Written by:
MJ Kaufmann It’s nearly impossible to avoid storing sensitive data online, as most companies collect personal information. Consumers who want to do anything online must register for services; often, these forms include requests for sensitive information such as date of birth, social security number, credit cards, and other identifiable data. Research done by the Identity Theft Resource Center (ITRC) shows that by having your data online, there is a strong chance that it will be lost, as there are 422 million people affected by an average of 4.8 daily breaches.
Consumers are interested in protecting their data, as 85% of adults are concerned about their online privacy but lack the power to protect it. The responsibility for data protection is increasingly shifting from consumers to companies. Given the vast amount of personal information they handle, businesses must act as responsible data stewards.
This article will investigate a recent breach with Xfinity disclosing consumer data and how this disaster could have been averted.
Analyzing the Comcast Xfinity Data Breach
A prime example of how consumers face risk from data being controlled by an organization happened in October when Comcast’s Xfinity division was hit by a data breach. This breach was caused by an existing vulnerability in their network infrastructure, allowing massive amounts of data to be leaked for at least 35 million customers. Unfortunately, like many vulnerabilities organizations fall victim to, this was not known before the attack, meaning there was no way to reasonably stop the attackers.
The Mechanics of the Xfinity Breach: A Zero-Day Exploit
In the Comcast Xfinity breach, hackers leveraged a zero-day vulnerability in Citrix software, a key component of Comcast’s cloud computing infrastructure. This newly discovered flaw, dubbed Citrix Bleed, was unknown until October, meaning Comcast had no prior opportunity to patch or mitigate the risk. Between October 16 and 19, attackers exploited this vulnerability to infiltrate Xfinity’s internal systems, gaining access to sensitive customer data.
The breach was not immediately discovered by Comcast. It was only during a routine cybersecurity exercise on October 25, several days after the initial breach, that suspicious activity was detected. This delay in detection allowed the hackers to access and potentially exfiltrate a significant amount of customer data, including usernames, hashed passwords, and, in some cases, additional personal information like parts of Social Security numbers and birthdates. All of which form the foundation of future attacks.
Consumer Implications: Understanding the Real Risks
From a consumer perspective, it may appear that the breach was not that significant. It’s not like they stole whole social security numbers or passwords. Unfortunately, that is not the case. Names, dates of birth, and partial Social Security numbers on their own may appear to be a low risk but are actually the building blocks for fraud. This information is frequently used to verify financial transactions, such as calling a credit card company to change the address or phone number or requesting a new card be mailed to the new address.
Fraud is only the start of the problem, as this breach goes beyond personal information as it involves the theft of hashed passwords, which, while hashed, still pose a risk. If hashed using a weak algorithm, cybercriminals can still discover the original password from the data. Once attackers have this data, they can reuse these stolen passwords for credential stuffing attacks, trying them on multiple sites to gain unauthorized access to more accounts, compounding the consumer risk.
Preventing Data Loss From Attacks
Companies must stop working to only stop the attack and adopt a proactive approach to preventing data loss from cyberattacks. A data-first security approach like this does not mean that companies should ignore defenses to stop the breach, but they should expect a breach to happen despite best efforts. Instead of waiting for an incident to occur, when it’s often too late to recover lost data, organizations should focus on preventing and detecting breaches as they happen. This dual strategy ensures that sensitive data is protected and any unauthorized access or anomalies are quickly identified and addressed.
Encryption Is Key
One of the first ways that companies can take control of their data security is through encryption. Encryption plays a crucial role in data security, rendering stolen files unusable to unauthorized parties. Encryption applies to more than just files and even works within databases in field-level encryption. This encrypts individual sensitive fields, making them inaccessible to users without access to the decryption keys. When appropriately implemented, following the principle of least privilege, only those who must have access to these keys do, reducing the risk of data disclosure and the overall impact if a breach does occur.
The other advantage of encryption is that it builds a defense against many legal liabilities. Under many regulations, such as GDPR, encrypted data is granted a ‘safe harbor’ if it is stolen because it is unusable to cybercriminals. This clause prevents companies from being liable and facing fines or other consequences that often come with a breach of sensitive data.
Stopping the Threat
Companies can also defend their data by using in-depth monitoring to track its utilization. Monitoring data is an early indicator of attack, as business use for each user often follows similar patterns, which can be established by monitoring normal data usage to develop what constitutes typical behavior. Due to the vast volume of data, employing Artificial Intelligence (AI) becomes essential for setting these baselines and identifying deviations.
Abnormal access might include unusual times, different locations, or anomalous interactions with data, such as accessing rarely used files or a considerable volume of data. Systems that can detect these irregularities and alert IT teams are vital. Even more advantageous are advanced systems capable of autonomously restricting access pending human assessment, enhancing security posture, and mitigating potential threats.
Defend Consumer Data
The Sotero Data Security Platform integrates Zero Trust principles for robust data protection. It emphasizes stringent access control, perpetual data encryption, and sophisticated threat detection to ensure a comprehensive security approach. Sotero’s solution is designed to blend seamlessly with existing infrastructures and cloud environments, facilitating the protection of sensitive data and compliance with regulatory standards, even in highly regulated sectors.
Discover the capabilities of the Sotero Data Security Platform with a complimentary demo and see how it can bolster your organization’s cloud computing security. With Sotero, you can confidently navigate the cloud landscape and ensure your data remains well-protected.