Recent high-profile data breaches have compromised the personal information of hundreds of millions of individuals. Reports indicate a concerning rise in both the scale and frequency of such incidents. Additionally, there are two distinct types of breaches:
Public Breaches: These are incidents that are widely reported and known to the public.
Silent Breaches: These occur without public disclosure, as the stolen data is not leaked on the Dark Web but is instead exploited by attackers for personal gain, often going undetected by victims.
For instance, in April 2019, Have I Been Pwned identified and reported 8 new public breaches, highlighting the ongoing threat to data security.
What are the most common causes of a data breach?
Weak or Stolen Credentials (Passwords): Weak passwords or stolen login details remain one of the easiest ways for attackers to gain unauthorized access.
Unpatched Security Vulnerabilities: Outdated systems or software with known vulnerabilities are prime targets for exploitation.
Application-Level Vulnerabilities: Flaws in applications, such as insecure code or APIs, can be exploited by attackers.
Misconfigured Networks or Infrastructure: Improperly configured servers, cloud storage, or network settings can leave systems exposed.
Social Engineering: Tactics like phishing or manipulation trick individuals into revealing sensitive information.
Human Error or Negligence: Accidental actions, such as sending sensitive data to the wrong recipient, can lead to breaches.
Insider Threats: Malicious or careless actions by employees or contractors can result in data exposure.
Mistakes and errors are inevitable, but learning from them and avoiding repetition is critical. The key takeaway is:
Security isn’t a one-time effort but an ongoing process that requires continuous effort in monitoring, evaluation, and improvement to stay ahead of evolving threats.
No system is ever 100% secure—there will always be potential vulnerabilities. The goal is to continuously identify, patch, and improve security measures.
Remember: You have to be lucky every time to prevent a breach, whereas an attacker only needs to be lucky once.
Detailed Implementation Guide for Security Strategies
Asset Management: Know Your Attack Surface
"If You're Not Doing Continuous Asset Management, You're Not Doing Security." — Daniel Miessler
Map Your External Surface
OSINT Tools
Collecting data about your company using open-source intelligence (OSINT) tools is critical for security. OSINT plays a vital role in providing comprehensive insights into your organization at a relatively low cost. By leveraging publicly available sources—such as social media, domain records, and code repositories—alongside internal organizational data, OSINT helps identify vulnerabilities and external exposures.
Identify and Assess Critical Assets
The critical parts of the application and its data must be audited for security vulnerabilities. For auditing, you can either hire an internal team or outsource the task to a reputable security service provider. Regular security assessments of these critical components are essential. Generally, different parts of an application have different types of vulnerabilities. It is important to identify these components and assess the risks associated with them. The overall security strength of an application is determined by the security of its weakest link. Since the public-facing parts of the application are often the most vulnerable, the external surface should always be prioritized.
- Risk Prioritization: Audit critical applications and data for vulnerabilities
- Key Focus: Public-facing components (e.g., APIs, login portals)
- Regular Assessments: Conduct internal audits or outsource to reputable security firms
"The security strength is determined by the weakest part of the application."
Continuous Monitoring
- Automated Tools: Use Shodan/Censys for internet-wide server monitoring
- Pro Tip: Implement Slack bots to notify teams of new subdomains or exposed assets
Secure Code Development & Deployment
Manual testing for your application is crucial, but it becomes impractical when thousands of lines of code are deployed daily. To ensure a comprehensive security approach, you must integrate security components into your development cycle. This includes both static and dynamic code reviews.
Secure Development Cycle with Security Components:
- Developers write code.
- Code is passed through a static code analyzer.
- Code is scanned for sensitive information disclosure.
- Code is checked using an open-source vulnerability scanner.
- Code is deployed to the staging server.
- Manual testing is conducted using proxy tools (with a checklist tailored to business requirements).
- Code is moved to PRODUCTION.
Audit Public JavaScript Files
Implementing a static code analyzer in your pipeline is essential. These tools analyze the source code to identify vulnerabilities, coding errors, and potential security risks.
Monitor Organizational Secrets
It is crucial to define keywords related to your organization, including both external and internal domains used by your team. These keywords can help identify sensitive information that may have been publicly disclosed. The following blog post outlines common keywords used by bug bounty hunters or hackers to uncover sensitive information about organizations. Monitor what your employees post on public channels such as GitHub, Pastebin, and similar platforms. You can use the following tools to scan your codebase for any hardcoded sensitive information.
Detect Public Exposure
Breach Alerts
- Subscribe to Services: Use Have I Been Pwned (HIBP) and Firefox Monitor with security@company.com.
Internal Security Practices - Detailed Guide
Enforce 2FA/MFA
Enable Two-Factor Authentication (2FA) on all third-party services you use, including GSuite, GitHub, GitLab, and cloud service providers like AWS, Azure, and Google Cloud.
The following services must have 2FA enabled for everyone at the company:
- Google Services: G Suite, Gmail, etc.
- Code Repositories: GitHub, GitLab, Atlassian
- Cloud Service Providers: AWS, Google Cloud, Azure, Alibaba Cloud, etc.
- Company's Official Social Media Platforms: Twitter, Facebook, YouTube, etc.
Mandatory for: GSuite, GitHub, AWS, social media accounts.
Secure Onboarding/Offboarding
Secure onboarding and offboarding processes are critical for any organization.
- Onboarding: When a new employee joins an organization, several behind-the-scenes activities must be executed to ensure a smooth and efficient onboarding experience. While many of these tasks are administrative and handled by HR, cybersecurity-related steps are equally important—yet often overlooked.
- Offboarding: Companies typically excel at monitoring and controlling employees' technology use during their tenure. However, they often fail to adequately address vulnerabilities in the offboarding process, which can expose organizational data and resources. To mitigate risks, it is essential to revoke access to internal systems immediately and rotate any credentials the employee may have had access to.
Employee Training
Comprehensive security training is essential for every individual within the organization, regardless of their role or department. This training ensures that all employees understand the importance of cybersecurity, recognize potential threats, and follow best practices to protect sensitive data and systems.
Sudo for Engineers
Security training for engineers - A guide to security basics for those who build software.
Employee's Personal Security Checklist
Security Implementation Tools
- Personal Security: GitHub's personal-security-checklist for device/account hardening.
- Internal Communication: PrivateBin for sharing credentials (self-hosted, encrypted).
- Environment Access: VPN-Only Access using Pritunl for staging/dev servers.
Cloud Security Best Practices
- AWS: Enable MFA, restrict console logins by IP, audit IAM policies.
- Tool: Scout2 (AWS security auditing).
Team Engagement & Monitoring
- Security Champions: Foster a culture of ownership within teams.
- Monitoring Tools: Nagios (log monitoring), Kibana (visualization), Gauntlt (rugged testing).
Final Takeaways
- Security is Continuous: Regular audits, employee training, and proactive monitoring are non-negotiable.
- No System is 100% Secure: Focus on rapid detection, response, and learning from incidents.
You have to be lucky every time; attackers only need to be lucky once.
