In case you didn’t catch the news, on September 6, 2018, British Airways (BA) published a statement that its website and mobile application were breached by hackers. As a result, criminals seized personal and financial data of about 380,000 customers between 22:58 BST August 21, 2018, and 21:45 BST September 5, 2018.
Though BA did not reveal any technical details, a blog posted on Sep. 11, 2018 by Yonathan Klijnsma, Threat Researcher of RiskIQ, reveals that the attack is linked to the criminal hacking gang known as “Magecart.”
According to this BankInfoSecurity article, SPG Law is planning to launch a £500 million ($650 million) class-action lawsuit against BA unless the airline opts to settle with compensation for the victims.
As the story unfolds, executives around the world are likely wanting to answer the big question – “How do we make sure this type of breach doesn’t happen to us?” Since virtually all organizations do business online in this digital era, no company is 100% safe from targeted cyber-attacks; that’s why companies must act quickly to make sure all systems are completely secure.
This blog provides you with three important IT lessons to take away to better protect against future cyber-attacks:
Lesson #1 – Keep Website Platforms Up-to-Date
One of the top mistakes that leads to a data breach is not keeping a website’s platform up-to-date. When a website’s software does not have the latest version, it can leave weak spots in the code that hackers can exploit to break in and inject malicious code.
An insightful blog from HostGator says that “making sure you always have the newest versions of your platform and scripts installed minimizes the risk that you’ll be hacked and usually takes very little time to do.”
Lesson #2 – Ramp Up Threat Monitoring Across Website and Applications
In the blog published by RiskIQ, Yonathan Klijnsma revealed that the malicious script Magecart used to extract data from BA customers was a digital “credit card skimmer” secretly added to an online payment form. This was most likely missed by BA’s security team because the code was designed to blend in with BA’s existing code. However, how Magecart got past BA’s defenses and into the web server is still a mystery not yet been revealed by the airline.
To defend against these types of attacks, one of the best solutions is to invest in digital threat management solutions that enable organizations to accurately detect, monitor, enforce and report on digital threats that target websites, applications and email servers.
Lesson #3 – Reexamine File Exchange Server Security
A technology that is a choice target for hackers are file exchange servers that are used to receive send and data from customers. Many companies integrate file exchange solutions with websites and business applications but unfortunately will use unsecure solutions that have no way of tracking important activities like downloads, uploads, log ins, etc., use outdated protocols that are open to hackers, and have no way of controlling access to data.
Companies should use the BA breach as a reminder to reexamine the security posture of file exchange servers and determine if there are vulnerabilities present. At Thru, this is our area of expertise and we have helped numerous organizations to protect file exchanges online such as Sage, Plus500 and Blackbaud.
Thru’s file exchange and content collaboration platform is fully protected from harmful traffic and cyber-attack with intrusion detection/protection devices that are actively monitored 24/7. The platform is GDPR-ready with features that make it easy to permanently delete EU customer data and record consent from external guest users.
Conclusions
There are more companies than you may think that believe a data breach on the level of the British Airlines breach won’t happen to them. Instead of waiting until next year to ramp up security, start strategizing now and reexamine how your company is protecting its data online. This will save your company huge fines in the long run and will most importantly strengthen trust with your customers.
To learn how Thru can help your organization to secure file exchanges with customers and prevent data breaches, go to our security page.
