RNC leak of voter database exposes poor cloud security practices

Likely widespread RNC leak issues

Given the poor security efforts demonstrated in this RNC leak of voter database information, experts said it was likely there was a more widespread issue.

"If you see one problem, you likely have a widespread problem. Even government agencies that have very strong data protection practices are likely to be working with third-party contractors that do not. BAH and Deep Root are most definitely not the only agencies [or] contractors that have left data unprotected in the public cloud," Rich Campagna, senior vice president of products and marketing at Bitglass Inc., a cloud and mobile security company headquartered in Campbell, Calif., told SearchSecurity. "To find these unsecured data stores, you need to look for them. But anyone that knows how to execute a simple scan can access this data directly, without cracking passwords, encryption, etc."

"The theft of personally identifiable information [PII] is rampant. Every time a third party irresponsibly posts data or they are breached, people's lives are impacted. Bad actors are able to correlate stolen data from multiple sources to piece together the information they need to make monetary gains. Any data that is connected to the internet is vulnerable," Patterson said. "It is the responsibility of any organization gathering and storing PII to take best-practice approaches to monitoring the integrity of that data and providing timely notification if that data is compromised."

Ken Spinner, vice president of field engineering at Varonis, a security software company based in New York, said in the case of the RNC voter data, "it appears that the exposed sensitive information goes beyond personal data -- names, addresses, phone numbers -- and includes analysis on potentially controversial topics and political issues; all of it [is] sitting on a publicly accessible Amazon server." 

"Exposing this type of data, and this much of it, is a huge red flag. Not only can critical data and research be compromised, but personal data can be leveraged to breach more secure systems," Spinner told SearchSecurity. "Organizations -- including contractors -- need to make sure their data has basic controls in place. Data can't be open to everyone, users shouldn't be able to access what they're not supposed to, and all access should be monitored and recorded. You can't catch what you can't see, and too many organizations are flying blind."

RNC leak in regard to cloud security

According to John Bambenek, threat intelligence manager at Fidelis Cybersecurity, based in Bethesda, Md., "If the data is sensitive to disclosure, real thought needs to be given on whether to put this sensitive data into cloud services in the first place."

"If an organization opts to do that, then they need to ensure effective security controls are in place to control access. That means, at a minimum, access keys -- or username [and] password -- but likely encryption should be examined, too," Bambenek told SearchSecurity. "Access keys can be stolen, and once they are, very rarely are those keys changed."

Tim Prendergast, CEO of Evident.io, a cloud security company based in Pleasanton, Calif., said the RNC leak might be due to the RNC team having "the right intentions, but 'intent to secure' isn't enough."

"Government organizations and those working with the government have the highest responsibility to enforce continuous security and compliance monitoring, as they have an obligation to protect their citizens' data," Prendergast told SearchSecurity. "Hackers are always looking for the path of least resistance, so when there's an easy way to access data, once discovered, it will be exploited immediately. It's also important to note that when data is this available, it's vulnerable even to nonmalicious intent. An unauthorized, but well-meaning, actor could inadvertently delete, change or even duplicate files and share outside of the intended group of users."

Avoiding cloud data leaks

Imperva's Mantin said, "Enterprises should take control of their business-critical data, regardless of whether it is stored within the organization perimeter in endpoints, databases and file shares, or via cloud services."

"This includes monitoring and auditing data access and using analytics tools to identify attacks and anomalous behavior," Mantin said. "For example, retrieving a large amount of sensitive data that raises an alert to a security officer can lead not only to examining whether it was done for legitimate reasons, but also reviewing the practices taken by the user to keep this data safe."

Mike Shultz, CEO of Cybernance Corp., a cybersecurity company based in Bee Cave, Texas, said the first step in preventing an exposure like that of the RNC leak is to "understand your organization's current cybersecurity posture."

"Requiring the same level of cybersecurity maturity of your third-party partners as you do of yourself is vital for protecting the information your organization works so hard to secure," Shultz told SearchSecurity. "Regular employee training programs for all departments, including full- and part-time staff, must be upheld, as 80% of breaches are due to failures of people on the inside, not failures of technology. Accountability is the last piece of this puzzle, which should fall on leadership's shoulders. If executives do not implement and mandate enterprise-wide awareness and training, liability falls to them in the event of an inevitable breach."

Prendergast said creating a "culture of security within an enterprise is a first step."

"Things like multifactor authentication and demanding complex passwords are a good start," Prendergast said. "Beyond that, IT and DevOps teams should be constantly monitoring and auditing the different parts of their internal operations to determine where vulnerabilities tend to happen, and employ strict and fast remediation policies to fix issues and ensure they don't happen in the future."

Scott Petry, CEO of Authentic8, a Mountain View, Calif., cloud browser company, said, "Organizations need to treat all data as sensitive and protect it."

"A loss of data can present existential risk to an organization, and their information security perspective needs to change," Petry told SearchSecurity. "When firms outsource work to contractors, they need to be as vigilant, if not more so, than with the work product of an employee. A number of high-profile breaches over the last year point back to contractors or consultants."