This gap also makes remediation challenging because knowledge of the breach comes long after the information has been used to victimize users. Meanwhile, organizations are reluctant to admit to breaches because of the negative media attention they receive.
And here’s where Yahoo could have done more: there is
speculation they may have learned of the breach in early August. If we hope to stop this, we must begin by realizing that no single company or technological “silver-bullet” can stop a breach. Instead, all of us must work together.
What does that mean in practice?
First, organizations who are the targets of attacks must take the lead by adopting best practices that make it harder for a hacker to enter and move within networks. This need not mean complex, expensive fixes, but simple strategies like the ones outlined by the NSA in its recently published
Methodology for Adversary Obstruction. These include policies such as ensuring that administrator accounts do not have Internet access so that sensitive credentials cannot be stolen through spear phishing; using different passwords for users and administrators so hackers cannot move across the network; enforcing multi-factor authentication, which means an additional PIN is sent to another device that needs to be entered and “salting” (adding random data) and encrypting all stored credentials so that passwords are uncrackable even when stolen.
But it is not just up to organizations — every one of us needs to do our bit. This must start with checking if our credentials have been compromised on sites like “
Have I been Pwned,” which log stolen credentials, and changing those logins right away. Each of us must work on developing better cyber safety: learning to deal with spear phishing emails; enabling multi-factor authentication where available; using strong, unique passwords and using password-storage vaults; and learning to actively monitor our own devices for suspicious activity so that compromises cannot make their way from our devices to our organization’s.
Finally, policy makers must focus on improving the breach remediation processes. While most states have passed
breach notification laws, policies on breach remediation remain open-ended. Simply notifying people or asking victims to change their passwords, as Yahoo just did, or providing people credit protection
as Target and others did, does little to contain the damage to one’s reputation stemming from an information leak. Imagine the stigma if the health records of the 80 million victims of
the Anthem breach were ever released. Once released, this information becomes available on searchable databases, victimizing people forever. Here, the EU has been more proactive and ruled in favor of a
right to be forgotten online, making it possible for EU citizens to prohibit their personal information from appearing on online searches. Perhaps it’s time we considered this, too.
At the end of day, hackers are not after LinkedIn or Yahoo’s data — they are after ours. That means it is our collective responsibility to help protect that data.