“RED 5, STANDING BY”
After millions of movie fans around the world anticipated the opening of Star Wars: The Rise of Skywalker, the third film of the third Star Wars trilogy, there’s one very important fact to remember: It all started with an overlooked security flaw.
You may remember when George Lucas first took us to “a galaxy far, far away,” an unprotected thermal exhaust port on the Death Star (the Empire’s planet-killing satellite) made Luke Skywalker a hero and put him on the path to Jedi knighthood.
Following Obi-wan Kenobi’s advice to “use the Force,” Luke fired the shot—into a hole in the Death Star’s surface just two meters across — about the size of a womp rat — that started the chain reaction that destroyed the Death Star and saved the Rebel Alliance from annihilation.
A simple action that ended in disaster (for the bad guys, of course!) should be a lesson to administrators, IT heads, and frontline database users everywhere. All it takes is one small gap, one unguarded vulnerability, to destroy everything you have worked to build. Awareness, scrutiny, and attention to detail will make your little world safe and secure— no matter how hard your enemies will try.
What Experts are Saying About Network Security
According to one expert, the first step in addressing the problem is rethinking how you see data.
“People need to understand that data doesn’t exist the way they think it exists,” says Andrés Arrieta, Director of Consumer Privacy Engineering for the Electronic Freedom Frontier (EFF).
Drawing on his career as a telecom engineer, Arrieta joined the San Francisco-based non-profit that has sought to enhance transparency and protect consumer privacy and free speech rights in the internet marketplace for nearly 30 years. Arrieta works to raise awareness of the structural failures that lead to privacy breaches and create tools to protect against them.
“When people access a data file, they think they get it from a database, and when they’re done with it, they put it back in the database and there it stays until they take it out again,” he says. “But that’s not how it works.”
Arrieta explains that databases don’t work in isolation. They are linked to other databases, which all communicate with each other. So while a particular file may have its “home” in one database, it can also “exist,” in a general sense, in every other database connected to its home.
The Drawer Example
To understand this phenomenon, imagine a room full of filing cabinets, numbered 1 through 100. The file you need is in the top drawer of Filing Cabinet 33. But when you open the top drawer of Filing Cabinet 33, you don’t just see the contents of that drawer or the contents of every drawer in Filing Cabinet 33; you see the contents of all of the drawers of all of the filing cabinets. That, Arrieta explains, is how database networking works.
What many people don’t understand – even many IT security experts – is to secure the files in the top drawer of Filing Cabinet 33, you have to secure every drawer in every filing cabinet in the room. That is, every access point in the database must be secure, or the entire network is at risk.
Arrieta describes a scenario he’s seen many times, where two networks are linked together, and one contains very sensitive private data, and the other does not. While the “sensitive” network may have high-level security at its entry points, the non-sensitive network does not. And even when the IT team is aware that the non-sensitive network is attached to the sensitive network, they may not be aware that the security of the one is tied to the security of the other.
“A hospital, for example, may have several networks,” Arrieta says. “One is for patient data, with medical history, test results, and private information. Another might be the hospital’s AC system and IoT controls. So the network that controls temperature and airflow around the hospital and links with beds and other equipment to monitor patient care is connected to the one that handles all of the private data. And the controls network maybe doesn’t have the same level of security.”
The lesson, Arrieta says, is that every network, and every network of networks, is only as secure as its least secure component.
The Dark Side of Networks
This scenario played out in real life, in the worst health care data breach of 2019. American Medical Collections Agency (“AMCA”) was a billing company that contracted with hospitals, clinics, doctors’ offices, and laboratories all over the United States. Between August 2018 and March 2019, it was the target of a hacking attack that struck not only AMCA, but many of its clients’ databases as well. In all, about 25 million patient files were breached from at least 21 companies, driving AMCA into bankruptcy and triggering congressional inquiries.
While it’s not clear where exactly the initial breach occurred – that is, at AMCA itself or through one of its client companies – Arrieta says the AMCA data breach case shows the real-world consequences of a security failure at one database affecting many, many others.
Don’t Take Your Safety For Granted
It serves as an important learning opportunity for security administrators everywhere. If you rely on the belief that “your” network is safe, you may find yourself becoming a victim anyway. A recent report issued the National Cyber Security Alliance, based on a Zogby Analytics survey of 1008 small businesses with up to 500 employees, found that after suffering a data breach 10% went out of business, 25% had to file for bankruptcy and 37% experienced a financial loss.
If your network is connected to any other network, your network is as vulnerable as the other network, and every network that network is connected to.
To maximize your protection, there are simple steps you can take:
- frequently reassess your security system
- regularly monitor its effectiveness
- update your hardware, firmware, and software to make sure it’s operating at its peak
- follow best-practices in authentication for database access, including randomizing usernames and passwords
- run systematic training of all staff to ensure compliance with security protocols and practices
Moreover, as Arrieta and the AMCA example tell us, you have to be ready to ask your collaborators and partners to do the same. Because your business’s security depends on their vigilance as much as yours, and the Dark Side is always waiting to exploit a weakness (even though in this example, it was the Light Side that did the exploiting!)