In this article, I will answer the question “What is data leakage?”. I will also explain the difference between data leakage and a data breach and what companies can do to protect the sensitive information in their custody.
Table of ContentsThe term “Data Leakage” describes any event where confidential information is exposed to potential unauthorized access. When data leakage occurs a cybercriminal can gain unauthorized access to sensitive information without needing to bypass security controls.
Examples of data leakage include:
While data leaks and data breaches are similar (and the terms are often used interchangeably), the core difference is that a data breach describes when an attack results in a threat actor accessing sensitive data, whereas a data leak describes the accidental exposure of sensitive data.
Data leakage often occurs due to security vulnerabilities, poor data protection practices, human error, or accidental inaction by a user. While a breach can be made more viable through these factors, they require purposeful effort from a cybercriminal to occur.
When sensitive information is exposed to unauthorized parties through a data leak or malicious attacks it can result in serious consequences for the organization such as compliance violations, financial penalties, loss of competitive edge, and becoming a more viable target for a spear-phishing attack.
Though data leaks will often not directly lead to a breach, the offending organizations are still required to perform similar incident response plans. They must notify any supervisory authorities about the sensitive information that was made accessible to the public as the data leakage could have provided an opportunity for exfiltration.
They will also be required to perform validation on their existing controls and practices to prevent future attacks, data leakage, and/or data breaches.
In June of 2018 security researcher Vinny Troia discovered an unprotected database that belonged to Exactis, a compiler and aggregator of business and consumer data. The exposed database contained nearly 340 million individual records, many of which contained personally identifiable information of individuals.
In 2015 Data Breach Today reported on two incidents where healthcare staff members at the North Carolina Department of Health and Human Services sent unencrypted email messages containing PHI to other local health departments in the state.
While in this example they did not detect any sign of these internal resources being breached, the lack of encryption created the potential for a data breach, making the incident a HIPAA violation.
HIPAA (The Health Insurance Portability and Accountability Act of 1996) is a security compliance framework that is specific to the healthcare industry. Under HIPAA covered entities are held to stringent network and data security requirements.
North Carolina public health officials stated that they would remind their staff to encrypt emails with confidential data and they would search for tools that can encrypt emails automatically to avoid human error in the future.
As with any cybersecurity topic, there is no definitive answer for avoiding data leakage 100% of the time. As technology evolves it will introduce new ways that data leaks and data breaches can occur.
That said, there are best practices that organizations can take to prevent data leaks and protect the repositories containing trade secrets and the personal data of their customers.
When employees are given unrestricted use of portable storage devices, the leakage of data can be caused by something as simple as a misplaced USB flash drive. To mitigate against this risk you should use USB control software to monitor and control the use of removable media devices.
With these solutions, you will have the features you need to ensure that only trusted devices are allowed to be used in your network. You’ll also be able to set USB device policies that only allow authorized users to transfer data to portable storage devices.
Get started today—Download the FREE template and customize it to fit the needs of your organization.
Employee monitoring software solutions are essential security tools. By monitoring transfers to portable storage devices, the applications that employees use, and web browsing habits you can detect anomalous and high-risk behavior to protect your business from accidental and malicious insider threats.
The role that accidental insider threats have in the leakage of data simply cannot be understated. According to CybSafe’s analysis of data from the UK’s Information Commissioner’s Office (ICO), 90% of data breaches in 2019 were caused by human error.
For this reason, any organization that takes its cybersecurity responsibilities seriously must invest in training its users on the security risks and responsibilities that come alongside their roles.
Security awareness includes phishing and social engineering awareness, cybersecurity policies, internet security best practices, password security training, and the unique data security responsibilities of their role.
When data is leaked a malicious actor could gain access to it. Encryption will make the data illegible to anyone that does not have the associated encryption key, reducing the chances that the data can be used for personal gain. Any authorized employee that needs to decrypt the data can be provided with the means to do so.
To protect your business and your customers, you need to ensure that trade secrets, personal information, and other forms of sensitive data are only accessible on an as-required basis. If any user in your company can access this data it is far more likely that data leakage will occur.
This best practice is not just for your organization’s immediate employees, either. All third-party entities need to be vetted and restricted accordingly. Even with a documented chain of custody your organization is equally responsible for a data breach that is caused by a third party.
While cloud servers are a valuable solution for the modern workforce, these resources must be adequately protected to prevent unauthorized users from accessing them.
