It’s been two years since the advent of the EU’s groundbreaking GDPR scheme, which was implemented in an attempt to force data collectors to tighten up security over the information they collected on users of their services and to provide more transparency and standardization about exactly what and how they collect data. The GDPR is far from an exercise in toothless bureaucracy, though, with penalties faced by those found to be in breach of the regulations regarded as among the most stringent ever proposed.

With data breaches still a regular occurrence and increasingly among the primary objectives of cyber threat actors, just how successful has the GDPR “stick” of punishing fines been after two years of implementation? Has the “fear of a GDPR fine” changed the landscape of data protection, or merely increased the burden on organizations already struggling to deal with gathering and securing the masses of data needed to drive their businesses forward?

GDPR: Fines in Action

There have been around 340 GDPR fines amounting to a total of around $180 million over the last two years, although two of the largest fines amounting to another $350 million together are still to be confirmed in the coming weeks. That could total up to around half a billion USD before 2020 is done and dusted.

The first fine under GDPR was enacted on a bank in Bulgaria for ignoring the right to be forgotten, almost immediately after GDPR became mandatory in May 2018. The first UK GPDR fine was declared more than a year later, in December 2019, regarding a London firm called Doorstep Dispensaree Ltd, that supplies medicines to thousands of elderly care home residents. The company stored 500,000 medical documents containing sensitive information outside its offices, in unlocked containers. This earned the company a £275,000 fine for breaching GDPR rules. The most interesting facet of this incident is that it did not involve any digital record of any kind, only paper documents.

However, in the 18 months that have passed since this incident, many other organizations and companies have joined the not-so-prestigious club. The most recent country to impose a GDPR fine was Ireland, which in May 2020 fined Tusla, a child and family agency, for disclosing the location of children to unauthorised parties.

While the smallest fine has been a meager €90 received by a hospital in Hungary in November 2019, some of the larger fines have been extremely severe:

• British Airways – $229 million proposed fine for a data breach affecting half a million customers.

• Marriott Hotels – $123 million proposed fine, or 3% of global annual revenue, for a breach leaking records of 339 million guests.

• Google – fined $57 million for lack of transparency on how its Android operating system processed user data.

• TIM (Italian telecommunications operator) – fined  $27.8 million for unlawful data processing, non-compliant aggressive marketing strategies, invalid collection of consent and an excessive data retention period.

• Österreichische Post AG (Austrian postal service) – fined $20 million for illegally using marketing data.

• Deutsche Wohnen SE (German real-estate company) – fined $16.5 million for retaining historical data without a lawful basis.

• Eni Gas e Luce (Italian gas and electric company) – fined $13 million for processing personal data and activating unsolicited contracts.

• 1&1 Telecom GmbH (German telecom) – fined $11 million for failing to have sufficient protections to prevent unauthorized access to customer information.

• Dixons Carphone, UK – fined $630,000 for a data breach that exposed customer data to hackers for over 9 months.

• Equifax – fined $630,000 for failing to protect user data belonging to 15 million British customers in its 2017 data breach.

(note: organizations are always fined in their local currency, the above figures are approximate USD equivalents at the time of writing)

The Marriott and British Airways cases are still under review, with the final decisions expected to be announced in August 2020.

Additional decisions are being considered regarding fines for Google, Twitter and fashion retailer H&M. It seems that the larger the company and the heavier the fine, the longer it takes the regulators to charge the violators and then to actually fine them.

Has COVID-19 Impacted GDPR?

On May 4, 2020, the Hungarian Government issued a Decree that suspends, during the COVID-19 state of emergency, the one-month deadline that controllers have under the GDPR to reply to data subject rights requests. The Decree also allows public entities to refuse or suspend freedom of information (“FOIA”) requests in certain situations. The Decree has been heavily criticized by civil society groups and prompted scrutiny by the European Data Protection Board (“EDPB”). For organizations with data collection activities that fall under Hungarian jurisdiction, it is worth noting that the EU may well challenge the Hungarian government’s suspension and could even rule it illegal.

More generally, it is likely that the ongoing trend of “Working from home” will also have some effect on data breaches, and these are likely to increase in the 2nd half of 2020, triggering additional GDPR notifications and responses. The International Association of IT Asset Managers (IATAM) has warned that at-home work due to the COVID-19 pandemic is leading to a spike in data breaches that’s greater than anticipated.

