Sensitive data exposure: What is it and how it’s different from a data breach

 

Your personal information can be exposed in different ways. Sensitive data exposure is one way. A data breach is another. Here’s what you need to know.

What is sensitive data exposure?

Sensitive data exposure occurs when an application, company, or other entity inadvertently exposes personal data. Sensitive data exposure differs from a data breach, in which an attacker accesses and steals information.

Sensitive data exposure occurs as a result of not adequately protecting a database where information is stored. This might be a result of a multitude of things such as weak encryption, no encryption, software flaws, or when someone mistakenly uploads data to an incorrect database.

Different types of data can be exposed in a sensitive data exposure. Banking account numbers, credit card numbers, healthcare data, session tokens, Social Security number, home address, phone numbers, dates of birth, and user account information such as usernames and passwords are some of the types of information that can be left exposed.

How does data exposure differ from a data breach?

A data breach is a security incident in which information is accessed without authorization.

Hackers seek out personally identifiable information and other data in order to steal money, compromise identities, or sell over the dark web. Data can be targeted to be stolen, modified, or destroyed.

Data exposure is when data is left exposed in a database or server for anyone to see. Sensitive data can be exposed when configuration details for systems and applications are left unsecured online.

How applications are vulnerable to data exposure

Data exposure can be linked to how a company handles certain information. Sometimes, sensitive data can be found stored in plain text documents.

If websites don’t use SSL and don’t have HTTPS security on web pages that store information, data may be at risk of being exposed.

Other ways data can be exposed include by storing it in a database that may be compromised by SQL injection or other types of attacks, using weak cryptographic algorithms or keys, not implementing hashed and salted password practices (which is a form of cryptography similar to encryption), and other unsecure data storage. SQL injection is a code injection technique that allows an attacker to interfere with the queries that an application makes to its database. It can be used to steal information from a database via the backend.

Passwords can be exposed when hashed passwords are stored without salt, meaning it was not fully protected via cryptography, making the password easily unencrypted. Hashed and salted passwords refer to the storage of the password on the server, in which the password (salted or not) is converted into a type of word puzzle that the server knows how to read. If a website’s hashing isn’t strong, then passwords can easily be read during a data exposure.

How to protect yourself in an event of sensitive data exposure

Here are some tips that can help.

• Use a unique and complex password for each of your online accounts. Keeping track of all those passwords can be difficult, but there are products, such as Norton Password Manager, that can help make this task easier to manage.
• Monitor your bank and other financial accounts. Check your accounts regularly for unfamiliar activity. And if the companies offer activity alerts via text or email, it may make sense for you to sign up for them.
• Check your credit report. Do so regularly to see if a thief has attempted to open a new credit card or another account in your name. You’re entitled by law to a free credit report from each of the three major credit reporting agencies every 12 months. Visit annualcreditreport.com for more information.
• Take action as soon as possible. If you see suspicious activity, contact the financial institution involved immediately. If your information was stolen in a data breach, let them know that, as well.
• Use only secure URLs. Be sure that you are visiting a well known website that you trust. Generally, reputable sites begin with https://. The “s” is key. This is especially important when entering credit card or other personal information.
• Implement high-quality security software. Install and use a software suite that includes malware and virus protection — and always keep it updated. Norton 360 with LifeLock is one such solution.
• Consider an identity theft protection or credit monitoring service. The mess caused by a stolen identity could take months or even years to fix. It’s important to consider identity theft protection or a credit monitoring service. Norton protection now includes LifeLock identity theft protection, helping to protect your personal information in an age of data exposure and breaches.