CenturyLink Data Exposed to Public
Someone forgot to close the figurative “door.” A third-party vendor affiliated with CenturyLink misconfigured a MongoDB database leaving it open and accessible to the public for about 10 months.
CenturyLink, a Fortune 500 technology company, was alerted by a security research firm that approximately 2.8 million records were left unprotected and vulnerable to potential misuse. Included in the affected database were API logs containing multiple pieces of personally identifiable information (PII), including names, email addresses, phone numbers, and addresses, along with account-specific information.
While CenturyLink has stated that they found no evidence that its records were misused, it’s important to remember that any ill-intentioned individual with an internet connection could have easily exploited the records containing PII. Even more important is the underlying trend behind the story: security vulnerabilities go beyond a company’s internal IT products and solutions. The full risk profile extends to vendors, partners, and any other connected parties.
We live in a world where data is king—collecting, storing, and leveraging data is essential to running just about any business. All the more reason organizations must be diligent in protecting data with proper security controls. In this particular scenario, an automated cloud security solution, like DivvyCloud, would have been able to:
- detect the misconfiguration in the MongoDB database containing this information and then
- either alert the appropriate personnel to correct the issue or trigger automated remediation in real-time.
These solutions are essential to enforce policy, reduce risk, provide governance, impose compliance, and increase security across large-scale hybrid cloud infrastructures.
Interested in learning more? Check out our Solution’s page and speak with a DivvyCloud expert today!
Watch DivvyCloud’s 60-second video to learn how we help customers like GE, 3M, Autodesk, Discovery, and Fannie Mae stay secure and compliant.
DivvyCloud minimizes security and compliance risk by providing virtual guardrails for security, compliance, and governance to customers embracing the dynamic, self-service nature of public cloud, and container infrastructure. Customers like General Electric, Discovery Communications, and Fannie Mae run DivvyCloud’s software to achieve continuous security governance in cloud and container environments (AWS, Azure, GCP, Alibaba, and Kubernetes). First, our software performs real-time, continuous discovery of infrastructure resources allowing customers to identify risks and threats. Second, customers can implement out-of-the-box or custom cloud-native policy guardrails that identify and alert on violations. Third, we automate the enforcement and remediation of these policies.
The post CenturyLink Data Exposed to Public appeared first on DivvyCloud.
*** This is a Security Bloggers Network syndicated blog from DivvyCloud authored by Anna Mulamba. Read the original post at: https://divvycloud.com/centurylink-leak/?utm_source=rss&utm_medium=rss&utm_campaign=centurylink-leak
