The year 2021 was marked as the worst in history , when the theme is data leakage. Private companies, which are the main targets of cybercriminals .
New technologies, laws and customs have been implemented to reduce corporations' risks and data to be protected and confidential.
In this material you will see information on data leakage, large cases of 2021 and the main: how to avoid data leakage in the company.
Tools, actions, materials and articles, completely free and available for you to learn once and for all how to avoid this digital incident.
Download the eBook of this content
No time to read right now? Download the eBook with all the content on this page and definitely learn how to avoid data leaks in the company.
Index
- What is data leakage?
- How does a data leakage in the company happen?
- Higher data leaks of 2021
- LGPD and the influence on data leaks
- 5 steps to face a data leakage
- What not to do against data leakage
- An efficient and affordable solution for companies
- Trends and news about data leakage
- Free materials
Note: In all topics there is a button that automatically leads you back to the index. We hope this function will help you
What is data leakage?
azing is improper exposure and without prior consent of personal, sensitive, sensitive, biometric, behavioral, confidential, registration or navigation data, for example.
A serious problem that exponentially increases the risks and the occurrence of scams and virtual fraud.
The process of leakage of data causes losses of all kinds: financial, patrimonial, moral, strategic, competitive, personal, etc.
Data leakage is a process that involves at least three steps:
- Access (improper).
- Collection (unauthorized).
- Public disclosure or sale.
That is, before the exposure not authorized by the “owners of the data” , there will be access and collection infractions.
That is, the data leakage is not performed overnight or in isolation. According to the definition of “process”, the offense of improper data exposure occurs from a “continuous and ordained sequence” of actions.
How does a data leakage in the company happen?
Typically, data leaks are caused by vulnerabilities and/or information security and internet access failures . Also, in situations such as:
- Data theft
- Cyber attacks
- Malicious codes
- Use of weak passwords
- Employee or former employee action
- Loss or theft of equipment
- Negligence in the disposal of equipment and media
- Data in transfer without protection
- Invasion of personal, business or data storage
- Improper and/or unlawful collection of navigation data
- Malicious applications and websites
- Excessive data collection without the knowledge of users
- Lack of culture and data security
- Outdated software and applications
- Invasion of accounts
- Malput and/or recklessness online
- Insecure connections
Higher data leaks of 2021
Brazil jumped from sixth position to the global first place in data leakage . A sad statistic. Below are some events that made this fact real.
Vulnerability of Pix
In August, there was a leakage of 414,500 pix keys per telephone number of the State Bank of Sergipe (Banese). At the time, registration data was leaked, without the exposure of sensitive data (passwords and bank balances).
Finally, the same article informs a recent data leakage, on January 21, 2022: more than 160,000 pix keys were exposed.
The security incident, which took place between December 3 and 5, 2021, exposed names, CPFs, institutions, agencies and accounts . According to BC information, the leakage of data did not affect the movement of the 160.1 thousand customers of access payment solutions .
Click here and access the full article.
These are good examples of the risks and damage that data leakage can lead to people and companies.
The first in the world
On December 18, 2021, CNN Brasil published an interview with the expert on digital crimes Wanderson Castilho .
In the report, the expert states that, after computed the number of data exposed by the hacker attack to the Ministry of Health system, "more than 227 million Brazil data were exposed ."
Thus, Brazil exceeded the states in more than 14 million data exposed. Learn more .
Monster leakage
Public site leaked 426 million personal data and 109 million CNPJs, as well as signs of Brazilian vehicles . “A full plate for cybercriminals to apply social engineering blows,” says the article.
This monster data leakage was detected by DFNDR Enterprise . After identifying the “suspicious indexing”, DFNDR Lab (PSAFE Digital Security Laboratory) referred a report to the National Data Protection Authority (ANPD).
Without identifying the origin or way this data leakage took place, the article warns of the severity of the situation. According to the data exposed, it would be possible to “open fake companies and accounts on social networks” .
