shutterstock_490960141-1

Industry News: ESG5

      Know Your Breach: United Nations

      Jan 15, 2021 10:40:14 AM

      The target: United Nations Environmental Programme (UNEP)

      The take: 100,000 records containing: employee personally identifiable information, project funding records, employment evaluation records, and most critically 7 sets of administrative credentials to other databases.

      The attack vector: The leak originated from an unsecured Git directory and credential files (Git is one of the world’s most popular software version control systems). Within these exposed files were unencrypted, plain text administrative passwords for not only the repository which was accessed, but for other datasets and systems as well.

      This breach demonstrates the importance of appropriate credential storage – privileged credentials should never be stored in plaintext scripts or configuration files replicated in git repositories. Data must always be held with security controls commensurate to the sensitivity of that data.

      Read more...

      Topics:Know Your Breach

      About Castle Hall Diligence

      Castle Hall helps investors build comprehensive due diligence programs across hedge fund, private equity and long only portfolios More →

      Subscribe to Cyber Updates