Search
Close this search box.
Categories
Data Protection

Data breach protection: Cybersecurity is not the focus

According to a recent study by Tanium, an American cybersecurity and systems management company, 79% of companies only invest in cybersecurity after a data breach. Which shows that data breach protection is not a priority for many businesses.

This is a worrying statistic, as it leaves companies vulnerable to attack and can cost millions of dollars.

However, there are things that organizations can do to strengthen cybersecurity defenses and prevent cybercriminals from gaining access to companies’ corporate systems.

Data breach protection: why should prevention be a priority in your company?

Data breaches are an increasingly common threat to businesses. With the increasing amount of information stored on corporate systems, cybercriminals have an even greater interest in carrying out attacks.

The consequences of a data breach can be severe. Digital criminals can steal confidential information or damage a company’s reputation.

Therefore, it is critical that data breach protection is a priority for your company.

Also according to the Tanium study, 92% of companies have suffered an attack or data breach, 73% in the last year alone.

The survey shows that criminal cyber activity continues to grow: 92% of respondents admitted to having suffered an attack or data breach, with almost three-quarters (73%) having done so during the past year.

In fact, the situation is getting worse for businesses, with more than two-thirds of respondents (69%) admitting that threats are on the rise and the expectation for 2022 is that there will be the highest number of attacks ever.

Thales 2021 Data Threat Report

Investment in cybersecurity: The best way to avoid a data breach

The best way to ensure protection against data breaches is to take preventive measures. Companies should invest in cybersecurity to strengthen their defenses against attacks.

There are several things that companies can do to protect their data and reduce the chances of a data breach:

Implement data breach protection measures for cyber security

Companies must implement data breach protection measures for their systems and data. These measures include using firewalls, encrypting data, and managing access to systems.

Companies should train their employees on the cybersecurity measures that should be adopted. Employees who are aware of the importance of cybersecurity are less likely to make mistakes that could compromise the security of company data.

Create a business continuity plan

Companies should also have a business continuity plan to ensure that business can continue after a data breach. The plan should include measures to restore lost data and ensure that employees can continue their work without problems.

In addition to the business continuity plan, companies should have a plan for communicating the data breach to customers and other stakeholders. This plan should include a protocol for notifying affected people, as well as a strategy for dealing with the media.

Keep the systems up to date with the latest software versions

This will allow you to benefit from the latest bug fixes and security updates, and make it harder for cybercriminals to exploit old vulnerabilities. Software updates usually include new and better features that make your systems more efficient.

Create a backup strategy to prevent data breaches

Backups are extremely important to recover lost data in the event of a data breach. Having regular backups will allow you to quickly get back to normal after an attack, without compromising business continuity.

Make sure that your backups are protected against unauthorized access and encrypted to prevent attackers from reading them.

Implement encryption solutions

This prevents hackers from accessing or changing your data, even if they manage to obtain it. Encryption is particularly useful for protecting sensitive information such as credit card numbers or financial details.

Encryption is useful for protecting backups and files in transit, such as e-mails. Make sure that all your communication tools are encrypted, including your e-mail server, instant messaging application, and VoIP tools.

Monitor network traffic to detect a data breach

This will allow you to detect suspicious activity on your network and take steps to correct it before it turns into a data breach. Monitoring network traffic can help identify weak points in your system that need to be fixed.

The Future of Data Security

Although cyber threats continue to evolve, companies are becoming more aware of the risks involved and are making investments in cyber security.

The survey showed that 79% of companies have already been a victim of a data breach and that they are willing to invest more in security to prevent future attacks.

Companies are also becoming more aware of the importance of training their employees on cybersecurity risks and how to avoid them.

Data security is a complex issue, but it is important that companies are aware of the risks involved and are willing to invest the time and money necessary to protect their systems.

CipherTrust: Your company’s cybersecurity against data breaches in real time and with secure encryption

O
CipherTrust
is the ideal solution against ransomware attacks. In a simple, comprehensive and effective way, the solution
CipherTrust
provides capabilities to secure and control access to databases, files, and containers – and can protect assets located in cloud, virtual, big data, and physical environments.

With CipherTrust, you can protect your company’s data and anonymize your sensitive assets, ensuring security for your company and avoiding future problems with data leakage.

To handle the complexity of where data is stored, CipherTrust Data Security Platform provides strong capabilities to protect and control access to sensitive data in databases, files, and containers. Specific technologies include:

CipherTrust Transparent Encryption

Encrypt data in on-premises, cloud, database, file, and Big Data environments with comprehensive access controls and detailed data access audit logging that can prevent the most malicious attacks.

