Most enterprises know PII is critical and take extra steps to protect it. Databases holding PII is encrypted, strong access control is enforced, every access is logged and so on. All that is really great. In this privacy/security conscious world the stakes of losing PII is too high.
Unfortunately, production database is not the only place where PII gets dumped. More often than not PII gets included in logs & event streams. To make things worse, events streams and logs are often sent to 3rd parties or dumped into not so well protected locations like S3 buckets with loose permissions. A company I used to work for sent out PII (which included emails, phone numbers) to segment which in turn was integrated with dozens of other systems all outside of the firewall. This was a clear violation of company security policies and laws of the land.
Who was to be blamed? The company had hired top notch security professional to define and implement security policies but an inadvertent error by an individual engineer in including PII in event data leaked it to 3rd party vendors.Tools like segment while on the one hand make it really easy to forward event streams to multiple vendors but on the other hand exacerbate the security problem for the exact same reason.
Think this can impact you too? Come and talk to us!!
Recent Comments