“All data breaches are serious for those individuals and organizations concerned, but this breach is particularly concerning given the status of the affected parties. Data that is stolen during a breach will most likely end up for sale on the dark web, and this data is no different. The personal information of US citizens with top secret clearance for sale on the dark web is potentially disastrous and could attract attention from major criminal organizations or even hostile nation states. The individuals concerned should remain vigilant to the targeted spear phishing attacks and other types of cybercrime which could follow on from this. Organizations using authenticated online accounts need to be ever more vigilant to protect persons impacted by these breaches from account takeover and identity theft. Many organizations are looking to a more secure means of protecting accounts using a multi-layered approach to security. This includes the benefits of incorporating passive biometric solutions into their authentication process to truly verify it is the right user behind the account and not an intruder using the personal information stolen from breaches of this size and magnitude.”
“From a data privacy and compliance standpoint, this incident shows a disturbingly common pattern – apologize but blame it all on the subcontractors. Regardless of who actually made mistakes, the data controller – the organization entrusted to properly use and protect the data is always responsible.
“TigerSwan’s lengthy statement essentially says “we apologize, but it wasn’t our fault.” While the subcontractor may certainly share some blame, TigerSwan is still legally responsible for protecting data entrusted to them. Saying that their servers were never breached is irrelevant.”
“The potential damage from the TalentPen data leak makes damage from the unauthorized access of accounts pale in comparison. This disclosure could be extremely damaging to the individuals involved and highlights the very real need to fully assess your third parties. TigerSwan is as much at fault here as TalentPen. They chose to outsource this service and are accountable for TalentPen’s failures. The question I have is for TigerSwan – what where they doing to make sure TalentPen had adequate security controls and operational procedures in place?
Coming close on the heels of the BroadSoft leak ( https://www.engadget.com/2017/09/02/time-warner-cable-data-leak ), yet another third party leak due to failed security controls and operational procedures, should cause companies to wonder if their third parties have adequate operational procedures in place.”
“In this case, the data of thousands of job applicants, many who claimed “Top Secret” US government security clearance, was exposed by an Amazon server. The documents were found on an unsecure Amazon S3 bucket without password protection. Roughly 9,400 documents were exposed in this breach, highlighting the damaging effects of leaving critical data unprotected. This information was discovered in a folder labeled “resumes” that was in a visible location accessible by malicious parties. This breach highlights the importance of taking the guess work out of data security by employing protection at the file level, which ensures individual files are protected at all times.”
ISBuzz Team embodies the collaborative efforts of the dedicated staff at Information Security Buzz, converging a wide range of skills and viewpoints to present a unified, engaging voice in the information security realm. This entity isn't tied to a single individual; instead, it's a dynamic embodiment of a team diligently working behind the scenes to keep you updated and secure. When you read a post from ISBuzz Team, you're receiving the most relevant and actionable insights, curated and crafted by professionals tuned in to the pulse of the cybersecurity world. ISBuzz Team - your reliable compass in the fast-evolving landscape of information security
To provide the best experiences, we use technologies like cookies to store and/or access device information. Consenting to these technologies will allow us to process data such as browsing behavior or unique IDs on this site. Not consenting or withdrawing consent, may adversely affect certain features and functions.
Functional
Always active
The technical storage or access is strictly necessary for the legitimate purpose of enabling the use of a specific service explicitly requested by the subscriber or user, or for the sole purpose of carrying out the transmission of a communication over an electronic communications network.
Preferences
The technical storage or access is necessary for the legitimate purpose of storing preferences that are not requested by the subscriber or user.
Statistics
The technical storage or access that is used exclusively for statistical purposes.The technical storage or access that is used exclusively for anonymous statistical purposes. Without a subpoena, voluntary compliance on the part of your Internet Service Provider, or additional records from a third party, information stored or retrieved for this purpose alone cannot usually be used to identify you.
Marketing
The technical storage or access is required to create user profiles to send advertising, or to track the user on a website or across several websites for similar marketing purposes.