CipherTrust Database Protection

It provides transparent column-level encryption of structured and confidential data that resides in databases such as credit card, social security numbers, national identification numbers, passwords, and e-mail addresses.

CipherTrust Application Data Protection

It offers APIs for developers to quickly add encryption and other cryptographic functions to their applications, while SecOps controls the encryption keys.

CipherTrust Tokenization

It offers application-level data tokenization services in two convenient solutions that provide customer flexibility – Token without Vault with dynamic policy-based data masking and Tokenization in Vault.

CipherTrust Batch Data Transformation

Provides static data masking services to remove sensitive information from production databases so that compliance and security issues are alleviated when sharing a database with a third party for analysis, testing, or other processing.

CipherTrust Manager

It centralizes keys, management policies, and data access for all CipherTrust Data Security Platform products and is available in FIPS 140-2 Level 3 compliant physical and virtual formats.

CipherTrust Cloud Key Manager

It offers its own key lifecycle management (BYOK) for many cloud infrastructure, platform, and software-as-a-service providers.

CipherTrust KMIP Server

It centralizes key management for the Key Management Interoperability Protocol (KMIP) commonly used in storage solutions.

CipherTrust TDE Key Manager

Centralizes key management for encryption found in Oracle, SQL and Always Encrypted SQL.

The portfolio of data protection products that make up the CipherTrust Data Security Platform solution enables companies to protect data at rest and in motion across the entire IT ecosystem and ensures that the keys to this information are always protected and only under your control.

It simplifies data security, improves operational efficiency, and accelerates compliance time. Regardless of where your data resides.

The CipherTrust platform ensures that your data is secure, with a wide range of proven, industry-leading products and solutions for deployment in data centers, either those managed by cloud service providers (CSPs) or managed service providers (MSPs), or as a cloud-based service managed by Thales, a leading security company.

Portfolio of tools that ensure data protection against data breaches

With data protection products from the CipherTrust Data Security Platform, your company can:

Strengthen security and compliance

In addition to ensuring investment in cybersecurity, CipherTrust data protection products and solutions address the demands of a range of security and privacy requirements, including electronic identification, authentication, and trust, Payment Card Industry Data Security Standard (PCI DSS), General Data Protection Law (LGPD)among other compliance requirements.

Optimizes team and resource efficiency in fighting data breaches

CipherTrust Data Security Platform offers the broadest support for data security use cases in the industry, with products designed to work together, a single line for global support, a proven track record of protecting against evolving threats, and the industry’s largest ecosystem of data security partnerships.

With a focus on ease of use, APIs for automation and responsive management, the CipherTrust Data Security Platform solution ensures your investment in cybersecurity by enabling your teams to quickly implement, secure and monitor the protection of your business.

In addition, professional services and partners are available for design, implementation, and training assistance to ensure fast and reliable implementations with minimal staff time.

Reduces total cost of ownership

CipherTrust Data Security Platform’s data protection portfolio offers a broad set of data security products and solutions that can be easily scaled, expanded for new use cases, and have a proven track record of protecting new and traditional technologies.

With CipherTrust Data Security Platform, companies can prepare their cybersecurity investment for the future while reducing operational costs and capital expenditures.

About EVAL

EVAL has been developing projects in the financial, health, education and industry segments for over 18 years. Since 2004, we have offered Authentication, Electronic and Digital Signature and Data Protection solutions. Currently, we are present in the main Brazilian banks, health institutions, schools and universities, and different industries.

With value recognized by the market, EVAL’s solutions and services meet the highest regulatory standards of public and private organizations, such as SBIS, ITI, PCI DSS, and LGPD. In practice, we promote information security and compliance, increase companies’ operational efficiency, and reduce costs.

Innovate now, lead always: get to know Eval’s solutions and services and take your company to the next level.

Eval safety is value.

Categories
Data Protection

Dangers of public WiFi: data of 2 million users leaked

In our connected world, using free public Wi-Fi has become a daily routine for some people. But secure and reliable connections are not always what they seem.

Public Wi-Fi access points are easy targets for cybercriminals who can use them to invade your privacy and steal your data.

This is what happened with WSpot, a WiFi management software company based in Brazil. It exposed data from about 2 million user companies, 5% of its customer base was affected by this leak.

About the leak and the relationship with public WiFi

Security research firm SafetyDetectives discovered the leak and warned that WSpot had an incorrectly configured Amazon Web Services S3 asset. Supposedly, the vulnerability found was unprotected and open to public access, which generated 10 GB of visitor data exposure.