Many data leaks are the result of data repositories being made accessible to the internet without proper security measures in place. Repositories such as Amazon S3 buckets, Azure file shares, and GitHub repositories must have a secure password and multifactor authentication enabled at the bare minimum.
If these repositories have sensitive data stored on them further security measures such as encryption, restricting public access, and implementing an identity and access management solution.
Meeting (or exceeding!) security standards must be a priority throughout your entire organization.
Performing regular vulnerability assessments helps your organization identify its weaknesses, test the effectiveness of its current mitigation measures, and identify opportunities to improve your security posture.
Unfortunately, Netwrix research found that though 70% of companies are already doing risk assessments, the majority of them do not do it regularly.
Risk assessments simply aren’t a one-and-done deal; identifying and mitigating risks needs to be a continuous process to ensure that your organization is prepared to address new threats as they arise.
How often should IT risk assessments be done? The recommended best practice is to re-evaluate your risks at least every one to three years. This ensures that your security controls remain adequate as your IT assets change and new threats and vulnerabilities emerge.
During this process, you should perform a data discovery and classification assessment that identifies what sensitive data your business is responsible for, where it is stored in the network, who could have access to it, and what measures are required to ensure its confidentiality, integrity, and availability.
Misaddressed emails are one of the most common causes of data leakage. To help protect against this vulnerability you can implement a Secure Email Gateway (SEG) that detects when sensitive data is being transmitted via email and blocks its transmission.
Rather than sending sensitive data via email, the company can create a secure repository to store data on that only allows an authorized user to access it. This centralization of data further protects against data leaks by reducing the number of copies that need to be protected.
Now what you know what data leakage is and how to prevent the leakage of data, you can learn more about insider threat management and cybersecurity with these articles and other resources.
Need to protect against data leakage to portable storage devices, printers, and other peripherals? Get started today with a free trial of AccessPatrol, CurrentWare’s Device Control Software Solution.
Are your employees putting sensitive data at risk by using consumer-grade cloud storage accounts? In this article you will learn the security risks of shadow IT cloud platforms (“bring your own cloud”), multiple cloud DLP tips, and how to block employees from accessing Dropbox, Google Drive, and other consumer-grade cloud storage platforms.
The damage that trusted insiders can cause is extraordinary. According to the 2020 Ponemon Institute Cost of Insider Threats report the average cost per insider incident was a staggering $11.5 million in 2020. Follow these tips to protect your company’s sensitive data against theft, misuse, and loss from malicious and negligent insider threats
Are you concerned about the damage a terminated employee could cause with sensitive corporate information, account passwords, and other proprietary data? Follow these 5 data security tips to protect your sensitive data against insider threats when offboarding employees.
Cookie | Duration | Description |
---|---|---|
__cfruid | session | Cloudflare sets this cookie to identify trusted web traffic. |
cookielawinfo-checkbox-advertisement | 1 year | Set by the GDPR Cookie Consent plugin, this cookie is used to record the user consent for the cookies in the "Advertisement" category . |
cookielawinfo-checkbox-analytics | 11 months | This cookie is set by GDPR Cookie Consent plugin. The cookie is used to store the user consent for the cookies in the category "Analytics". |
cookielawinfo-checkbox-functional | 11 months | The cookie is set by GDPR cookie consent to record the user consent for the cookies in the category "Functional". |
cookielawinfo-checkbox-necessary | 11 months | This cookie is set by GDPR Cookie Consent plugin. The cookies is used to store the user consent for the cookies in the category "Necessary". |
cookielawinfo-checkbox-others | 11 months | This cookie is set by GDPR Cookie Consent plugin. The cookie is used to store the user consent for the cookies in the category "Other. |
cookielawinfo-checkbox-performance | 11 months | This cookie is set by GDPR Cookie Consent plugin. The cookie is used to store the user consent for the cookies in the category "Performance". |
JSESSIONID | session | The JSESSIONID cookie is used by New Relic to store a session identifier so that New Relic can monitor session counts for an application. |
LS_CSRF_TOKEN | session | Cloudflare sets this cookie to track users’ activities across multiple websites. It expires once the browser is closed. |