Learn more .
From bad to worse
According to a report published on Canaltech , on December 16, 2021, in the first 11 months of the year, 24.2 million profiles were exhibited “from attacks or breaches in systems”. Learn more .
Coincidence?
On October 4, 2021, WhatsApp, Facebook and Instagram went down . This was definitely not a good year for CEO Mark Zuckerberg.
Coincidence, or not, that same day (October 4, 2021), the news comes that data from 1.5 billion Facebook users would be on sale at a hacker forum on Dark Web .
According to the article on the look digital , in this case, the data leakage did not originate in hacker invasion. This database would have been obtained by scraping: a process that collects information left available by careless users (public profiles). Learn more .
LGPD and the influence on data leaks
The General Law on Personal Data Protection (LGPD) seeks to protect freedom and privacy. In practice, it requires changes in the way of collecting, storing, treating and using personal data.
As a result, impacts the administrative, legal, communication and marketing areas. But mainly, Internet access and information security technologies .
Therefore, LGPD is a stimulus to the adoption of measures against the leakage of Dads and Privacy Protection.
Its purpose is to try to ensure that personal data is treated lawful, properly and safely.
Both stored data (local or cloud) and data in transit . Because of this, individuals and legal entities have sought and researched solutions with security and privacy, such as VPN and Firewall DNS .
When we talk about LGPD and data leakage, attention should be added. After all, the fines are heavy . But above all, because the damage to the reputation of companies can be irreversible.
5 steps to face a data leakage
Implement solutions, tools, and data protection compliance processes . See what else is needed to face a data leakage at the company and other security incidents.
- Invest and improve management and control management measures and information and data security.
- Structure a policy of internet access, control and data security in accordance with existing standards and legislation ( LGPD ).
- Create and maintain a crisis management team. Qualified personnel who should know what to do, how to do it, and when to go to the company and actions during data leakage at the company or other security incidents.
- Plan and incorporate the policy of control and policy of internet access, data control and security, a tactical and operational plan for times of crisis. It will be the booklet that the crisis management team should follow .
- Notify victims (owners of the leaked data) and the National Data Protection Authority (ANPD). At least, the company must complete the incident communication form provided by ANPD (click here to access).
What not to do against data leakage at the company
Knowing the enemy and its strategies is important. In this digital war against virtual criminals, knowing what not to do wrong on the internet can be crucial to avoiding data leaks in your business.
- Prove identity through static information - they no longer protect as before. Static information is an invitation to the data leakage and fraud prevention techniques based on them are getting outdated and increasingly subject to blows.
- SMS for two factors authentication - the phone is very easy to cloned and therefore a direct channel for the data leakage in the company. The National Institute of Standards and Technology (NIST) has already stated that SMS is a reliable technology as a security method for authentication.
- Password authentication in mobile applications - passwords and cell phones are insecure. In addition, usability and experience are much better away from the use of passwords. The tendency is to use other safer authentication methods, such as facial or digital recognition, for example.
- Confirm or provide online data -do not provide or confirm data by phone or non-secure applications (WhatsApp, Telegram and Signa, for example). Even if the applicants seem to be true. Especially when they seem to be real, such as banks, judiciary, prosecutor, large companies, etc.
- Answer SMS Messages - To avoid data leakage by employees, companies must provide information and knowledge. Thus, when they receive SMS messages that, for example, inform an atypical and recognized operation, the correct action is not to answer! In addition, responding already provides data that can confirm personal or business identity.
- Access SMS or WhatsApp links - No links are reliable if it was received via SMS, free messaging applications (WhatsApp, Telegram and Signal, for example). Especially in messages like “the prize is yours, just…”, “this notification refers to the fine…”, “See the prohibited photos of the famous…”. They are certainly links that contain viruses and malicious software that can do a great damage, such as collecting bank and social networking passwords. When the internet is corporate, then, the risk of data leakage by employees is very high.