Contemporary Trends, Threats And Challenges

GDPR was supposed to reduce the overall number and severity of data breaches by providing companies with an incentive to avoid being fined. But evidence suggests that the effect was not conclusive or uniform across all member countries since it came into effect.

In Britain, for example, breach reporting increased almost 324.24% between May 2018 and May 2019, with the Information Commissioner’s Office (ICO) recording 14,000 breaches over the period. However, the same body reported it received 19% fewer data breach notifications in the first quarter of 2020 than it did in the same period the previous year. This might indicate less fear of the regulator, either due to fines being less punitive than anticipated or to the UK’s impending exit from EU regulation (“Brexit”) and uncertainty about what, if any, regulations businesses will face from the ICO once GDPR is no longer part of British law.

The recent DBIR report noted that hackers are specifically looking for credentials and personal data. 58% of attacks resulted in compromised personal data, and 37% of attacks either used or stole user credentials. This spells bad news for organizations since theft of such data will almost always trigger GDPR notification. Another recent trend is that aggressive ransomware gangs extort enterprise victims not only by denying them access to their own corporate data but also by threatening to dump that data in the public domain, again triggering breach notifications and all the subsequent headaches.

Has the GDPR Achieved Its Aims?

GDPR redefined privacy as a fundamental right and made our corporate entities stewards of our data. As a result, proper data identification and handling is mandated under GDPR with fines as a severe stick for non-compliance. To measure its success, however, we need to look not so much at the total amount of fines collected, but rather at the mindshift it has created.

This is not limited to European territories, of course. The regulation has become a model for many national laws outside EU, including Chile, Japan, Brazil, South Korea, Argentina, Indonesia and Kenya. The California Consumer Privacy Act (CCPA), adopted on 28 June 2018, has many similarities with GDPR.

GDPR and similar regulations such as those mentioned above have encouraged organizations to try and prevent or limit the risks of a potential data breach by upgrading and improving their cybersecurity measures, and that can only be a good thing for all.

However, it remains a challenge to many businesses to factor in the cost of non-compliance, when fines can amount to as much as 4% of global annual turnover. For this reason, many businesses operating within the jurisdiction of GDPR or similar regulations have seen fit not only to upgrade their cybersecurity defences but also to instate a Data Protection Officer to take responsibility for overseeing compliance.

Conclusion

There is no doubt that GDPR has changed the landscape of data collection and protection since May 2018, not just in Europe but across much of the world’s markets. However, despite the penalties, the data breaches keep on rolling, and customer data keeps on being leaked and traded.

To some extent, this can be seen as enterprise still playing catch up on years of poor or neglected data protection practices and legacy security technology. The threat actors are still out there punishing those that have not upgraded the technology they need to secure their clients’ data, and the regulators are out there punishing those that have not upgraded their data collection procedures and policies. If that tells us anything, it should be that data protection is a fundamental priority of every data collector. If an organization gets punished by the bad guys, it can expect the regulators to be lining up right behind them.

To learn more about how SentinelOne can help your business achieve GDPR and similar regulatory compliance, click here.

---

Like this article? Follow us on LinkedIn, Twitter, YouTube or Facebook to see the content we post.

Read more about Cyber Security

• Kubernetes Security Challenges, Risks, and Attack Vectors
• Feature Spotlight – Introducing the New Threat Center
• Look Who’s Back – It’s DDoS!
• “EvilQuest” Rolls Ransomware, Spyware & Data Theft Into One
• How Do Attackers Use LOLBins In Fileless Attacks?
• How a New macOS Malware Dropper Delivers VindInstaller Adware
• Ransomware – A Complex Attack Needs a Sophisticated Defense

The Good

Cybercriminals often enjoy the fruits of their labor, and few ever get to pay for their malicious deeds, so this week we celebrate two victories for the forces of good. 32-year old Russian national Yevgeny Nikulin, who stole 117 million user details from LinkedIn and Dropbox in 2012, lived a luxurious lifestyle in Moscow, driving his Lamborghini Huracan around the city streets. Nikulin was arrested in the Czech Republic in 2016 and extradited to the US in 2018, where his lawyers tried to avoid trial due to his mental condition. Nevertheless, after undergoing psychiatric evaluation, he was tried and has now been convicted. He is scheduled to be sentenced on September 29, although his lawyers said they would file an appeal in the interim.

