How Can Breaches like Capital One Be Prevented?
The Capital One breach of 2019 is just the latest incident in a long line of data breaches this year. But it’s a great way to see what’s being done wrong in corporate digital security.
As troubling as these data breaches are, it’s important we learn from this incident. We’ll give you a quick refresher on how the Capital One breach went down. Then, we’ll offer some important lessons to take from the breach that we can all apply to our own security practices.
How the Capital One Breach Happened
We’ve already covered how the Capital One breach happened, but here’s a quick recap:
On July 29th, 2019, Capital One announced that their system had been breached. A single hacker accessed the personal information of more than 100 million accounts. The current estimate of damages for Capital One is upwards of $150 million. Damage to Capital One’s reputation is harder to quantify, but given how the data breach happened, it isn’t good.
We think Capital One could have done many different things, but these three lessons are most important.
1. The Importance of Zero Trust
We’ve already highlighted how a Zero Trust system would have helped prevent the Equifax breach of 2017. The same case applies here. Capital One only had a single person in charge of their firewall.
This single person was responsible for something that is incredibly complicated and requires complex maintenance and extensive testing. You’re relying on that one person to do a perfect job every single time. And unlike computers, humans make mistakes.
In a Zero Trust system, this doesn’t happen. That one employee would have been a part of a team assigned to maintain the firewall. A Zero Trust system makes sure that one person isn’t responsible for everything. Plus, it ensures proper oversight of employees to catch mistakes before they become bigger problems!
2. Layering Security
Zero Trust would have also prevented Capital One for relying too much on Amazon Web Services (AWS) to provide most of their security. Capital One was relying on a firewall and AWS. That’s only two layers of security for some of the company’s most sensitive data. Yikes!
Too much reliance on a single vendor introduces risk since there is no way to ensure full controls over who might be working for (or who has worked with) the vendor you’ve chosen. The hacker, Paige Thompson, was a former AWS employee.
AWS said she had no privileged information that would have granted her access. But her experience at the major cloud provider still means that Thompson had an intimate understanding of how AWS works. That understanding was good enough to breach the system regardless of whether or not she had privileged information.
3. File Encryption
Layers of security are important, especially for companies that are keeping sensitive financial information. But there’s one more particular layer Capital One could have used that would have prevented the breach from being successful:
Adding this extra layer and having exclusive control over the encryption key would have protected Capital One from Thompson’s breach.
In a Zero Trust system, Capital One would have encrypted the files Thompson was trying to steal before even uploading them onto AWS. Capital One should have restricted the key access to a limited number of internal employees, rather than allowing a vendor full control of the encryption process.
Restricting privilege to the encryption key does two things:
· Limits the number of people who have access to the encryption keys
· Allows for more oversight over the people who have access to those keys
With the files encrypted on the AWS server, Thompson would not have been successful. Even if she breached the server, the encrypted files she would have been looking for would be useless without the key.
The Major Takeaways
Making the above structural choices would have saved the company’s reputation. Moreover, it would have also allowed them to identify and confirm that their files were secure, even if they were breached.
By diversifying reliance on a single vendor, better restricting key access to encrypted data, and using Zero Trust to provide oversight, the Capital One breach could have been easily prevented.
If you’d like to see more lessons we learned from current events, subscribe to our blog!