{"id":7128,"date":"2021-01-04T15:25:09","date_gmt":"2021-01-04T15:25:09","guid":{"rendered":"https:\/\/outofsite.biz\/cynance\/?p=7128"},"modified":"2021-03-09T15:30:18","modified_gmt":"2021-03-09T15:30:18","slug":"data-breach-brokers-the-wrong-hands-for-your-data","status":"publish","type":"post","link":"https:\/\/outofsite.biz\/cynance\/data-breach-brokers-the-wrong-hands-for-your-data\/","title":{"rendered":"Data Breach Brokers &#8211; Avoid Data Falling Into the Wrong Hands"},"content":{"rendered":"\t\t<div data-elementor-type=\"wp-post\" data-elementor-id=\"7128\" class=\"elementor elementor-7128\">\n\t\t\t\t\t\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-45e0897e elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"45e0897e\" data-element_type=\"section\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-2a13f229\" data-id=\"2a13f229\" data-element_type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t\t\t<div class=\"elementor-element elementor-element-264884f6 elementor-widget elementor-widget-text-editor\" data-id=\"264884f6\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<style>\/*! elementor - v3.11.5 - 14-03-2023 *\/\n.elementor-widget-text-editor.elementor-drop-cap-view-stacked .elementor-drop-cap{background-color:#818a91;color:#fff}.elementor-widget-text-editor.elementor-drop-cap-view-framed .elementor-drop-cap{color:#818a91;border:3px solid;background-color:transparent}.elementor-widget-text-editor:not(.elementor-drop-cap-view-default) .elementor-drop-cap{margin-top:8px}.elementor-widget-text-editor:not(.elementor-drop-cap-view-default) .elementor-drop-cap-letter{width:1em;height:1em}.elementor-widget-text-editor .elementor-drop-cap{float:left;text-align:center;line-height:1;font-size:50px}.elementor-widget-text-editor .elementor-drop-cap-letter{display:inline-block}<\/style>\t\t\t\t<p dir=\"ltr\">What happens after a data breach?<\/p>\n<p dir=\"ltr\"><b>&nbsp;<\/b><span style=\"word-spacing: normal;\">Discovery of a data breach is only the tip of the iceberg. Even as companies complete their initial incident response and begin their recovery, trying to minimise the leak and reduce the damage, the chances are that the stolen data has already been passed onto the next stage of its journey. One of these stages are data breach brokers who might sell that data on the dark web.<\/span><\/p>\n<p dir=\"ltr\"><b>&nbsp;<\/b><span style=\"word-spacing: normal;\">As 2020 drew to a close, that is exactly what happened. Data breach brokers <\/span><a href=\"https:\/\/www.bleepingcomputer.com\/news\/security\/data-breach-broker-selling-user-records-stolen-from-26-companies\/\" style=\"word-spacing: normal;\" target=\"_blank\" rel=\"noopener\">began to sell 368.8 million stolen user records<\/a><span style=\"word-spacing: normal;\"> from 26 companies on a hacker forum. What is interesting is that eight of the companies whose data is being sold had not disclosed a data breach to the authorities, and in some cases were not even aware that they had been breached.<\/span><\/p>\n<h2 dir=\"ltr\">Data breach brokers &#8211; the shady middle men<\/h2>\n<p dir=\"ltr\">Just like in the physical world, where people may sell their possessions to a broker who in turn will sell it at the second hand market, getting them the best possible price, data breach brokers help cyber criminals sell their stolen data. Data breach brokers will market and sell the stolen data for them, allowing them to profit from their hacking exploits but remain under the radar at the same time.<\/p>\n<p dir=\"ltr\"><span style=\"word-spacing: normal;\">Data breach brokers market and sell stolen data records on the dark web to hacker groups or other forms of criminals, who will then use the data for their own purposes, including hacking into accounts, identity theft, or fraud. The price each stolen database will receive <\/span><a href=\"https:\/\/outofsite.biz\/cynance\/the-stolen-health-data-market\/\" style=\"word-spacing: normal;\">depends on the information contained within them<\/a><span style=\"word-spacing: normal;\">. In this case, databases are being priced at between $1,800 to $4,000. Each database can be sold multiple times, bringing in a tidy profit for both the hackers and the brokers.<\/span><\/p>\n<p dir=\"ltr\"><span style=\"word-spacing: normal;\">It should be noted that these data breach brokers are not the majority of data brokers who operate in legitimate areas such as Equifax, Experian, and Oracle. These brokers operate within the privacy laws of the countries they work in, and sell anonymised data that may be useful for other organisations to use in their marketing, advertising, or other targeting activities.&nbsp;<\/span><\/p>\n<h2 dir=\"ltr\">What happens to the companies who are hacked?<\/h2>\n<p dir=\"ltr\">The information data breach brokers post on the dark web is usually accurate &#8211; meaning that the records will contain the information that the data breach brokers claim is in them. For eight companies on the list published last month, this seems to be unwelcome news.