Blaming Customers for Cybersecurity Breaches

Welcome to the Cybersecurity Vault. I'm your host, Matthew Rosenquist, CISO, industry cybersecurity strategist and advisor. Today we're going to talk about, well, how some companies after being breached are attempting to shift the narrative of blame away from themselves and sometimes even to their customers. I'll be talking with Christine Bejarazco, and Christine is the Chief Information Security Officer at WithSecure, was formerly the Chief Technology Officer at F-Secure, and has been focused on cybersecurity for over 20 years. Welcome, Christine. It's great to see and talk with you again. Thank you for coming.

Thank you, Matthew Rosenquist, for having me.

Now, recently in the news, the DNA sampling company 23andMe had a breach, and in their shareholder lawsuit, interesting enough, they blame the customers for not managing their passwords securely. Can you tell us a little bit about what happened here?

This is, um, it's very interesting when, uh, when sort of organizations put blame on their customers. But of course, the different customers that we are having here may not necessarily have all the cybersecurity trainings and awareness that they need to have when they're using our platforms. So the onus of securing the platforms that we are building should not be on the people that are using them, but should be on us who are building this type of platforms. And of course, there are methods on how we can do this. For instance, in this scenario with 23andMe on how this particular breach actually happened.

Now, this particular attack, um, it's interesting because it wasn't necessarily the servers of the company that were attacked. This was a reuse of passwords by their customers. So a customer had a password at some other site or service, and they reused that password at 23andMe, and potentially that other site, you know, was hacked or that data was breached at some point, and the attackers simply reused those credentials. So I can see on the one side where the company says, well, hey, that's, That's not us.

Yes.

Right? It's not our server that got breached. This sits with the customer. They should have handled their passwords better. But on the other side, right? I mean, are customers really that savvy? Should companies understand that maybe we need to take extra steps or extra measures just as good practice?

Exactly. And I mean, obviously there's— this is sort of the reason why we have multi-factor authentication in the first place, because if there wouldn't have been a need, if all users would have been savvy with securing like all of their different passwords, then the burden of securing this wouldn't have fallen to organizations and we wouldn't need to have set this up in the first place. So the sad thing of the matter really is For this time and age, passwords seem a little bit obsolete for the stuff that we're trying to do, and users do end up— like, some people do end up with hundreds of different passwords that they would then end up securing. So think about the user psychology for a moment. Hundreds of different passwords. Some users may be very savvy and they make unique passwords for every particular account that they have, but the truth is that Most users don't do that. We have seen that when previously in Essicure, for instance, we have our own password management software, and then when we looked at it, when I even looked at my password during that time, I could see that there's a certain percentage of passwords that are reused, and this is just human psychology. This is human nature because you can't remember all of these things, and sure, you may ask these users to have their own password managing software, But maybe not everyone can really afford that. So the burden of security is like when we create services online that users need to authenticate in order to get into especially their personal data, then we should be mindful actually that we give these users the right kind of authentication measures so that they're actually securing themselves when they are within our platforms. Or for instance, if I'm a user, then maybe I should just select another platform that actually cares enough about allowing me to secure my data better in the first place.

So it sounds like there's, well, a responsibility potentially on both parties here. If you're a customer of these services, there are definitely things that you can do to protect yourself. But on the other hand, it sounds like if you are a professional company, and especially if you're, you know, the caretaker of very sensitive personal or private data, that there also is an additional responsibility versus just, okay, our server is all right. We need to think a little bit more on the behavior side.

Absolutely. And yeah, sorry. So it's just really good practice because like, think about it. It also depends on what type of data, as you said, it's like stored in these different locations. So for instance, we're talking about data related to DNA. I mean, that's data that throughout my whole lifetime will never change. So essentially, that breach is going to follow me and haunt me for the rest of my life. There may be other services online that don't have like that level of intensity when it comes to its impact to my person or to another, another person's another person's information, but for this one, it is quite impactful and it's quite long-lasting. So organizations that know that they have this information should actually elevate the level of their security measures because the burden of securing those type of information should be higher than, for example, for others that are not as relevant.

Got it. So let's talk again about those companies then, because in your role, you get to talk, you get to advise, you get to collaborate with many companies in many different fields, which gives you kind of an inside track on those good and poor practices you were talking about. And you mentioned some of them, right? You mentioned second factor, multifactor. What is it that you think that these companies need to take a moment and think about? Is it just, let's just put, you know, a second factor or multi-factor in and we're good? Is there something beyond that? Is it a way of thinking or is it just a technology that they should be looking at?