OptanonConsent | 1 year | OneTrust sets this cookie to store details about the site's cookie category and check whether visitors have given or withdrawn consent from the use of each category. |
viewed_cookie_policy | 11 months | The cookie is set by the GDPR Cookie Consent plugin and is used to store whether or not user has consented to the use of cookies. It does not store any personal data. |
Cookie | Duration | Description |
---|---|---|
__cf_bm | 30 minutes | This cookie, set by Cloudflare, is used to support Cloudflare Bot Management. |
_zcsr_tmp | session | Zoho sets this cookie for the login function on the website. |
Cookie | Duration | Description |
---|---|---|
_calendly_session | 21 days | Calendly, a Meeting Schedulers, sets this cookie to allow the meeting scheduler to function within the website and to add events into the visitor’s calendar. |
_gaexp | 2 months 11 days 7 hours 3 minutes | Google Analytics installs this cookie to determine a user's inclusion in an experiment and the expiry of experiments a user has been included in. |
Cookie | Duration | Description |
---|---|---|
_ga | 2 years | The _ga cookie, installed by Google Analytics, calculates visitor, session and campaign data and also keeps track of site usage for the site's analytics report. The cookie stores information anonymously and assigns a randomly generated number to recognize unique visitors. |
_ga_GY6RPLBZG0 | 2 years | This cookie is installed by Google Analytics. |
_gcl_au | 3 months | Provided by Google Tag Manager to experiment advertisement efficiency of websites using their services. |
_gid | 1 day | Installed by Google Analytics, _gid cookie stores information on how visitors use a website, while also creating an analytics report of the website's performance. Some of the data that are collected include the number of visitors, their source, and the pages they visit anonymously. |
CONSENT | 2 years | YouTube sets this cookie via embedded youtube-videos and registers anonymous statistical data. |
Cookie | Duration | Description |
---|---|---|
_opt_expid | past | Set by Google Analytics, this cookie is created when running a redirect experiment. It stores the experiment ID, the variant ID and the referrer to the page that is being redirected. |
IDE | 1 year 24 days | Google DoubleClick IDE cookies are used to store information about how the user uses the website to present them with relevant ads and according to the user profile. |
NID | 6 months | NID cookie, set by Google, is used for advertising purposes; to limit the number of times the user sees an ad, to mute unwanted ads, and to measure the effectiveness of ads. |
test_cookie | 15 minutes | The test_cookie is set by doubleclick.net and is used to determine if the user's browser supports cookies. |
VISITOR_INFO1_LIVE | 5 months 27 days | A cookie set by YouTube to measure bandwidth that determines whether the user gets the new or old player interface. |
YSC | session | YSC cookie is set by Youtube and is used to track the views of embedded videos on Youtube pages. |
yt-remote-connected-devices | never | YouTube sets this cookie to store the video preferences of the user using embedded YouTube video. |
yt-remote-device-id | never | YouTube sets this cookie to store the video preferences of the user using embedded YouTube video. |
yt.innertube::nextId | never | This cookie, set by YouTube, registers a unique ID to store data on what videos from YouTube the user has seen. |
yt.innertube::requests | never | This cookie, set by YouTube, registers a unique ID to store data on what videos from YouTube the user has seen. |
Cookie | Duration | Description |
---|---|---|
_dc_gtm_UA-6494714-6 | 1 minute | No description |
_gaexp_rc | past | No description available. |
34f6831605 | session | No description |
383aeadb58 | session | No description available. |
663a60c55d | session | No description available. |
6e4b8efee4 | session | No description available. |
c72887300d | session | No description available. |
cookielawinfo-checkbox-tracking | 1 year | No description |
crmcsr | session | No description available. |
currentware-_zldp | 2 years | No description |
currentware-_zldt | 1 day | No description |
et_pb_ab_view_page_26104 | session | No description |
gaclientid | 1 month | No description |
gclid | 1 month | No description |
handl_ip | 1 month | No description available. |
handl_landing_page | 1 month | No description available. |
handl_original_ref | 1 month | No description available. |
handl_ref | 1 month | No description available. |
handl_ref_domain | 1 month | No description |
handl_url | 1 month | No description available. |
handl_url_base | 1 month | No description |
handlID | 1 month | No description |
HandLtestDomainName | session | No description |
HandLtestDomainNameServer | 1 day | No description |
isiframeenabled | 1 day | No description available. |
m | 2 years | No description available. |
nitroCachedPage | session | No description |
organic_source | 1 month | No description |
organic_source_str | 1 month | No description |
traffic_source | 1 month | No description available. |
uesign | 1 month | No description |
user_agent | 1 month | No description available. |
ZCAMPAIGN_CSRF_TOKEN | session | No description available. |
zld685336000000002056state | 5 minutes | No description |