About 226,000 files were exposed in this data leak. The leaked information includes personal details of at least 2.5 million users who have connected to the WSpot client’s public WiFi networks.

In addition, the information exposed included details of individuals who accessed the companies WiFi service, leaking information such as name, home address, email and taxpayer registration numbers, and plain-text login credentials created by users when getting registered to the service.

The company explained that the leak was caused by a lack of “standardization in information management”, which was stored in a specific folder. The company also noted that it has been dealing with the problem since SafetyDetectives notified it and the technical procedures were completed on November 18.

Why can using public Wi-Fi connections be dangerous?

Among the main dangers of public Wi-Fi are the risks of data breaches and malware infections. In the first scenario, cybercriminals can intercept the information you transmit over an unprotected connection.

In the second scenario, digital criminals may present you with an imitation of a legitimate website, tricking you into downloading malware.

Using an insecure public Wi-Fi network offers cybercriminals a great opportunity. Here is what makes it a vulnerable wireless network:

  • No or weak password protection;
  • Improperly configured Wi-Fi routers;
  • Outdated router software;
  • Many careless users;
  • Logging into a fake Wi-Fi access point.

By 2023, there will be almost 628 million public Wi-Fi access points. And as their number increases, so do the potential dangers. Let’s see what you risk by connecting to a free public Wi-Fi network.

What are the risks of using public WiFi?

Those who don’t know how to use public Wi-Fi safely can quickly find themselves in trouble. To avoid this, you should always keep your guard up against the following dangers of open wireless networks.

Identity Theft

Identity theft is a cyber crime with the primary goal of illegally obtaining someone’s data.

Most commonly, cybercriminals use public Wi-Fi hotspots to steal people’s credit card information and commit financial fraud. With enough information about an individual, criminals can apply for loans, withdraw money, make purchases, and commit other crimes, all in their name.

Data breach

Using public Wi-Fi safely is essential to avoid data breaches, which happen when criminals illegally access private information. While identity theft primarily involves financial information, data breaches can affect any type of information you store on your device.

If you don’t know how to use public Wi-Fi safely, cybercriminals can steal your photos, videos, documents, and contacts, among others.

Malware Infection

Using public Wi-Fi makes you an easy target for browser hijackers who distribute malware to unsuspecting surfers. You may just be opening a news website when a supposedly innocent-looking pop-up ad appears on your screen. What you don’t know is that by accidentally clicking on it, you get dangerous software directly on your phone or laptop.

How to stay safe on public WiFi networks

Here’s what you need to do if you want to minimize the security risks of public Wi-Fi:

Use a VPN on a public WiFi network

To stay secure on a public Wi-Fi network, use a Virtual Private Network (VPN) application. The application hides your IP address and encrypts the information you send online, making it unreadable to third parties.

Do not access or send your confidential data when accessing a public WiFi

You don’t want your sensitive data to be intercepted, so make sure you don’t expose any. Forget about online banking, shopping, and remote work when connecting to a public Wi-Fi.

Do not use any application that may contain confidential data. The sad truth is that many applications have security holes, so anything you do in them can be visible to hackers.

Use an antivirus

Unfortunately, an antivirus program does not save your personal data from interception, but it can protect your device from various malware. This includes malicious programs that hackers secretly send to your phone or laptop on a public Wi-Fi network.

Turn on the firewall when accessing via public WiFi

Enabling the firewall can save your laptop from suspicious data packets. Simply put, a firewall analyzes data traffic and protects your device from unauthorized access. So whenever you connect to a public Wi-Fi network, don’t forget to activate the protection.

There is no magic solution for data security. While website owners and retailers should clearly up their game in protecting our privacy, we also need to do our part to at least eliminate the easiest fruit for hackers.

Fortunately, with just a little attention and these simple steps, you can protect your data and still enjoy the convenience of public Wi-Fi.

Invest in data protection in 2022 and beyond.

The CipherTrust Data Security Platform solution allows companies to protect their structure against attacks even with access via public WiFi.

According to IDC, more than 175 zetabytes of data will be created by 2025, and today more than half of all corporate data is stored in the cloud.

To handle the complexity of where data is stored, CipherTrust Data Security Platform provides strong capabilities to protect and control access to sensitive data in databases, files, and containers. Specific technologies include:

CipherTrust Transparent Encryption

Encrypt data in on-premises, cloud, database, file, and Big Data environments with comprehensive access controls and detailed data access audit logging that can prevent the most malicious attacks.

