It has been reported that security researchers discovered a security lapse at IT giant Tech Data allowed them to access customer and billing data. The Fortune 500 information technology giant secured an exposed server shortly after researchers found and reported the leaking data. The server was running a database used for logging internal company events for its StreamOne cloud service, which let customers buy cloud services from a variety of providers and vendors. The logging data contained error data that Tech Data staff can use to troubleshoot issues that arise when customers try to buy service online.
Amit Sethi, Senior Principal Consultant at Synopsys:
“Organisations often focus on security of their customer-facing interfaces and neglect security of logs used for debugging. This issue illustrates why this is a problem. Developers need to ensure that their applications do not write sensitive information to logs, and organisations need to ensure that application logs are properly secured. Additionally, responding to security events quickly is very important, and Tech Data should get credit for mitigating this issue quickly.”
About the Author
The opinions expressed in this post belongs to the individual contributors and do not necessarily reflect the views of Information Security Buzz.