U.S Attorney David L. Anderson told CBS station that the conviction was a warning to would-be-hackers, and that “Computer hacking is not just a crime, it is a direct threat to the security and privacy of Americans. American law enforcement will respond to that threat regardless of where it originates.”

The penalty for his crimes could be up to 30 years in prison plus a hefty fine.

On the same day as Nikulin’s conviction, a UK court found Lewis Howe, 27, guilty of hacking his former employer as a retaliation for being let go from the “Flying Trade Group”.

Howe was fired on October of 2018 and launched a cyber attack on November 16 where he gained unauthorised access to the domain controller, which he utilized for deleting key user accounts and knocking computers off the network. He then tried to cover his tracks by deleting the server history. The disruption lasted several days, costing an estimated £180,000 in damages. He was sentenced to 10 months prison time, suspended for 24 months, and is required to complete 240 hours of community service and 30 rehabilitation days. He is also on a 6-month long curfew between 7pm to 7am and will be electronically monitored.

On both sides of the Atlantic, it seems that cybercrime doesn’t pay!

The Bad

This week saw an unprecedented, coordinated attack against the verified Twitter accounts of multiple celebrities and big-name companies, which were then used in concert to perpetrate a large-scale Bitcoin scam.

Hackers were able to gain control of 130 Twitter accounts belonging to some of the platform’s most prominent users, including the likes of Democratic presidential candidate Joe Biden, former President Barack Obama, Elon Musk, Kim Kardashian West, Kanye West, Bill Gates and the verified Twitter accounts of corporate giants Apple and Uber. Once the accounts were under the control of the attackers, they were used to tweet one of several versions of the following scam:

The net gain for the attackers so far has been USD $117,000, or around 13 Bitcoins at the current price, collected over a period of 24 hours from 392 transactions.

After realizing they had been hacked, Twitter immediately blocked all verified accounts across the service, not just those that had sent out the scammers’ message. While it is known that Twitter’s internal tools were leveraged in the attack, it is still unclear how the hackers gained access to Twitter internal systems, other than that “a coordinated social engineering attack” targeted some Twitter employees. The investigation continues as Twitter seek both to understand what happened and to improve security. Law enforcement agencies are also conducting their own investigations.

The Ugly

The world races to find a vaccine for Covid-19, and thousands of scientists are working day and night to help the world to return to normality. But some prefer to take shortcuts and simply steal the research done by others. In a very unusual public announcement by the UK National Cyber Security Centre (NCSC), Russian intelligence services were accused of targeting vaccine research and development organizations in the US, Canada and UK.

The UK Foreign Secretary, Dominic Raab, said: “It is completely unacceptable that the Russian Intelligence Services are targeting those working to combat the coronavirus pandemic. While others pursue their selfish interests with reckless behaviour, the UK and its allies are getting on with the hard work of finding a vaccine and protecting global health. The UK will continue to counter those conducting such cyber attacks, and work with our allies to hold perpetrators to account”.

The actors said to be responsible are the infamous cyber espionage group variously known as APT29, Cozy Bear and The Dukes. Canada’s Communications Security Establishment (CSE), responsible for Canada’s foreign signals intelligence, said that the Russian APT group “is likely to continue to target organizations involved in COVID-19 vaccine research and development”.

For their part, Kremlin spokesperson Dmitry Peskov said Thursday that Russia “has nothing to do” with the hacking attacks targeting organizations involved in coronavirus vaccine development.

---

Like this article? Follow us on LinkedIn, Twitter, YouTube or Facebook to see the content we post.

Read more about Cyber Security

• Kubernetes Security Challenges, Risks, and Attack Vectors
• Feature Spotlight – Introducing the New Threat Center
• Look Who’s Back – It’s DDoS!
• “EvilQuest” Rolls Ransomware, Spyware & Data Theft Into One
• How Do Attackers Use LOLBins In Fileless Attacks?
• How a New macOS Malware Dropper Delivers VindInstaller Adware
• Ransomware – A Complex Attack Needs a Sophisticated Defense

The IT world is changing rapidly as containers and Kubernetes (K8s) become increasingly popular. In just seven years, we’ve moved from a virtual machine to containers and then to a container orchestration platform (the first Docker release launched in 2013). While some startups are still in the process of learning how these new resources can serve them, some of the more senior companies are looking into migrating their legacy systems to more efficient infrastructures.