CipherTrust Database Protection

It provides transparent column-level encryption of structured and confidential data that resides in databases such as credit card, social security numbers, national identification numbers, passwords, and e-mail addresses.

infográfico sobre a plataforma de proteção de dados CipherTrust

CipherTrust Application Data Protection

It offers APIs for developers to quickly add encryption and other cryptographic functions to their applications, while SecOps controls the encryption keys.

CipherTrust Tokenization

It offers application-level data tokenization services in two convenient solutions that provide customer flexibility – Token without Vault with dynamic policy-based data masking and Tokenization in Vault.

CipherTrust Batch Data Transformation

Provides static data masking services to remove sensitive information from production databases so that compliance and security issues are alleviated when sharing a database with a third party for analysis, testing, or other processing.

CipherTrust Manager

It centralizes keys, management policies, and data access for all CipherTrust Data Security Platform products and is available in FIPS 140-2 Level 3 compliant physical and virtual formats.

CipherTrust Cloud Key Manager

It offers its own key lifecycle management (BYOK) for many cloud infrastructure, platform, and software-as-a-service providers.

CipherTrust KMIP Server

It centralizes key management for the Key Management Interoperability Protocol (KMIP) commonly used in storage solutions.

CipherTrust TDE Key Manager

Centralizes key management for encryption found in Oracle, SQL and Always Encrypted SQL.

The portfolio of data protection products that make up the CipherTrust Data Security Platform solution enables companies to protect data at rest and in motion across the entire IT ecosystem and ensures that the keys to this information are always protected and only under your control.

It simplifies data security, improves operational efficiency, and accelerates compliance time. Regardless of where your data resides.

The CipherTrust platform ensures that your data is secure, with a wide range of proven, industry-leading products and solutions for deployment in data centers, either those managed by cloud service providers (CSPs) or managed service providers (MSPs), or as a cloud-based service managed by Thales, a leading security company.

Tool portfolio that guarantees data protection also with access via public WiFi

With data protection products from the CipherTrust Data Security Platform, your company can:

Strengthen security and compliance even when using a public WiFi

CipherTrust data protection products and solutions address the demands of a range of security and privacy requirements, including electronic identification, authentication and trust, Payment Card Industry Data Security Standard (PCI DSS), General Data Protection Act (LGPD), and other compliance requirements.

Optimizes team and resource efficiency

CipherTrust Data Security Platform offers the broadest support for data security use cases in the industry, with products designed to work together, a single line for global support, a proven track record of protecting against evolving threats, and the industry’s largest ecosystem of data security partnerships.

With a focus on ease of use, APIs for automation, and responsive management, the CipherTrust Data Security Platform solution ensures that your teams can quickly deploy, secure, and monitor the protection of your business.

In addition, professional services and partners are available for design, implementation, and training assistance to ensure fast and reliable implementations with minimal staff time.

Reduces total cost of ownership

CipherTrust Data Security Platform’s data protection portfolio offers a broad set of data security products and solutions that can be easily scaled, expanded for new use cases, and have a proven track record of protecting new and traditional technologies.

With CipherTrust Data Security Platform, companies can prepare their investments for the future while reducing operating costs and capital expenditures.

About Eval

EVAL has been developing projects in the financial, health, education and industry segments for over 18 years. Since 2004, we have offered Authentication, Electronic and Digital Signature and Data Protection solutions. Currently, we are present in the main Brazilian banks, health institutions, schools and universities, and different industries.

With value recognized by the market, EVAL’s solutions and services meet the highest regulatory standards of public and private organizations, such as SBIS, ITI, PCI DSS, and LGPD. In practice, we promote information security and compliance, increase companies’ operational efficiency, and reduce costs.

Innovate now, lead always: get to know Eval’s solutions and services and take your company to the next level.

Eval, safety is value.

Categories
Data Protection

What to do in the event of a data breach?

The information most compromised in a data breach is personal. For example, credit card numbers, social security numbers and medical records. Corporate information includes customer lists, manufacturing processes and software source code.

Unauthorized access to this information characterizes a clear data breach, resulting in identity theft or violation of compliance requirements vis-à-vis the government or regulatory sectors. Incidents like this lead to companies facing fines and other civil litigation, not to mention the loss of money and credibility.

The problem is that any company can suffer cyber attacks these days. No matter how many preventive actions are taken, the big question that arises – and which should be a priority for organizations of different sizes and sectors – is: what to do in the event of a data breach?

Recently there was a huge leak in which data from approximately 800 million email accounts was stolen. By the way, if you want to check whether your email data has also been stolen, go to: https://haveibeenpwned.com.

Main causes of data breaches

It’s common to think of a data breach as someone attacking a corporate website and stealing confidential information. However, not everything happens that way.

