Industry News: ESG5

The target: C3UK, a provider of Free WiFi at railway stations across the UK

The take: Personal data of more than 10K rail passengers including dates of birth, email addresses and travel plans

The attack vector: A security researcher discovered that C3UK had left a database backup publicly exposed on an Amazon Web Services storage device with no password protection.

While security controls around production systems and databases are missions critical, care must also be taken when storing and transferring backups and duplicate copies of production data. Security controls must always be commensurate to the level of sensitivity of data being handled, and must travel with that data throughout its lifecycle.

Read more...