Researchers: 61M Health IoT Device User Records Exposed
Database Belonged to a Firm That Apparently Just Shut Down
… Internet-exposed database breaches usually occur due to several common reasons, says Keith Fricke, a principle consultant at privacy and security consultancy tw-Security.
Sometimes IT makes changes to these systems and afterwards the security is not checked, he says. “In other cases, these systems have vulnerabilities that criminals exploit before the hosting organization patches them or puts compensating controls in place.”
Occasionally, internet-facing systems have misconfigured security settings due to lack of knowledge or experience, he notes.
“Lastly, sometimes assumptions are made about the hosting provider securing the internet-facing systems. For example, Amazon and Microsoft have defined boundaries of responsibilities for their respective cloud hosting services,” he says.
“Often times these boundaries put the responsibility of properly securing the servers built in these environments on the customer.”
In order to help prevent these types of incidents, entities must ensure their systems are secured before putting them on the internet, and then use change management processes to ensure changes are secured, as well, Fricke says.
Entities should review security post-change, and lastly, routinely scan the internet-facing systems for vulnerabilities and track remediation, Fricke suggests.
“The criminals are scanning the internet all the time, looking for vulnerable systems. We need to be scanning our systems too.”
For more information or to schedule a FREE initial consultation – contact tw-Security.
Read More