- Make payments or transfers of values - this guidance is aimed at employees of the financial departments of the companies. After all, they are the targets of this type of scam. Digital criminals use applications or make phone calls, with the aid of previously leaked data and information. They invent stories and situations very close to the possible reality and abuse good faith (and lack of training and information) of employees. Thus, with social engineering, they try to dissuade employees to pay or deposit improper amounts. In 100% of companies that do not invest in data security and personnel training, the chance of this scam is very large.
An efficient and affordable solution for companies
Data leakage is a serious and current security incident that can be easily prevented . When companies take action and correct attitudes, this type of security incident has a solution, yes.
Much more than just prevent, there are sons and tools that still offer advantages and benefits .
From the adequacy to the LGPD (General Law on Personal Data Protection) and the rules of ANPD ( National Data Protection Authority ), to security, cost reduction, productivity, information and reports that assist in the Business Intelligence (BI) analysis process.
Among the solutions available on the market, you will meet Lumiun Box . However, reinforcement that entrepreneurs, IT professionals and managers should research and compare .
Certainly, the best way to decide on the solution that best meets the need for security and productivity and also offers resources and features that fit the needs of the company.
Lumiun Box is the Internet Access Security and Management Service advised for small and medium -sized companies. For, in addition to seeking efficiency in protecting the internet threats and evolution of team productivity rates, they also seek economy and cost reduction .
Therefore, the main benefits of Lumiun Box are:
- Security - to protect against threats on the company's internet.
- Productivity - To increase the productivity of work teams and decrease the waste of time.
- Economics - to reduce expenses with security and maintenance of devices.
- Information - To generate management reports on the use of the internet by employees.
DNS Filtering Based, Lumiun Box manages Internet access requests on the corporate network on all connected devices. In addition to blocking websites, it prevents access to harmful, dangerous or outside work sites. Lumiun Box has some features such as:
- Business VPN
- Management and Control of Internet Access
- Safety and Prevention Against Internet Risks
- Firewall and Network Protection
- Traffic Management and Internet Performance
- Management information and reports
- Compatibility and integrations
- Customer support, service and success
Meet, in detail, some of the main features of Lumiun Box .
10 trends and news about data leakage in companies
The expansion of risks and cyber threats from 2022 is a consensus among cybersecurity experts.
The largest number of digital privacy violations in Brazilian history in 2021 signals that we will see the growth in the number of virtual threats and the highest risk of data leakage in companies from 2022.
Therefore, we focus so much on the relevance of information , prevention and investment in solutions, technologies and security systems . Since the lack of these conditions is what makes data leakage in companies one of the most frequent .
The purpose is to share information so that entrepreneurs, IT professionals and managers know that, although serious, prevention against data leakage is possible.
But then, what come around?
On the following pages you will see some predictions from internet security experts for the coming months.
In addition to the well -known cyber threats, new cyber risks and security challenges will be present in 2022. Here are some of the main trends.
1. Ransomware attacks
Ransomware , resulted in major losses to insurers and organizations worldwide.
2. Cyber security talents are missing
Recruit and retain the best cyber security professionals to face the challenges presented by the current scenario of cyber threats will certainly be a significant business challenge from 2022.
In 2021, there were about 4.19 million cyber security professionals around the world . An increase of more than 700,000 compared to 2020, according to the 2021 CyberSecurity Workforce Study of the International Information System Security Certification Consortium.
Despite this rapid growth in cyber security workforce, the study also notes that "global demand by cyber security professionals continues to surpass offer."
In addition, cyber security is no longer a risk of information technology or information security - it is a risk of corporate governance.
3. Challenges of the cloud service
As more companies and processes migrate to cloud -based solutions, cybercriminals will look for ways to explore and infiltrate.
However, moving to a cloud -based solution does not mean that companies fail to deal safely.
It is an inappropriate thought. Although a cloud provider offers some security, it is still up to the companies to adopt additional security measures.
