sensitive Information is protected by laws, regulations, and policies: • Gramm-Leach-Bliley Act • Federal Information Security Management Act • HIPPA
- 8. MINIMIZING EXPOSURE •Restrict access • Specified individuals • Assign access privileges • Guidelines • Passwords • Encryption
- 9. HOW IS DATAEXPOSED? • Intrusion- weakness in operating system • Phishing- tricked into thinking the website is trusted • Social Engineering- posing to get information/ installing malicious software
- 11. MINIMUM PREVENTION 1.Encrypt all sensitive data (two –factor identification) 2. Dispose of sensitive data 3. Disable autocomplete and caching 4. Backups 5. Plan for data loss/theft
- 12. THREAT AGENTS •Theft • Internal Employees, Partners) • External (Malware, Cyber Criminals) • Loss • Neglect • Insecure Practices
- 13. SECURITY FLAWS •Exploitation of software bugs • Denial-of-service attacks • Read/write files • Common flaw (not encrypting) • Website defacement • Server (distribution point) • Secure remote access
- 14. TECHNICAL IMPACTS •Update software • Unsecured remote desktop • Wipe devices
- 15. BUSINESS IMPACTS •Business Value • Damaged Reputation • Legal liability
- 16. SUMMARY 1. Donot store information if it is not necessary 2. Encrypt sensitive data 3. Learn from other’s mistakes
- 17. REFERENCES Hamit, J.(2014). Top Ten Web Security Risks: Sensitive Data Exposure . Retrieved from http://blog.credera.com/technology-insights/open-source- technology-insights/top-ten-web-security-risks-sensitive-data-exposure- 6/ Safe Computing Techniques. (2008). Sensitive Data: Your Money and Your Life. Retrieved from http://web.mit.edu/infoprotect/docs/protectingdata.pdf OWASP. (2013). Top 10 2013-A6-Sensitive Data Exposure. Retrieved from https://www.owasp.org/index.php/Main_Page Sundar, V., (2014). Sensitive Data Exposure – A Nightmare To All Business Enterprises. Retrieved from https://www.indusface.com/blog/?p=395 University of North Carolina. (n.d.). What is Sensitive Data. Retrieved from http://help.unc.edu/help/what-is-sensitive-data/
- 18. READING LIST 1.To order a report or report fraud: http://www.experian.com 2. IS&T Security FYI Newsletter: http://mailman.mit.edu/mailman/listinfo/ist-security-fyi 3. Sensitive Data: Your Money and Your Life. http://web.mit.edu/infoprotect/docs/protectingdata.pdf 4. Sensitive Data Exposure – A Nightmare To All Business Enterprises. https://www.indusface.com/blog/?p=395 5. Using Transparent Sensitive Data Protection. http://docs.oracle.com/database/121/DBSEG/tsdp.htm 6. Identifying and Protecting sensitive Data. http://www.darkreading.com/vulnerabilities--- threats/identifying-and-protecting-sensitive-data/d/d-id/ 1141253?
- 21. THE END SENS I T I VE DATA B Y : AMB E R BODI FORD
Editor's Notes
- #4 University of North Carolina. (n.d.). What is Sensitive Data. Retrieved from http://help.unc.edu/help/what-is-sensitive-data/
- #8 Safe Computing Techniques. (2008). Sensitive Data: Your Money and Your Life. Retrieved from http://web.mit.edu/infoprotect/docs/protectingdata.pdf
- #9 Safe Computing Techniques. (2008). Sensitive Data: Your Money and Your Life. Retrieved from http://web.mit.edu/infoprotect/docs/protectingdata.pdf
- #10 Attackers typically don’t break crypto directly. They break something else, such as steal keys, do man-in-the-middle attacks, or steal clear text data off the server, while in transit, or from the user’s browser.
- #12 It is encrypted everywhere it is stored long term, including backups of this data. It is encrypted in transit, ideally internally as well as externally. All internet traffic should be encrypted. Strong encryption algorithms are used for all crypto Strong crypto keys are generated, and proper key management is in place, including key rotation. Proper browser directives and headers are set to protect sensitive data provided by or sent to the browser.
- #13 https://ist.mit.edu/security/data_risks Consider who can gain access to your sensitive data and any backups of that data. This includes the data at rest, in transit, and even in your customers’ browsers. Include both external and internal threats.
- #14 The most common flaw is simply not encrypting sensitive data. When crypto is employed, weak key generation and management, and weak algorithm usage is common, particularly weak password hashing techniques. Browser weaknesses are very common and easy to detect, but hard to exploit on a large scale. External attackers have difficulty detecting server side flaws due to limited access and they are also usually hard to exploit.
- #15 Failure frequently compromises all data that should have been protected. Typically, this information includes sensitive data such as health records, credentials, personal data, credit cards, etc.
- #16 Consider the business value of the lost data and impact to your reputation. What is your legal liability if this data is exposed? Also consider the damage to your reputation.