&nbsp;<\/p>\n<p dir=\"ltr\"><span style=\"word-spacing: normal;\">The recent <\/span><a href=\"https:\/\/outofsite.biz\/cynance\/us-treasury-cyber-attack-suppliers-in-the-spotlight\/\" style=\"word-spacing: normal;\">SolarWinds attack<\/a><span style=\"word-spacing: normal;\"> in the United States demonstrated that not all breaches are detected quickly. The average dwell time for undetected breaches is upwards of six months, before they are discovered or they decide the time is right to attack. Many hackers are extremely good at covering their tracks. Other hackers get lucky, or are able to discover organisations with weaker perimeter security, which means they can get in and out of systems without discovery.<\/span><br><\/p>\n<p dir=\"ltr\"><span style=\"word-spacing: normal;\">These eight companies now face the hard work of completing their incident response programme after their breach was discovered by a third party. They will need to understand where the breach occurred, identify what data was stolen, and figure out the overall damage in terms of both money and reputation.&nbsp;<\/span><\/p>\n<h2 dir=\"ltr\">Keep your data out of the hands of data breach brokers: Data protection tips<\/h2>\n<p dir=\"ltr\">No matter how careful you are, data breaches happen. They are a real risk for organisations of all sizes and in all industries. Every organisation needs to take steps to protect their data at all times. These steps can include:<\/p>\n<p dir=\"ltr\"><span style=\"word-spacing: normal;\">1. Ensure that <\/span><a href=\"https:\/\/outofsite.biz\/cynance\/infrastructure-security\/network-security\/\" style=\"word-spacing: normal;\">network security<\/a><span style=\"word-spacing: normal;\"> defences are configured correctly, and set up to notify you when there is an attempt to breach them.<\/span><\/p>\n<p dir=\"ltr\"><span style=\"word-spacing: normal;\">2. Monitor your networks continually, collecting incident logs in a secure, centralised location. Ensure that these logs are kept safe and can\u2019t be altered.<\/span><br><\/p>\n<p dir=\"ltr\"><span style=\"word-spacing: normal;\">3. Create an update schedule that ensures that all systems, software, and applications are kept up to date, and that crucial <\/span><a href=\"https:\/\/outofsite.biz\/cynance\/vulnerability-chaining-gives-access-us-gov-networks\/\" style=\"word-spacing: normal;\">security patches<\/a><span style=\"word-spacing: normal;\"> are applied in a timely manner. Automate updates that are safe, and test updates that could potentially harm systems.<\/span><\/p>\n<p dir=\"ltr\"><span style=\"word-spacing: normal;\">4. Conduct <\/span><a href=\"https:\/\/outofsite.biz\/cynance\/pasta-threat-modelling\/\" style=\"word-spacing: normal;\">threat modelling<\/a><span style=\"word-spacing: normal;\"> exercises to examine the resilience of your systems and infrastructure, and make sure that you are aware of, and on top of, the specific threats to the confidentiality, integrity, and availability of your data, and have effective controls in place.<\/span><br><\/p>\n<p dir=\"ltr\"><span style=\"word-spacing: normal;\">5. Apply multi factor authentication for employees and users to strengthen passwords and make sure that they don\u2019t inadvertently create a breach.<\/span><br><\/p>\n<p dir=\"ltr\"><span style=\"word-spacing: normal;\">6. Implement a data backup and recovery policy, that includes checking that it is possible to recover properly from the backups created, and keep it up to date to minimise damage and interruptions should a breach occur.&nbsp;<\/span><\/p>\n<p dir=\"ltr\"><span style=\"word-spacing: normal;\">7. Encrypt databases to ensure that even when stolen they are of limited value to a hacker.<\/span><\/p>\n<p dir=\"ltr\"><span style=\"word-spacing: normal;\">8. Get your employees involved by training them in their cybersecurity responsibilities, from safe development, to avoiding falling for phishing attacks.<\/span><\/p>\n<p dir=\"ltr\">\n<\/p><p dir=\"ltr\">Stay safe.<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t\t\t\t<\/div>\n\t\t","protected":false},"excerpt":{"rendered":"<p>What happens after a data breach? &nbsp;Discovery of a data breach is only the tip of the iceberg. Even as companies complete their initial incident response and begin their recovery, trying to minimise the leak and reduce the damage, the chances are that the stolen data has already been passed onto the next stage of&hellip;<\/p>\n","protected":false},"author":10,"featured_media":7138,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[18],"tags":[63,62],"_links":{"self":[{"href":"https:\/\/outofsite.biz\/cynance\/wp-json\/wp\/v2\/posts\/7128"}],"collection":[{"href":"https:\/\/outofsite.biz\/cynance\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/outofsite.biz\/cynance\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/outofsite.biz\/cynance\/wp-json\/wp\/v2\/users\/10"}],"replies":[{"embeddable":true,"href":"https:\/\/outofsite.biz\/cynance\/wp-json\/wp\/v2\/comments?post=7128"}],"version-history":[{"count":0,"href":"https:\/\/outofsite.biz\/cynance\/wp-json\/wp\/v2\/posts\/7128\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/outofsite.biz\/cynance\/wp-json\/wp\/v2\/media\/7138"}],"wp:attachment":[{"href":"https:\/\/outofsite.biz\/cynance\/wp-json\/wp\/v2\/media?parent=7128"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/outofsite.biz\/cynance\/wp-json\/wp\/v2\/categories?post=7128"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/outofsite.biz\/cynance\/wp-json\/wp\/v2\/tags?post=7128"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}