4. Security Incident Insurance Market
Insured and potential insurance buyers can expect the cyber insurance market to remain tense by 2022.
Because the high frequency and substantial severity in claims such as data leakage, along with greater legislative and regulatory inspection activity, caused cyber insurance markets to require certain minimum controls for insurance qualification, capacity coverage and limits reduction.
As the understanding of the causes of the insurers deepens, the subscription requirements will evolve. However, the requirement for strong controls will not change, even if we can see prices start to decrease at the end of 2022 or at some time of 2023.
5. Acceleration of regulatory activity of safety incidents
Internationally, 2021 saw China's Personal Information Protection Act into force, penalties in Brazil's General Personal Data Protection Law became applicable and the final decision to implement the EU on standard contractual clauses.
The size and scope of regulatory activity will probably continue to increase. From 2022, we will see the introduction of new regulations, as well as changes, support regulations, adjustments and warnings related to many of these recently promulgated laws.
6. Cybersecurity improves consciousness and culture against data leakage
It is difficult to quantify cybercriminous damage in recent years. But the negative impact these attacks had on individuals, companies and public entities is immense.
On the other hand, a positive impact of the current cyber risk environment is greater awareness of the need for attention, risk management strategies and business resilience.
In a 2021 survey, Gartner found that 88% of corporate advice now see cyber security as a commercial risk .
7. increasing threats of operational technology
With the acceleration of digital transformation, came the convergence of operational technology (TO) and Information Technology (IT). Now hardware and computer software are used to manage equipment and operating systems.
Vulnerabilities in TO environments cannot be neglected or ignored . After all, strategic infrastructure sectors depend strongly on to (energy, industry, manufacturing, logistics, oil and gas, telecommunications and public services management).
8. Confidence in machine learning and artificial intelligence
While many companies have begun to adopt the use of automated solutions, others invest in artificial intelligence and machine learning to support operational and business functions. Part of this seems to be driven by the Covid-19 pandemic .
Although automation and machine learning have existed for some time, they are relatively new technologies. Therefore, problems with coding, incorrect configuration, insufficient tests and conflicts with other systems and platforms may arise.
As more companies advance to automated solutions, cyber safety risks should be properly and effectively managed.
9.
Attacks directed against various supply chains create great turmoil. Despite reaching a large organization, they result in substantial destruction because many others depend on the target organization.
The cybercriminals will continue to implement this strategy, which has proven to be very lucrative - supply chain interruptions will continue throughout 2022.
10. More collaboration to prevent data leakage
The digital and digitized world has been historically considered a IT problem. But a recent report published by JP Morgan International Council noted that "cybernetic is the most dangerous weapon in the world - political, economic and militarily."
So combat and mitigate risks and database can only be performed with shared responsibility between companies, employees and customers.
Free materials
To help you improve your company's internet control and security, we selected our best materials on the topic.
We periodically seek to produce materials that can help business owners, managers and IT professionals in the search for improvements in the control and security of companies' internet.
Below, you will see tools, ebooks, documents, infographics, guides and kits with free educational content, which can be applied to people management and the internet of companies.
Feel free to share with your colleagues and friends, they are all free !
We developed this material so that professionals and companies definitively learn how and why blocking websites in the business environment is important and beneficial in different scenarios.
We have prepared important information about one of the most appropriate internet protection tools for companies: Firewall DNS. Throughout this material, you will see what is Firewall DNS and also 7 of the main reasons for using this internet protection tool in your company.
The internet is a means of communication, source of information and work tool in companies. However, the lack of control over internet access in the business environment can have negative results, especially on employee productivity.
Every day companies produce information , regardless of their size. Such information adds value and increases productivity and competitiveness in the market . When in use connected to the internet, this data need to be protected and for this reason there are so many internet security systems and tools.
Understand how to use the internet more safely and stay protected from network threats.
Download the eBook of this content
No time to read right now? Download the eBook with all the content on this page and definitely learn how to avoid data leaks in the company.
