- This topic has 6 replies, 6 voices, and was last updated 2 years, 11 months ago by Weerada Trongtranonth.
-
AuthorPosts
-
-
2021-09-23 at 12:29 am #31568Tossapol PrapassaroParticipant
1.Provide a brief description of the story.
On March 21st, Jerimiah Fowler, a cyber security researcher, found a non-password protected database which contained more than 1 billion records from CVS health customers. Although those databases consisted of non-identifiable CVS Health metadata; however, if those data were traced to identify an individual by attackers, it could cause a huge disaster. He notified the CVS Health administrators and public access was restricted in the same day. Then CVS health worked with the vendor, investigating the cause of the data breach and finding a way to protect it.2.What is/are the impact of this data breach? Consequences of the data breach
The impact of these data breaches can impact both individuals and organizations. For the individual, if the attackers can identify individual information such as email, they can use phishing attacks and cross-reference other actions. For the organization, trust is essential for the relationship and engagement between the company and the customer. If the company can not provide privacy, confidentiality, and security about customer information, they will lose customer trust.3.How did the data breach occur?
It starts from logging and tracking customers’ activity from the website, which provides valuable analytical data. The customers inadvertently entered their email in the search bar together with the misconfiguration that publicly disclosed the database, so the data breach occurred.4.What should be the main cause of the data breach? Provide a brief explanation of the cause of data breach, such as phishing, ransomware, HIPAA violation, database misconfiguration, human error, third-party vendor error)?
The leading cause of these data breaches would be database misconfiguration and human error. They exposed the database publicly without concern that there is the possibility to see the configuration; therefore, there is a potential to identify individuals by using their visitor ID and session ID accompanied with inadvertently email address entering by the customer.5.How could you prevent this data breach attack?
They recommended to CVS that it should not be possible to enter email addresses or domain names to log in in the searches box. So, this could help them to avoid undesired data from being used. -
2021-09-23 at 12:55 pm #31597Navin PrasaiParticipant
From the report, the Data breach was commenced logging and tracking customers’ activity from the website. Multi-factor authentication, immediate law enforcement, and investigation should be started. The people who are affected by the data breach should be provided with identity protection and credit monitoring service
-
2021-09-23 at 11:44 pm #31607Tossapol PrapassaroParticipant
Thank you for your comments.
-
-
2021-09-25 at 9:16 pm #31645chanapongParticipant
Thanks for sharing about this case. I really agree with you that the company should have preventive measures on this incident, not blaming their customers for entering their email to the search bar. Well-design data security should be implemented to prevent this reoccur and the customers should receive guidance on what to do after this incident occurred.
-
2021-09-27 at 11:59 am #31680Hazem AbouelfetouhParticipant
Thank you for sharing. As I understood, CVS was collected data from all visitors not only users having an account! I would like to add that the main reason in my opinion is the CVS omission of their responsibility to audit their vendor procedures and training to avoid such an incident.
-
2021-09-29 at 8:55 pm #31719SaranathKeymaster
Thanks for sharing and all of your comments. Only few misconfigurations could create a large impact.
-
2021-10-07 at 1:58 am #31932Weerada TrongtranonthParticipant
Thanks for sharing. Even with non-identifiable data, Hackers also know how to trace back from quasi-identifying attributes or identity disclosure. In this case, The strong Security and privacy designed will be another way to prevent disaster from this event
-
-
AuthorPosts
You must be logged in to reply to this topic. Login here