Data breaches which result in disclosed confidential, sensitive, or secured data to an unauthorized individual can occur under many circumstances. Any entity regardless of size can be a target of a data breach — from individuals to corporations to governmental organizations. However, most cases of data breaches stem from preventable issues. A cyber incident occurred in February 2020 at General Electric (GE) through their contractor Canon Business Process Services. This is known as a 3rd party breach.

The data breach occurred due to an unauthorized party gaining access to a company email which contained significant amounts of sensitive information regarding present and previous GE employees. GE’s official notice of data breach lists “direct deposit forms, driver’s licenses, passports, birth certificates, marriage certificates, death certificates, medical child support orders, tax withholding forms, beneficiary designation forms and applications for benefits such as retirement, insurance, and death benefits” as the affected documents. 

For many organizations, preventing a data breach from happening internally is a difficult enough challenge, especially at a Fortune 500 scale. This becomes even more complicated when companies work with 3rd parties. In GE’s case, they used Canon Business Process Services to process GE employee and beneficiary documents. GE themselves did not suffer any incidents to their systems, but rather on Canon BPS’s where sensitive documents for GE employees were being maintained and processed. Canon has since “took steps to secure its systems and determine the nature of the issue”, but thousands of current and former GE employees and beneficiaries are still left having had their confidential and sensitive employment documents breached.

While the damage done is impossible to say, it can still be mitigated by changing passwords and security questions for potentially breached accounts and turning on 2FA when services offer it. For more advanced cases of identity theft, it may be necessary to get in contact with consumer reporting agencies. In an effort to help individuals impacted by the breach, Canon offered GE present and former employees identity protection, credit monitoring, and theft insurance for 2 years through Experian.

What can be learned from Canon BPS?

Cases such as this remind us that while securing the company internally is important, your cybersecurity is only as strong as the weakest link when it comes to 3rd parties. Most businesses enlist the help of 3rd party platforms to assist in day to day operations which makes it critical for the contractor to ensure the data of their client is kept safe from unauthorized parties and the contractee to inquire about cybersecurity protocols for their services.

We are also reminded about the importance for cybersecurity training for employees as a breach even to the scale of Canon BPS’s is more than likely preventable with proper knowledge. It’s likely that the email account accessed by the unauthorized party was obtained through very simple and non-brute force cyber-attack methods, such as spear phishing or malware. If employees are properly trained to spot potential incoming threats, in addition to cybersecurity protocols such as MFA or 2FA, breaches just like this are able to be prevented more easily. 

How else can data breaches be prevented?

Data breaches frequently occur without a company’s knowledge, and cybersecurity experts agree that while some data breaches are not completely preventable., the vast majority of them are. That’s why cybersecurity best practices and approaches are recommended to help detect, contain and remediate data breaches. The following preventative cybersecurity methods are recommended regardless of organization size.

Vulnerability assessments

The systematic review of security weaknesses in company systems, with continuous action to remediate high priority security gaps.

Penetration testing

The simulated cyberattacks against IT systems to check exploitable vulnerabilities. 

Emergency mitigation and recovery plans

The security staff must document known threats to sensitive systems, and maintain plans for responding, containing, mitigating, and recovering from security incidents.

Defending the network perimeter

The security tools that can be used to deny unauthorized access and prevent many types of attacks against information systems. For example, the Web Application Firewall protects from all common web application security threats such as SQL Injection, Cross-Site Scripting (XSS), and Remote File Inclusion (RFI). Email spam filters and attachment scanners prevent common phishing and malware attempts.

Update software regularly

Cybersecurity experts recommend keeping all application software and operating systems updated regularly with auto-rollout features. The network is vulnerable when programs aren’t updated regularly and mandatory rollout updates ensure network users aren’t pushing off updates for extended periods of time.

Working with a trusted partner

Even though it’s necessary, secure networks are incredibly hard to maintain with so many moving parts and constantly changing variables. To ensure proper cybersecurity protocols are in place and remain that way, it’s recommended to work with a skilled and knowledgeable partner, whether it’s an internal IT team or a vetted IT vendor.

Unsure of where to start?

KLH has over a decade of experience in industries such as legal, finance and insurance, manufacturing, retail, construction, and more. Our expert technicians know that different industries have different needs, and tailor their managed services approach individually so business owners and managers can go back to focusing on business operations; that’s how KLH makes technology work for you. Contact us at 952-258-8200 or info@klhmn.com to learn more about how we use technology to support SMBs in the greater metro area.