Alert regarding personal information leakage when using cloud services and telework environments

More and more companies are introducing cloud services and telework environments to accommodate the diverse working styles of their employees. On the other hand, cyberattacks targeting these system environments are also increasing, and the Personal Information Protection Commission has received numerous reports of personal information leakage incidents occurring in these system environments.

We will introduce actual cases that have occurred, and we urge personal information handling business operators to use these as a reference to review the system environments used by their own organizations.

■ Learning security measures from actual cases
Among the personal information leakage incidents reported to the Personal Information Protection Commission, we will introduce cases that could potentially occur again in the future. To check whether your organization's security measures are sufficient, confirm the implementation details and results (evidence) with system administrators or outsourced system development/maintenance contractors, and if they are insufficient, consider and implement the necessary measures.

Case 1: A case where personal information on a cloud service that should have been private was accidentally made public

Due to a mistake in the cloud service's public settings, private information, including personal information stored in the cloud service, became viewable by anyone. The causes include firewall settings and data area access permission settings not being configured correctly.

＜Common pitfalls＞
・The mistaken belief that network security settings are handled by the cloud provider.
・Not realizing that depending on the cloud service used, the default settings may be set to public to everyone.
・Lack of knowledge or awareness regarding items that should be checked by the business operator, leading to a failure to perform proper checks.
＜Example measures＞
・Check the shared responsibility model (*) for each cloud service used and correctly understand the scope of responsibility of the cloud provider and your own company. Check whether the network settings (security groups), storage public settings, and object access permissions, which are your company's responsibility, are appropriate (if work is outsourced, ensure that the contractor performs these checks thoroughly).
・Check the current settings, including the initial settings, and confirm whether changes are necessary. *The concept of dividing roles between the cloud provider and the user to ensure overall security.
・While cloud services are convenient because they can be accessed from anywhere using the internet, security measures must be implemented strictly accordingly. If you are unsure whether your measures are sufficient, please consider consulting with a professional service provider.

Case 2: A case where login authentication for a cloud service was insufficient, leading to unauthorized login

Insufficient authentication when logging into a cloud service led to unauthorized login. There have also been cases where, despite intending to introduce multi-factor authentication, the use of previously used, low-strength authentication methods in parallel became the point of attack.

＜Common pitfalls＞
・Using low-strength authentication methods consisting only of an email address and password makes them easy to guess. Furthermore, if passwords are reused across multiple services, there is a risk of unauthorized login if a password is leaked from another service.
・If a mobile phone is used as one of the factors for multi-factor authentication, employees who do not have a mobile phone might be allowed to log in using only an ID and password, which could be targeted by attackers.
＜Example measures＞
・Introduce multi-factor authentication so that unauthorized logins do not occur even if authentication information such as passwords becomes known to attackers.
・It is extremely important to adopt an authentication method only after confirming that it is sufficient as a security measure, including methods prepared exceptionally for employees who do not have mobile phones and cannot use multi-factor authentication.
・To avoid the misconception that you have "introduced" multi-factor authentication, please confirm whether all login authentication methods provided to employees are highly secure.

Case 3: A case where authentication information for a cloud service system administrator was not managed appropriately

When using an internet-based source code management service, authentication information such as IDs and passwords for cloud service system administrator privileges was included in the source code, and attackers who obtained this authentication information gained unauthorized access to confidential information such as personal information on the cloud service.

＜Common pitfalls＞
・Rules such as not writing IDs/passwords directly into source code were not thoroughly enforced, and authentication information for the cloud service was embedded in the source code.
・Source code was published on an internet-based source code management service (without limiting the scope of disclosure) to allow multiple developers to develop efficiently.
・Multi-factor authentication was not introduced for the login authentication of the cloud service system administrator account.
＜Example measures＞
・Do not write authentication information itself, such as IDs/passwords or access keys, into the source code.
・When using an internet-based source code management service, limit the scope of disclosure to within the company.
・Introduce multi-factor authentication for the login authentication of the cloud service system administrator account. Since there is a risk that all operations on the cloud service could be performed if the system administrator account's authentication information is leaked, create and use an account with the minimum necessary privileges (to minimize damage in the event of a leak).
・Please store the authentication information for cloud service system administrator privileges using a secure management method so that it cannot be seen by third parties, in accordance with the best practices and management guidelines recommended by the cloud service provider.

Case 4: Cyberattacks targeting personal information using illicitly obtained VPN authentication information

We issued an alert regarding personal information leakage incidents associated with telework on September 23, 2020 (https://www.ppc.go.jp/news/careful_information/telework/), but personal information leakage due to cyberattacks exploiting vulnerabilities in VPN equipment used for telework is still occurring.

＜Common pitfalls＞
・If VPN equipment is not upgraded or security patches are not applied after installation, continuing to use vulnerable VPN equipment without security measures may lead to attackers stealing IDs/passwords used for VPN connections.
・If IDs/passwords for VPN connections are stolen, there is a risk of intrusion into the internal network, which may lead to the theft of confidential information such as personal information or damage from attacks using ransomware (ransom-demanding viruses).
・Leaving vulnerabilities in equipment intended for access from outside the workplace, such as VPN equipment, is highly likely to result in significant damage.
＜Example measures＞
We strongly urge you to check once again whether the version of your VPN equipment is the latest. If it is not the latest version, you need to take the following measures or responses to mitigate the impact.
・Update to a version that is not affected by the vulnerability.
・Introduce multi-factor authentication for telework and other connections via VPN equipment.
・If you were using a version affected by the vulnerability, it is desirable to change the account password, as there is a risk that the ID/password has already been stolen.

Case 5: A case where an internal network was breached via a cyberattack through an overseas branch

With the globalization of business, when an environment was built that incorporated overseas branches such as local overseas offices, affiliated companies, and business partners into the Japanese domestic network, the overseas branch, which did not have sufficient security measures compared to those in Japan, was subjected to a cyberattack, leading to unauthorized intrusion into the domestic network and access to confidential information such as personal information.

＜Common pitfalls＞
・Overseas branches are difficult for headquarters to govern, and measures against system vulnerabilities were insufficient.
・Due to the unique operations of the overseas branch, unmanaged private devices were connected to the system.
・Prioritizing low costs led to the use of a supply chain with insufficient security measures.
＜Example measures＞
・Even for overseas branches, regularly collect information on system vulnerabilities and perform rapid version upgrades if affected.
・Separate systems that store confidential information such as personal information and strengthen access restrictions on inter-branch networks.
・As a measure against supply chain risk, establish security requirements and regularly audit the implementation status of security measures.
・Introduce behavioral detection-type endpoint security measures (EDR, etc.) so that cyberattacks such as malware infections can be detected early even if they occur.
・It is important not to complete security measures only within Japan, but to ensure a security level for the entire group that connects networks including overseas branches.

There is no such thing as a security measure that is sufficient just by doing this one thing. It is necessary to understand global threats and information security cases, and to continue to implement more appropriate security measures.

The Personal Information Protection Commission has previously published the "Collection of Near-Miss Cases regarding the Act on the Protection of Personal Information," which introduces near-miss cases that are likely to occur when handling personal information, and alerts for business operators operating websites such as e-commerce sites on the Personal Information Protection Commission website. Please check those as well and use them to consider and implement necessary security measures in the future.

🌻Site Map (List of all article links)
🌻List of Services (Services handled by our office)
🌻Work Requests (Available nationwide)
🌻Profile

🌈Announcements (Office news, legal updates, etc.)
🌈Seminar Information

🍊Twitter (Please follow us)
🍊LINE Official Account (Inquiries)