After two years of waiting, the general data protection law (LGPD) will finally come into force in Brazil. The law aims to regulate the processing of personal data, mainly ensuring the security, transparency, and integrity of the data provided.

Since its announcement, it has been widely discussed among companies how to adapt to the rules established by law, as the impact on data processing is enormous for companies to create their communication strategies and protect personal data effectively.

Companies that have not yet adapted to the LGPD are subject to fines of R$ 50 million, which would bring huge losses to any company.

If you have not adjusted yours yet and want to catch up with the damage as soon as possible, we have this article to show you the 10 privacy principles for you to comply with the LGPD, check them out:

Learn More: 7 important details between the LGPD (Brazilian) and the GDPR (European)

10 Privacy Principles

Before you put measures in place to regulate your company, it is important to know the 10 privacy principles that LGPD requires from companies, which are:

1. Purpose limitation principle: inform the purpose of collecting data from the user.
2. Adequacy principle: the data will have to be processed in a way that makes sense with the purpose that was informed to the holder.
3. Necessity principle: request only the information necessary for the fulfillment of its purpose.
4. Free access principle: give assurance to the personal data holder that they can know the form and duration for which their data will be used.
5. Quality of data principle: the company will be responsible for the quality of provided.
6. Transparency principle: the user must receive a notice with a detailed list of how their personal data can be used.
7. Security principle: a company must have a means to ensure that only authorized people have access to such data.
8. Prevention principle: data cannot be shared with other companies or people not authorized to process it.
9. Non-discrimination principle: data cannot be used for illegal purposes.
10. Accountability principle: it is necessary to have the term that ensures the 10 principles are being followed.

How to Ensure that the 10 Principles are Followed

To ensure the integrity of personal data, your information security team must contribute a lot, since fully protecting personal data is required for the company to have efficient privileged access control.

One that allows only authorized people to access the information and ensures the security from any internal or external threat, in addition to recording all types of actions taken on personal data.

A good way to solve this effectively is by hiring a PAM solution. A good PAM solution manages all the points you need to pay attention to, ensures internal and external security, and even records all actions performed within the databases. If you are curious to know how a PAM solution works, fill out the form below and request the demo.

Through the digital transformation, now driven by the Covid-19 pandemic, we see a massive migration to decentralized, cloud-based models. And those who already use these models will further accelerate the migration to the cloud. According to Gartner, by 2021, more than half of global companies that already use Cloud will adopt a strategy in a 100%-Cloud environment.

Proper protection of this type of environment becomes a growing concern for Security teams and a business must. Thus, the risks associated with the lack of proper protection of the Cloud environment must be considered not only by the Security team but also by senior management, in order to ensure the organizations’ digital sovereignty over data, in addition to business continuity.

Learn more: Remote Work and Increased Usage of Cloud

Lacework researchers, for example, found more than 22,000 container orchestration dashboards and API management systems open on the internet. Among the applications Lacework has found during the research, we have Kubernetes, Mesos Marathon, Swagger API, Red Hat Openshift, and Portainer from Docker Swarm and Swarmpit. Also, according to the research, 95% of these dashboards and management systems were stored on Amazon Web Services (AWS). Although the vast majority of these interfaces have privileged credentials for access control, the researchers consider it an issue that these interfaces are exposed on the internet. This is because anyone with access to dashboards is able to perform tasks such as starting or stopping workloads, adding or removing applications, or even configuring security controls.

Against this background, it would be very easy for security teams to hand over responsibility for the cybersecurity aspect to CSPs (Cloud Service Providers). It is worth mentioning, however, that in distributed environments, organizations should not rely only on their cloud providers to ensure this protection. If the interfaces are not properly configured, the attack surface increases considerably, which brings a greater risk of cyberattacks to organizations’ infrastructure.

Also, new regulatory requirements, such as GDPR and LGPD, require adequate data protection, which can lead to heavy sanctions if not met. For organizations that treat personal data of European citizens, this figure can reach up to 50 million euros, or 50 million reais if the organization treats personal data of Brazilians and is subject to the LGPD, considering that the Brazilian legislation is already in force.

Some of the best practices that can be implemented by the Security teams to reinforce the organizations’ behavior when it comes to the security of Cloud environments and avoid data leaks include:

Having an understanding of their cloud environments

While ease and convenience bring together some of the biggest advantages of using services in a cloud environment, the implementation of workloads is not as trivial as it seems. The security team must commit itself to know all the configurations and permissions of its Cloud-based services, and thus leverage the maximum of the security features integrated with the contracted services. Even though it is an activity that requires extensive effort, it is necessary to ensure the security of the distributed environments.

Checking and configuring credentials and permissions

Organizations that are implementing Cloud approaches may find that using the default security settings is enough to prevent their workloads from being compromised. However, these settings are very basic or even non-existent. Given this, the recommendation is that those responsible for security in the Cloud environment constantly check credentials and permissions and ensure that access to workloads is limited to those who really need access, ensuring the implementation of the Principle of Least Privilege. This can be achieved through a Privileged Access Management solution or PAM. Besides, the use of features such as Multifactor Authentication (MFA) ensures an additional layer of security to the environment immediately.

