Preventing a Twitch or Sony Level Hack

The latest victim of a massive data breach was Twitch. It’s got lots of executives concerned about the security of their systems. It’s a bit remnant of the Sony hack a number of years ago.

Although many companies spend a lot time ensuring their customer data is secured, and rightly so, there is little attention paid to corporate security. Corporate security refers to internal corporate data that keeps the company moving along. 

Let me outline some of examples of corporate data:

• Emails, like all emails like password resets, casual conversations, and on

• Slack DMs and Teams Conversations

• Performance Reviews

• Salary and compensation information (including executive compensation)

• Cap TableFinancial Information such as

  • Vendor contracts

  • Fees for consultants

  • Customer financials (like Twitch user earnings for example)

What’s the riskiest item here for your company? In other words, if the WORLD knew a piece of information above, what would be the most impactful?

• Does your company have a loose policy on how it speaks about customers and clients? Or even each other? Then email and slack could be your biggest concern.

• Would a leak in vendor and client fees hurt your competitive advantage or negotiating capabilities for future deals?Share Last Week As A vCISO

Data Loss Protection Controls for a Twitch Hack

I’m going to list (almost) every possible control one can do to help prevent or lower the risk of such an attack. Nothing is foolproof and there is no silver bullet. If you’ve been reading this for awhile, you’ll know that defense in depth is everything.

There Is No Spoon - No Data, No Problem

If the data is not there, then it can’t ever leak can it?

Do you have every single email and slack message ever sent? Are there conversations that could impact your company negatively?

Guidelines and Controls

• Have a policy and provide training around good communication principles. Ask everyone to assume everything typed can be leaked, screenshot, or forwarded.

• Consider lowering your retention policies on email and slack. You will need to find the fine line of convenience vs security

  • You’d be surprised what’s in slack sometimes. I once found an open channel by an old employee with tons of API keys in chat.

Data Leak Prevention - Built In Tools

Your existing SaaS tools have a lot of built-in controls to prevent data from leaving your organization. You’d be surprised how easy it is to share information externally.

Here are some examples of scenarios I’ve run into in the past:

• Users sharing documents and folders with the world or personal user accounts (intentional or not)

• Users using 3rd party email clients, especially startups, that retain all company email (An email hack/leak can happen from anywhere!)

• Users forwarding emails to their personal emails

• Users sharing calendars with the world (Imagine how much information is in an EA’s calendar)

• Admin tools provide employees access to tons of client information and permissions allowing people to view data or make deletions

Here is a list of possible controls and guidelines:

• Prevent users or groups from sharing information externally (drive, calendar, etc)

• Prevent users from forwarding company emails to their personal email

• Disable IMAP and POP

• Disable “Less secure apps” in Google Workspaces

• Enable logging of sharing actions

• Conduct an access review of users quarterly (make this a group effort to prevent too much load on one group)

• Limit access to sensitive data to only users that require it for their role. Create roles appropriate to the employee role.Share

  • Does CS really need all those permissions?

Data Leak Prevention - Advanced Protection Tools & Methods

Sometimes to truly track your company data, you might want to employ additional controls.

That could involve:

• Using DLP controls built into your software

• Obtaining DLP specific software designed to track data from all corporate sources

• Limiting access to some or all corporate data from company authorized and managed devices only

Conclusion

As you can see the rabbit is pretty deep. Yes, there is lot of data out there, but managing the risk of that data being exposed involves a few factors:

• The type of data you are holding

• Culture of your company

• Stage of your company (are you trying just to survive or are you #1 and not trying to get knocked off that pedestal?)

• Balance between convenience and security

• Past incidents and precedent

Hopefully this helps paint a more holistic picture next time you wonder, could this happen to me?

Thanks,

Ayman