I think you're onto something there because the idea really for security, it's not just you slap a technology on it and then you solve security. And this is why we talk quite a bit about secure by design, because when people build something, we typically have a tendency to build our technologies and try to conceptualize on how these technologies can be used, what could be the potential use cases, how can this advance certain business cases or personal use cases, but we rarely consider, and sometimes we even fail to really like completely think about how these technologies or how the data behind the scenes could be misused. And if we, at a very fundamental level, when we design these capabilities that we have, these digital capabilities, when we think about how they can be misused, that is already threat modeling at its very basic sense. So just integrating that thinking into the different feature building or capability building things that we do already launches the process of thinking about how to secure certain capabilities, like thinking about this data, how can this be misused? How, for instance, can this database be misused? How can this login page be, page be misused? So a lot of these different entry points towards what you're trying to protect will then be, like, people can then conceptualize what are then the protection capabilities I can put in place in order to mitigate or to prevent this misuse.

So it's not just about running out and finding the first shiny tool. It sounds like it's more strategic in nature in understanding, okay, what are the technologies, but also what are those behaviors, right? And what are those processes that wrap all around? And you had mentioned kind of, you know, the threat assessment, the risk assessment. And there's many things that kind of blend into that. You know, one of the things that we've been talking a lot about, especially going into 2024, is new regulations about reporting requirements, material cybersecurity events, all those fun, fun things. Do you think that there's going to be more pressure on companies to be able to explain failures like this, even if they're not, you know, absolutely 100% at fault? But to explain those failures and impacts to their customers and shareholders. Do you think that's going to be another challenge here with all this?

I do believe that, yes, that the pressure is definitely mounting, especially with the different regulatory requirements that are coming like all over the world that are being put into place. And of course, these requirements are being put there so that government can start regulating and securing the digital space. And from my perspective, it's long overdue, to be honest, because I mean, a lot of the security measures that we have in our physical dimension have sort of been there. And law enforcement, for instance, would be able to implement certain things. But in our digital space, we have, in the past 20 years, for instance, we have added one technology on top of the other, and we have sort of like expanded this digital dimension and just have all of these third-party different interlinkages. But we don't really have much governance over this, and kind of like everywhere all over the world has different things. But now it's starting to be apparent that more and more of these requirements are now coming into play. And of course, this is good for consumers because it protects and elevates the privacy considerations of the data that they have. But of course, this is heavy for different businesses. And the unfortunate thing, or the fortunate thing about it, is that like our digital dimension is really Like, the internet is not a place that you go into. It's just composed of different services that different organizations all over, all over the world interconnect with each other, and this is what we have. So how do we make sure that we can elevate the security here means that we need to do this one organization at a time. And this is why in these initial stages of putting on some governance on top of this, It's going to be quite heavy, but eventually, I mean, it would be like the GDPR, that it's heavy at the beginning, but then eventually organizations got used to the idea that, yes, this is personal information of the user, we need to take special considerations with this. Maybe we need to think about this data will not stay here forever and it needs to be deleted. Maybe if data gets deleted, that's one thing we now don't need to secure. So there are different approaches definitely in order to help with compliance as well with these regulations. But I will not discount it. It's not going to be easy, of course, especially at the beginning.

You know, so if we blend those things together, right, you're talking about a more strategic viewpoint in understanding where even your customers could be part of that risk equation, that risk calculus. Do you think that's going to reflect in some of the government reporting, right? Those 10-K reporting or whatnot. It's not just about these are our defenses, but also we've looked at it in a deeper way and realize that there are other threats, including internals, including customers, including those third-party suppliers you talked about. And then elaborating a little bit more on that forethought and the controls that companies are putting forth out there. Do you think that's gonna be part either of the required reporting requirements or do you think it potentially could just become part of best practice to be able to convey confidence?

Of course it would be great if there is a way to require organizations, for instance, what they're proactively doing to elevate their security posture. Otherwise, everything would just be incident response, which is not how we want to do it because it's going to be purely firefighting. But with a best practice approach, I think it's good for organizations to have some level of transparency when it comes to this. And I even think that this level of transparency, like as consumers, should be seen as a competitive advantage when they are considering one vendor versus another. Because like, for instance, if I'm a customer and I look at two different vendors or three, and all else being equal, one of them has a bug bounty program where, for instance, if there's some, something vulnerable that I found or someone else found in their software, it was very easy to report to them. They handle it with a certain specific disclosure policy date, and then they fix these problems, and then it's very easy to communicate with them. I would be more comfortable in working directly with them because I know that proactively, even without a certain type of requirement, they are already putting this burden upon themselves to ensure that their customers actually get, continuously get high-quality software that have as few security vulnerabilities as possible. So I think like at some point If users would really want to be mindful of where they're putting their assets, which is their data, then it's good to have these certain types of comparisons so that it's very easy to say that, okay, these 3 different organizations, I'll pick one because they may have almost the same features, but this one is really like head and shoulders above the others when it comes to security. And that's my hope for these organizations, that a little bit more transparency in that regard. Would be helpful for them as well.