Last Saturday (18), the digital world was shocked by another episode of data leaks, and the protagonist this time was Twitter. That’s right, hackers were able to steal data from users of the microblogging platform. And it was not ordinary users, but celebrities, public people and even organizations with millions of followers who had their data exposed, including the use of bitcoin wallets in the scheme. Although it is still under investigation, it is already clear that this episode exposed a major vulnerability of Twitter.

But what were the dynamics of this attack? Also, in times of elections, can we trust the process of choosing future leaders?

By targeting the accounts of world leaders and celebrities on Twitter, hackers managed to orchestrate an attack based on social engineering, and thus promote a scheme involving cryptocurrencies through administration tools of the social network itself. According to the Verizon Data Breach Investigations Report 2020, 22% of the nearly 4,000 incidents and security attacks surveyed involved social engineering. Bill Gates, Elon Musk, Barack Obama, Warren Buffet, and even US presidential candidate Jon Biden were some of the hacked profiles. Not to mention the Apple and Uber accounts.

But how did these hackers manage to perform this well-orchestrated attack?

The answer comes in the form of two words: SIM Swapping. SIM Swapping is a technique used by malicious agents that aim to transfer the number and data of the victim’s SIM chip to another one in their possession. In this case, through social engineering attacks, the hacker convinces a telephone line’s user that a problem has occurred with their chip and needs to transfer the number to another. This type of attack requires that some information, such as the number, name, and other data, is already in the attacker’s hands. Depending on the situation, it is not that difficult to obtain this information if it has already been leaked, for example. Similarly, agents can also persuade operators to perform this transfer, since they have access to all data required for the swap.

Through Social Engineering techniques, malicious attackers deceive their victims to gain improper access to credentials and administrative tools. By obtaining this access, hackers changed their victims’ email addresses on the microblogging network. Then, the attackers disabled the two-factor authentication. This makes it possible to prevent any account modification alerts from being received by its legitimate user. With absolute control of the accounts, hackers start promoting the cryptocurrency-based scam scheme.

Typically, the logic of a cyberattack like this involves several phases:

1. Recognition: In this first phase, malicious attackers try to identify IT routines, as well as security measures and data traffic flow. Also, hackers scan the entire environment to get a clear view of network resources, as well as privileged credentials and services. Domain controllers, Active Directory, and servers are the attackers’ first targets to find other privileged credentials and complete the cyberattack. In many cases, this prior knowledge may exist due to some previous link between the attacker and the victim organization. 
2. Invasion: based on what was discovered in the Recognition phase, hackers are able to enter the environment normally through malware or exploitation of vulnerabilities.
3. Exploitation: This phase involves the act of exploiting vulnerabilities to compromise the environment.
4. Escalation of Privilege: attackers usually need more privileges on systems to gain more access and privileges. This is usually done by escalating administrator privileges.
5. Lateral Movement: Once in the infected environment, attackers can move laterally to other devices and credentials, in order to obtain more data and more access.
6. Obfuscation: For a cyberattack to be successful, attackers need to erase all tracks left in the environment. At this point, it is even possible to change log data and confuse the incident investigation team.
7. Denial of Service: disruption of the normal access by users and systems to prevent the actions of the attack from being monitored or blocked.
8. Extraction: when the malicious user is able to improperly extract the data.

A unanimity among cybersecurity professionals is that this attack on Twitter involved privileged or administrative credentials. According to the Data Breach Investigations Report, the use of privileged credentials occurs in 20% of the attacks. This type of credential, also called “keys to the kingdom”, allows access to add, remove, and modify settings in accounts, applications, and systems. In this specific case, the hacker was able to compromise a credential from the Twitter administration tools. By gaining access, the attacker was able to move around the environment, compromising other privileged accounts. 

According to confirmation by Twitter itself, the nature of the attack was an insider threat. When it comes to data breaches, employees themselves can be one of the biggest risks to the organization. According to Verizon, these threats can be: accidental, when personnel is only poorly trained; negligent, when employees try to bypass the implemented policies; or malicious – the most dangerous – when an employee is motivated by financial gains, espionage, or revenge. An important fact, according to Verizon, is that 30% of cyberattacks performed in 2019 involved insider threats.

But how to prevent this type of attack?

It is complicated to deal with an attack coming from someone inside the organization. This is mainly because this insider threat knows (very) well the organizational environment, the mechanisms, and tools installed. So, it is easy for these attackers to deceive these control mechanisms. In this case, using Zero Trust-based controls can be a good way to mitigate the risks associated with a cyberattack. In terms of credential protection, the implementation of this strategy must not only be focused on identity only, such as access and permissions, but also on the aspect of user behavior. So much so that, in this specific case, the compromised credentials had protection mechanisms, as two-factor authentication. Finally, Zero Trust-based policies recommend the implementation of policies to allow people to take only the necessary actions, based on the concept of Least Privilege.