No one likes to hear dripping. Two problems are forming with this innocent constant sound — loss of the
liquid itself, and more importantly, the damage that is being caused by the escaping substance as it
finds a new home. We can all sympathize and understand the logistics around a dripping tap or pipe. Did
you know data leaks too?
How does that manifest?
Let us first of all define what we mean by data leakage. This is the accidental, or unintended, sharing
of data when performing another function. Sounds implausible doesn’t it? You are probably thinking that
your organization is a tight ship with the data under your stewardship safe and secure.
This is an area we look for at MacLaurin
Group when engaging with our clients, either in a due diligence
or a TAP (Technology Advisory Program) capacity, and people are continually surprised when we find
significant data leakages.
Before we jump down into where a company can leak data, let us first look at ourselves and how on a daily basis we leak our own personal data, all without us realizing it. If you have done any of the following things, then you may leaked your own personal sensitive data:
Been asked by a teller in a shop for your cell number, as part of the store’s loyalty program. If you have one, you may have said it out-loud, for anyone within ear-shot to hear. You’ve just leaked.
Entered in your zip code at the gas pump. We seldom hide typing our zip code in like we do with our PIN numbers, or notice it displays in a big font as confirmation, but anyone looking over at you can easily see your data. You’re leaking.
Set your home address in your car’s navigation for faster routing. Any parking valet, car mechanic, or rogue passenger can easily get your home address. Big leak (recommend setting an address that is close to your home, say a street over).
At the airport, standing waiting for TSA line, most likely with your drivers license or passport out, ready for the agent to review. Or tagged your bag with your name, address and phone number. This data is clearly visible to all standing around you (look around the next time, it will amaze you how much data you can glean from your fellow travellers).
This is all before we look at the information that you may be advertising on social media (twitter/facebook/blogs) posts. For example, advertising you’re on vacation or taking a flight, says your home is sitting empty and available for burglars. It is very easy to leak data, and for the would-be Sherlock’s, take note as you move around your community just how much data you can pick up from your fellow humans.
You can see where in your personal life you can easily let sensitive data creep out by virtue of simply
trying to use it. The same thing happens in the corporate world — albeit a little more subtle than
typing in zip codes at a gas station!
We aren’t just talking about user data leaking, included is the data that will give the would-be viewer
an insight into the types of systems you are using and give them an unintended upper hand.
Error Reporting
The biggest culprit of all is when an application develops a problem and reports an error to the
end-user. Some systems will dump the state of the data at the time of the fault for easier
debugging, but that data may contain sensitive data, such as database credentials. Web
applications are particularly guilty of this leakage.
Database Identities
Databases are terribly good at storing data and it is common to store a unique ID with each
record to make it easy to address that data. Most default to numeric and most default to
sequential starting at zero. So what? Well if that ID is something that is exposed in a browser
window location bar (?customer_id=2), then you are leaking the number of clients (or whatever
type it is) that you have, particularly if you let them sign-up themselves, and they’re assigned
a number they can see. Additionally, irreputable individuals can potentially access another’s
information by simply altering the customer ID if exposed in the URL to the next number in the
sequence. Not so easy to do if you are using a GUID.
Customer Support
Does your support staff have all the data about your customer at their fingertips? Do they
actually need all the data? If not, then you are leaking data unnecessarily, internally.
Email
If your system generates automatic emails (password resets, system status etc), does that email
contain anything in it, that if it was forwarded to another recipient, would give more
information than you would like them to see? Such emails should have the minimal amount of data
in it to satisfy the request that is being addressed.
Conference Calls with Screen Sharing
If you are giving a demo to a client or new customer, and sharing your screen, have you closed
down your email, chat and cleared away any bookmarks? Notifications that come through will leak
data, including being potentially embarrassing.
Documents
Have you ever sent a document/contract/image to an external party, for example a client? How
much metadata did you leak out in the document you just sent? An image may contain the date and
location of where it was taken. The document may contain all the version history, particularly
troublesome, if you’ve edited something you prefer for the recipient not to see.
It is very easy to fix a leak once you’ve identified it. A dripping pipe/tap, is easy to see and know the
corrective action to take. Not quite as obvious when listening for the drip-drip of data.
With a little thought though, stepping back, looking at it with fresh eyes, you may be surprised just
what data you’ve been leaking out over the years.