Panama Papers a Lesson in Cyber Security

Whether data breach or insider leak, Panama Papers Cyber Security lessons still the same.

By now, you’ve heard about the leaked papers from a Panamanian law firm implicating world leaders, sports figures and celebrities alike in a scheme to shelter massive wealth in off-shore corporations (if not, see the NYTimes summary below for relevant links). At this point it is still unclear whether the 11.5 million records were obtained through hacking or leaked from someone inside of the Panamanian law firm.

But from a cyber security perspective, the lessons are nearly identical either way. At issue here is the massive centralization of data that makes either breach or leakage not only inevitable, but rather convenient. World leaders and executives alike must have a sense of deja vu from the leakage of the NSA documents by Edward Snowden several years ago. From a security perspective, it is baffling in both cases that one individual would have access to such a trove of data. This suggests that the records were not properly segmented, encrypted or subjected to user-level access permissions.

Now, it’s possible that the administrator in charge of the law firm’s computer network facilitated the breach (remember, someone with SysAdmin access always has the keys to everything when it comes to data), but I highly doubt it, as this is easily monitored and punishable. We may never know exactly how this breach transpired, but there are several lessons you can absolutely take from the Panama Papers:

Segmentation. If the critical data inside of your organization is not segmented or divided across different digital locations, it’s like keeping all of your gold under the same mattress.
Encryption. In the event that the Panama Papers were obtained by a hacker, this suggests that the data was not properly encrypted to keep out prying eyes. Most businesses still only have a partial encryption strategy on their data (either at rest or in transit) and this lack of an end-to-end encryption solution is what dooms them to breach.
User-Level Permissions. We don’t know how the Panama Papers were accessed, but if we learn from Edward Snowden, the amount of global digital access you give to your employees makes a huge difference. A contractor like Snowden probably should have never had permission to access so much information across such a wide spectrum. He was only a contractor – imagine what a true insider could have accessed.
Monitoring. Any organization that has implemented a secure firewall can monitor how much data is leaving their servers. More sophisticated software lets many companies know exactly what data is leaving the premises and exactly who is responsible. But both of these cases require human intervention to read the warning signs and take action. Target knew that their POS system was being breached, but no one acted on the red flags.

It’s too late for Mossack Fonseca to go back and right these cyber security wrongs. For you, it’s not too late.

Panama Papers Quoted Directly from the NYTimes.com:

The leaks from the Panamanian law firm, Mossack Fonseca, involve more than 11.5 million documents, nearly 215,000 companies and 14,153 clients of the firm, according to the German newspaper Süddeutsche Zeitung, which got the information and shared it with some other media outlets and the International Consortium of Investigative Journalists, a nonprofit group.

They began reporting Sunday on the leaks, now known as the Panama Papers, which have implicated a range of politicians, celebrities and sports figures, including close associates of President Vladimir V. Putin of Russia, President Petro O. Poroshenko of Ukraine, Prime Minister Nawaz Sharif of Pakistan, current and former members of China’s ruling Politburo and FIFA, the worldwide association for soccer.

John Sileo is an an award-winning author and keynote speaker on identity theft, internet privacy, fraud training & technology defense. John specializes in making security entertaining, so that it works. John is CEO of The Sileo Group, whose clients include the Pentagon, Visa, Homeland Security & Pfizer. John’s body of work includes appearances on 60 Minutes, Rachael Ray, Anderson Cooper & Fox Business. Contact him directly on 800.258.8076.

Posted by Identity Theft Speaker John Sileo in Cyber Data Security and tagged Cyber Security, John Sileo, Panama Papers, Sileo.