By Randy Reiter CEO of Don’t Be Breached
Recent Data Breaches Disclosed in 2020
In February 2020 the United States Department of Defense (DOD) disclosed a data breach that occurred at its IT and telecom agency the Defense Information Systems Agency (DISA). DISA does the IT and telecommunications support for the White House, diplomats, and military troops. The breach exposed Personally Identifiable Information (PII) of its employees between May and July 2019. DISA has about 8,000 civilian and military employees. The employee personal information breached is believed to include social security numbers.
Other major 2020 data breaches include:
- January 2020. Wawa who has 850 US convenience stores reported that Hackers put up the payment card details of more than 30 million Wawa customers for sale on Joker’s Stash on the Dark Web where cybercriminals buy and sell payment card data.
- January 2020. 250 million Microsoft “Customer Service and Support” (CSS) records were exposed online. The leaked database contained data on customers including their email addresses, IP addresses, locations, case numbers, and internal notes marked confidential. Hackers potentially could try to trick users into paying for support solutions by impersonating Microsoft support representatives.
- March 2020. UK telecommunications provider Virgin Media reported that the personnel information of 900,000 customers was exposed in a data breach. Customer names, home addresses, email addresses, phone numbers, and dates of birth were leaked.
- March 2020. US telecom giant T-Mobile suffered another data breach. Cyber Hackers gained unauthorized access to sensitive information on customers and employees.
How to Protect Confidential Database Data from Insider Threats and Hackers?
Confidential database data includes credit card, tax ID, medical, social media, corporate, manufacturing, law enforcement, defense, homeland security, and public utility data. This data is almost always stored in Cassandra, DB2, Informix, MongoDB, MariaDB, MySQL, Oracle, PostgreSQL, SAP Hana, SQL Server, and Sybase databases. Once inside the security perimeter a Hacker or Rogue Insider can use commonly installed database utilities to steal confidential database data.
Non-intrusive network sniffing can capture and analyze the normal database query and SQL activity from a network tap or proxy server with no impact on the database server. This SQL activity is very predictable. Database servers servicing 10,000 end-users typically process daily 2,000 to 10,000 unique queries or SQL commands that run millions of times a day.
Advanced SQL Behavioral Analysis of Database Query and SQL Activity
Advanced SQL Behavioral Analysis of the database SQL activity can learn what the normal database activity is. Then from a network tap or proxy server, the database query and SQL activity can be non-intrusively monitored in real-time and non-normal SQL activity immediately identified. Non-normal SQL activity from Hackers or Rogue Insiders can be detected in a few milliseconds. The Hacker or Rogue Insider database session can be immediately terminated and the Security Team notified so that confidential database data is not stolen.
Advanced SQL Behavioral Analysis of the query activity can go even further and learn the maximum amount of data queried plus the IP addresses all queries were submitted from for each of the 2,000 to 10,000 unique SQL queries sent to a database. This type of data protection can detect never before observed query activity, queries sent from a never observed IP address, and queries sending more data to an IP address than the query has ever sent before. This allows real-time detection of Hackers and Rogue Insiders attempting to steal confidential web site database data. Once detected the security team can be notified within a few milliseconds so that a data breach is prevented.
About the Author
Randy Reiter is the CEO of Don’t Be Breached a Sql Power Tools company. He is the architect of the Database Cyber Security Guard product, a database data breach prevention product for Informix, MariaDB, Microsoft SQL Server, MySQL, Oracle, and Sybase databases. He has a Master’s Degree in Computer Science and has worked extensively over the past 25 years with real-time network sniffing and database security. Randy can be reached online at [email protected], www.DontBeBreached.com, and www.SqlPower.com/Cyber-Attacks.