While the rapid adoption of containers and Kubernetes shows just how disruptive these technologies have been, they have also led to new security problems. Their widespread popularity and the many organizations without proper security measures in place have made containerization and Kubernetes the perfect target for attackers.

A K8s cluster is a set of machines managed by a master node (and its replicas). It can span over thousands of machines and services and can thus become a prime attack vector. Adopting strict security practices is therefore crucial.

Securing Your Cluster

There are many moving parts within the Kubernetes cluster that must be properly secured. The security of the cluster, of course, cannot be achieved in a single process. Rather, ensuring the security of the entire cluster involves a number of best practices and requires a competent security team.

Below, we’ll cover a number of different Kubernetes attack vectors along with best practices for keeping your K8s cluster secure.

Ensuring Kubernetes and Its Nodes Are Up to Date

K8s is an open-source system that is continuously updated. Its GitHub repository is one of the platform’s most active repositories. As such, new features, refinements, and security updates are constantly being introduced.

Every four months, a new major Kubernetes version is released. Each new version includes new features to improve the service, but that may also introduce new security issues or bugs—something every software is susceptible to, especially if frequently updated.

Security breaches can be found in older versions too, however. Understanding how the Kubernetes team handles security updates in older versions is therefore critical. Unlike Linux distribution or other platforms, Kubernetes does not have an LTS version; rather, the Kubernetes system attempts to backport security issues to the three most recent major versions launched.

It is therefore vital to keep your cluster in one of the three most recent major versions, to keep on top of security patches, and to plan updates to the latest major version at least every twelve months.

Beyond its main components, Kubernetes also handles nodes that run the workload assigned to the cluster. These nodes can be physical or virtual machines with an operating system running on them. Each node is a potential attack vector that must be updated to address any security issues. The nodes must therefore be as clean as possible to reduce the attack surface.

Limit User Access

Role-based access control (RBAC) is one of the best ways to control who and how users have access to the cluster. It allows a fine-grained permission set to define each user’s permission. The rules are always additive, so any permission must be explicitly set. With RBAC, it is possible to restrict access permissions (view, read, or write) to each Kubernetes object, from pods (the smallest K8s computing unity) to namespaces.

RBAC can also be attached to another directory service using OpenID connect tokens. This allows users and group management to be defined in a centralized way to be used more widely within the organization.

Access permission is not only restricted to Kubernetes. Sometimes, users may need to access a cluster node to identify problems, for example. In such cases, it is better to create temporary users for solving these problems and then deleting them.

Best Practices for Containers

Docker, the most prominent container technology, is made up of layers: the innermost layer is the most primitive structure, while the outer layer is the most specific. Thus, all Docker images begin with some type of distribution or language support, with each new layer adding or modifying the previous functionality until the very last layer. The container should then have everything it requires to spin up the application.

These layers (also called images) may be available publicly in Docker Hub or privately in another image registry. The image can be expressed in two forms: as a name plus a label (e.g., node:latest) or with its immutable SHA identifier (e.g., sha256:d64072a554283e64e1bfeb1bb457b7b293b6cd5bb61504afaa3bdd5da2a7bc4b for the same image at the moment of writing).

The image associated with the label can be changed at any time by the repository owner; thus, the latest tag indicates the latest version available. It also means that when building a new image or running an image with a tag, the inner layer can change suddenly, without any notice.

This strategy of course poses some problems: (1) You lose control of what is running in your Kubernetes instance, as an upper layer can be updated and add a conflict, or (2) the image can be intentionally modified to introduce a security breach.

To prevent the first issue, avoid using the latest tag, and opt for a more version-specific tag (e.g., node:14.5.0). And to avoid this second problem, opt for official images, clone the image to your private repository, or use the SHA value.

Another approach is using a vulnerability detection tool to continuously scan the images used. These tools can run together with continuous integration pipelines and can monitor the image repository to identify previously undetected issues.

When building a new image, it’s important to remember that each image should contain only one service. The entire image should be built so that it has only the dependencies needed for that application and nothing else. This reduces the attack surface to only the components essential to the service. Having only one application per image also makes it easier to update to a new version and to allocate resources in the orchestrator.