Well, that's a perfect transition, right? Because we've talked about what the businesses should be thinking and potentially regulatory requirements around that. Let's talk about those customers or consumers, right? And you mentioned a great step we can all take. We can put our thinking caps on and evaluate the different options as consumers, we control the money. We have wallets.

Absolutely.

And that's a strong vote to motivate companies to act responsibly. So what are some other things that the consumer should be thinking about or acting that can help them stay out of being victimized like this?

Well, I think there should be I know that it's hard sometimes to read the end-user license agreement when users actually— No! I know that's horrible. But I mean, of course, for those who want to read it, definitely some of this fine print could be there, like when it comes to your data and how it's used. But like from a very simplistic perspective, like as a user, there are sort of red flags when you don't control your asset that belongs on someone else's computer systems. Like, for example, if it's my data, I should be able to define data retention that, um, whenever I don't want to use it anymore or I haven't touched it for an X number of times, that it should be deleted and it should not be linked to me anymore. Because to be honest, Before GDPR, there were a lot of different services that people have been using that they just sort of forgot. And then there are many different companies that afterwards, they now had the burden to tell you that, hey, we still have your data. If you want to continue to be our customers, we keep it. And if you don't want to be our customer, then we're gonna delete it. So these type of things would be helpful for me as a customer if I was given that option like right off the bat when I signed up. For a certain service. And of course, in businesses, this has become already contractual requirements. So if I'm talking about like myself as a business, these different third-party requirements would just need to be in the contract so that at the end of the day, if I need— if there's a breach that happened on your end, you would need to communicate it with me so that I would know how to manage my data. In the same way, if I'm a customer, it would be really good to understand if a breach happened on your end, what type of my data is impacted, so that I will know how to manage that as well. I mean, I would rather that this organization that I signed up voluntarily for be the one contacting me than some threat actor, some cyber criminal, telling me that my data is now up for hostage and I need to, to pay ransom. I mean, that would be a moment that you would end up like waking up and then panicking.

Yeah, you don't want to be notified by the bad guys that they have your sensitive data. Exactly.

And those have happened. Those have happened, unfortunately.

Yeah, and in fact, I was just reading, in fact, with the 23andMe, they did a couple of things. One, they just came out with an announcement, I think it was yesterday, where they actually didn't detect it, they realized that the breach occurred because it was on some forum and their customers' data was being published and sold, and that's how they learned, which was a little concerning. The other thing that they did is after the breach, they modified their contract with their customers, and I don't know if it was in the EULA or if it was in their privacy policy, which you should read both. I mean, we all should read both, but they made it so So you couldn't immediately sue them in the event of lost data. You had to go through some type of arbitration and kind of keep it quiet. Again, those little things in an agreement that you're reading, if you're seeing that, that might raise a red flag.

Yeah.

Right? So, okay, so nobody wants to, but yes, we should be reading the privacy policy and the end user licensing agreement. Yes, you had mentioned, You know, also look at the security, how savvy they are, and are they out there? Are they communicating? Do they have a good reputation? Do they have a bug bounty program? Things like that would show a certain level of maturity and embracing security and looking out for their customers and their business partners. And you had mentioned earlier, right, having a password program, and there are free versions and there are paid versions depending on, you know, how many bells and whistles you want. Having something like that, because none of us can remember all of our strong passwords for all the different services that we have. So these are all great things that every consumer should be doing. And actually, you mentioned one other thing, which I absolutely love. And I live in California, and we've got a stronger privacy requirement here as compared to the rest of the states. It's still not as strong as GDPR, but it allows you to request for your data, one, not to be sold, but two, to also be deleted. And I think it's a great feature as part of the regulation, and unfortunately so few people take advantage of it. And you brought up, okay, I'm no longer using this service. Why would you still want them to have your data? Send them a note, go on their privacy page, click on that link, tell them, Delete it. They have to get back to you and confirm that it's deleted. And that's just a little less information about you out there on the vast internet that you have to worry about.