However, it only takes an unauthorized employee to view a customer’s personal information on an authorized computer screen to constitute a data breach.

Data is stolen or breached for various reasons:

  • Weak passwords;
  • Software patches that are exploited;
  • Stolen or lost computers and mobile devices.
  • Users who connect to unauthorized wireless networks;
  • Social engineering, especially phishing e-mail attacks;
  • Malware infections.

Criminals can use the credentials obtained through their attacks to enter confidential systems and records – access that often goes undetected for months, if not indefinitely.

In addition, attackers can target their attacks through business partners to gain access to large organizations. Such incidents usually involve hackers compromising less secure companies in order to gain access to the main target.

Prevention is still the best medicine

Ensuring a completely secure environment is a major challenge.

Today we have various resources and technologies that can considerably minimize the risk of attacks. However, this is a very dynamic environment in different aspects that make cyber attacks possible. Prevention is therefore the best way forward.

In short, the most reasonable means of preventing data breaches involve security practices and common sense. This includes well-known basics:

  • Carry out continuous vulnerability and penetration tests;
  • Apply malware protection;
  • Use strong passwords;
  • Apply the necessary software patches to all systems;
  • Use encryption on confidential data.

Additional measures to prevent breaches and minimize their impact include well-written security policies for employees, as well as ongoing training to promote them.

In addition, there must be an incident response plan that can be implemented in the event of an intrusion or breach. It needs to include a formal process for identifying, containing and quantifying a security incident.

How to Deal with the Consequences of a Data Breach

Considering that a data breach can happen in any company and at any time, an action plan is the best tactic.

The most basic problem is that people still don’t see cyber attacks as inevitable. After all, they believe their defenses are good enough or they don’t think they’ll be targeted.

Another problem is that organizations don’t understand the true value of effective incident response plans. It can take weeks for them to understand what has happened.

The recommended steps during a data breach are:

  • Identifying what happens;
  • Meeting of all related sectors;
  • Getting things under control;
  • Reduced side effects;
  • External communication management;
  • Recovery of business operations;
  • Identification of lessons learned;
  • Process improvement.

The priority is to stop the breach of confidential data, thus ensuring that all the necessary resources are available to prevent any further loss of information.

 
Identification

Understand what happened – how the attackers got in or how the data was leaked – and also make sure there is no leak.

Knowing what your situation is, defining the position to adopt and being able to take the necessary actions from that position are the first steps to take.

Containment

Did the strikers come from outside? Ensuring that nothing else leaves the company should also be one of the initial stages of incident response. The next actions will be carried out from this point.

Eradication

Deal with the problem by focusing on removing and restoring the affected systems.

Ensure that steps are taken to remove malicious material and other illicit content, for example by performing a complete hard disk recreation and scanning the affected systems and files with anti-malware software.

Communication

The next step is to align the discourse when it comes to external communication.

The IT policy must include care related to social networks and the organization’s other communication channels. After all, all the information related to the problem should come out of one place, always aligned with the actions taken by the company.

It is very common these days to include the organization’s legal department in communication issues and in dealing with situations with clients and official bodies.

On the saferweb website, which is a civil association focused on promoting and defending human rights on the Internet in Brazil, you can find a list of cybercrime police stations where you can file a complaint.

In addition to official bodies, remember to notify those affected by the leak, whether they are employees, suppliers or even customers.

Finally, don’t forget that the General Data Protection Act (LGPD) also deals with this issue.

Lessons learnedfrom the Data Breach

If your company can solve the data breach problem and recover quickly, then it is on the right track to restoring business and minimizing the impact.

However, in some cases, the problem reaches the press and takes on greater proportions, affecting the company’s reputation and business.

Follow our tips and the examples of other organizations that have faced similar situations in order to understand what went wrong and make sure you have the best tactics to avoid a recurrence.

Another important tip is to subscribe to our newsletter and keep up to date with the latest news!

About Eval

EVAL has been developing projects in the financial, health, education and industry segments for over 18 years. Since 2004, we have offered Authentication, Electronic and Digital Signature and Data Protection solutions. Currently, we are present in the main Brazilian banks, health institutions, schools and universities, and different industries.

With value recognized by the market, EVAL’s solutions and services meet the highest regulatory standards of public and private organizations, such as SBIS, ITI, PCI DSS, and LGPD. In practice, we promote information security and compliance, increase companies’ operational efficiency, and reduce costs.

Innovate now, lead always: get to know Eval’s solutions and services and take your company to the next level.

Eval, safety is value.