Network Security

The previous section was all about reducing the attack surface, and the same applies to networking. Kubernetes contains virtual networks inside the cluster that can restrict access between pods and allow external access so that only permitted services can be accessed. It is a primitive solution that works well in small clusters.

But bigger clusters that contain several services developed by different teams are far more complex, and a centralized approach may be impossible to manage. In such cases, service meshes are currently the best available method. The service mesh creates a network encryption layer that allows services to communicate with each other securely. They usually work as a sidecar agent that is attached to each pod and provides communication between services. Service meshes are not only about security; they also enable service discovery, monitoring/tracing/logging, and avoid service interruption by applying a circuit breaking pattern, for example.

Establishing Resource Quotas

Because applications are updated all the time, implementing the above means for securing your cluster are on their own insufficient, as there is still risk of a security breach.

Using resource quotas, in which Kubernetes limits outage coverage to the established constraints, is another important step. If the constraints are well designed, they will prevent all cluster services from becoming unavailable due to resource exhaustion.

They can also prevent you from racking up a massive cloud bill at the end of the month.

Monitoring and Logging

Monitoring the cluster, from cluster to pods, is essential for discovering outages and pinpointing their cause. It is all about detecting anomalous behavior. If the network traffic has increased or the nodes’ CPU is acting differently, this requires further investigation to rule out any issues. While monitoring is more about metrics such as CPU, memory, and networking, logging can provide additional (historical) information that can help detect unusual patterns or quickly identify the source of the problem.

Prometheus and Graphana combined are effective tools for Kubernetes monitoring. Prometheus is a highly performant time-series database, while Graphana is a graphical dashboard that can read Prometheus data and provide easy-to-view dashboards.

ElasticSearch is another useful tool and also one of the most popular for providing near real-time centralized logging of the application, nodes, and Kubernetes itself.

Cloud vs. On-Premises: The Security Perspective

A Kubernetes installation can be either on-premises or can use a cloud management service. In the on-premises scenario, every configuration—spinning up new machines, setting up networking, and securing the application—must be deployed manually. Cloud managed services such as Google GKE, AWS EKS, or Azure AKS enable K8s to be installed with minimal configuration and are compatible with other services from the cloud provider.

From a security perspective, on-premises solutions demand much more attention. As noted previously, every new update must be downloaded and configured by the system, and the nodes must be updated as well. It is therefore recommended that only an experienced team deploy on-premises Kubernetes.

With cloud management services, on the other hand, the process is far simpler, as Kubernetes is already installed and the cloud vendor keeps all nodes updated with the latest security features. From the cluster perspective, most cloud providers allow the user to choose the K8s version from a set and also provide ways to update it to a new version. And so, while it is more straightforward, there is also less flexibility.

Final Notes

With continuous updates and the flood of new tools on the market, staying up to date and keeping on top of vulnerabilities can be challenging. Breaches are inevitable. With Kubernetes, the challenge is even greater, as it is more than just a tool. Rather, Kubernetes is a set of tools that manages other tools, machines, and networks, and its security is therefore essential.

But with so many moving parts, keeping your Kubernetes secure is no trivial task, so be sure to follow these guidelines:

• Scan applications running on K8s for security issues.
• Limit and control access.
• Ensure everything is patched with the latest security updates and continuously monitor the cluster to address outages immediately to mitigate the damage.

The challenge is even greater with on-premises deployments, where there is real hardware to manage, automations to create, and more software to keep updated. But following the best practices discussed herein can give you a major security advantage and help keep your Kubernetes environment safe and running.

The SentinelOne Platform supports physical and virtual machines, Docker, self-managed Kubernetes, and cloud service provider managed Kubernetes like AWS EKS. To find out more, request a free demo today.

---

Like this article? Follow us on LinkedIn, Twitter, YouTube or Facebook to see the content we post.

Read more about Cyber Security

• Feature Spotlight – Introducing the New Threat Center
• Look Who’s Back – It’s DDoS!
• “EvilQuest” Rolls Ransomware, Spyware & Data Theft Into One
• How Do Attackers Use LOLBins In Fileless Attacks?
• How a New macOS Malware Dropper Delivers VindInstaller Adware
• Ransomware – A Complex Attack Needs a Sophisticated Defense
• macOS Big Sur | 9 Big Surprises for Enterprise Security