Exactly. So, I mean, just like you said it, I mean, if you don't, you don't have it, you don't have to secure it. So, I mean, we, we do try to reduce attack surfaces in organizations, but we also have a digital identity. And therefore reducing our attack surface, like our digital footprints, also helps towards lessening the work in securing the type of identity.

So we do all have a role in it. We can at least scratch back some of that and protect some of our private data. Not in all cases. It does take partnership. Okay, so last kind of question, especially for those cybersecurity leaders out there that are listening and, you know, they're busy, they've got all these other things, they're worried about other types of attacks in the news and all this. What would you want them to do, right? What is that one action you would want them to take in looking at their environment and deciding, am I okay or am I not? What would you recommend? What action for them?

That's a really hard question because I would let them go through several.

We're not here for the easy questions, Christine. I can ask anybody the easy questions.

Okay. So, I mean, as a CISO, it's definitely good to look back at what type of assets I'm trying to protect. Like, if at the end of the day, the only thing I can really do is to understand what is my current security posture and what are the things that I really need to worry about protecting, then I would go back to my assets. And what those are. And those may be customer data. Those could be like organizational data that are confidential, for example, financial employee data, or those could be computing assets. So the stuff that the business actually is like heavily dependent about and then understanding what are the protection measures that I now have in place for that. Because the thing that I would really need is how can we have continuous proactive security governance on top of these different assets. And of course, that, that can grow into having your own information security management program, etc. But at the very least, you need to understand what you are trying to protect, and if you already have protection capabilities for those in the first place, how strong they are, are they compliant with best practices, and will my business go forward if this gets misused? If this gets attacked? If my customer data gets exposed, what is the impact to my business? And for example, if my employee data or this company confidential data gets exposed, what is then the impact of our business? It's in understanding that from the asset to the business impact that gets you to prioritize what then you need to address first. And of course, there are frameworks that can help you do this. But it doesn't replace understanding what you have to protect and how those can be actually misused by cybercriminals and what would be then the impact to your business. Hopefully that helps.

It does. And as part of that risk assessment, knowing what you need to protect and whatnot, is considering your customers a potential threat vector? Is that an important aspect as well now?

Absolutely, yes, because I mean, customers can also be the entry point of misusing the data. So like, I could give you an example. If, if let's say you have your Salesforce SaaS application that is also exposed to customers out there, because let's say you have your customer support on top of this SaaS application, It now means that there is a way for whoever is out there, whether they may be customers or pretending to be customers, to have direct access to your support people, one way or the other. So the question then becomes, how is this platform protected? Do people understand that when they interact here, some people may be validated, some people may not be validated? Are they who they claim they are? So it's in really understanding that what are then these things that you have exposed out there? And of course, this contains customer information because this is your CRM system. And how are you protecting then that information? What are the access controls behind it? Who handles the access controls? Is there a way to validate if there's already misuse? And then the list goes on. But yeah, you're definitely right. I mean, there are a lot of entry points towards the organization now because a lot of the services that we have may not, may not always be inside what we call the traditional perimeter. They may be all over the place out there with our third parties as well.

Yeah, you know, I think you're right there. We have to take that bigger view. We can't just go, okay, this is my infrastructure. We have to expand that perimeter out. And go, yes, our trusted business partners, right, those third-party suppliers and whatnot, are more of a risk. And we've started thinking in those terms as well. But I think with the 23andMe, you know, breach, I think it's also time to consider those customers, the very customers that, you know, you're getting paid by and that you're servicing. They may also be acting in ways that may not secure or fit within your security model, right? If we assume that they're always going to do the right thing, we're probably going to lose at some point. We're all going to lose.

I mean, we even do that with our employees. Of course, there's a concept of insider attack. So in a way, there's also— it's also definitely good to take a look at like how can a certain customer be a misuser, if you may. Of the platform that you are having rather than using that platform according to the use cases that you have laid out for them. So that, that's entirely a possibility.

Yeah, that's a whole new topic, right? Uh, insider threats and, and risks— always been a threat, uh, never in the news as much. But great insights, outstanding insights, Christine. Thank you so much for coming in and sharing your thoughts and your insights. Very much appreciated.

Thank you for having me once again.

And thank you all for watching. Be sure to subscribe and catch all the Cybersecurity Vault episodes where we chat with industry leaders like Christine here to dive into the most relevant and interesting cybersecurity challenges, perspectives, and best practices. See you next time.