Cybercriminals work tirelessly to compromise sensitive data by manipulating technology to carry out malicious activities against digital systems and networks, and it’s up to their intended targets to defend against these sophisticated attacks. But sometimes these online fraudsters barely need to lift a finger because a threat gives them what they want on a plate: data leakage, putting prevention in the spotlight for businesses.
Understanding Data Leakage Prevention
This unauthorized transmission of sensitive data from within a company to an external recipient or destination typically occurs via the web and email. Typical examples include an employee sending a message to the wrong recipient, security policy flaws, and unpatched software vulnerabilities.
It can also happen when mobile data storage devices such as USB keys and laptops are left unattended or when a disgruntled employee leaks confidential information to attract outside attention. Whether the leakage is accidental or intentional, the consequences can be crippling.
1. Reputational damage
After a customer fills out an online form on a business’s website, a data leak of personal information can break trust, erode loyalty, and create a negative perception of the brand.
2. Financial cost
Costs vary by the type and extent of the leak, but typically include reactive steps to contain the breach, implement new security measures, investigate the leak, and compensate those affected.
3. Regulatory compliance
Increasingly robust data protection regulations legally require organizations to take appropriate steps to mitigate data leaks. Noncompliance can result in legal action, significant financial penalties, and reputational damage.
Data Leakage Examples
1. Volkswagen Group of America
From August 2019 to May 2021, a data leak exposed personal information of around 3.3 million Volkswagen customers, including driver’s license numbers and social insurance numbers. Malicious actors exploited a third-party vendor to obtain the data after Volkswagen had failed to secure this database.
2. Capita
In May 2023, Capita, a company that provides services for the NHS, councils, and the military in the UK, leaked personal and financial data to the public. The incident was caused by an exposed Amazon S3 bucket – a cloud storage misconfiguration that left sensitive files publicly accessible. This primarily impacted local councils, exposing constituents’ benefits data, including Personal Independence Payment (PIP) details. The company’s shares fell by more than 12% after the leak.
3. Infinity Insurance
In December 2020, malicious actors temporarily achieved unauthorized access to files on Infinity Insurance’s servers for two days. This exposed the personal information of customers and existing and former employees, including millions of driver’s license numbers and Social Security numbers.
How to Prevent Data Leakage
The adage “prevention is better than a cure” rings true when tackling data leaks. Closing gaps in your business’s physical and digital security perimeter before a leak occurs can prevent it. Conversely, a reactive approach that tries to stop a leak after it starts will leave you exposed.
A proactive approach to data leak management requires the implementation of focused strategies that are specifically designed to prevent this pervasive threat, including:
1. Achieving comprehensive coverage of website data
To gain visibility and respond quickly to a data leak, monitor every script’s activity in real time to identify misbehavior. Reinforce this by creating a detailed inventory of each code’s output, its destination, and when it’s sent.
2. Reinforcing the source code
Gain control of third-party script activities on your website by combining innovative runtime protection and obfuscation capabilities or actions that can mitigate data loss, as endorsed by the National Institute of Standards and Technology (NIST) and the Open Web Application Security Project (OWASP). Blocking suspicious code prevents data leakage.
3. Implementing robust policies
Oversight measures can help you structure how data is transacted. This includes implementing robust data leakage prevention policies that require third parties to comply with agreed data protection standards. These essential components of a cybersecurity strategy help reduce the risk of financial loss, reputational damage, and legal consequences resulting from a data leak.
Data Leakage Prevention Tools
Jscrambler’s data leakage prevention tool supports this proactive approach. It helps you understand your risk level by gathering data and showing which vendors and scripts run on your website and what data they touch in every user session.
This essential process is performed across three key stages:
- Monitoring: Continuously gathers information on all user sessions and attributes levels of risk to each vendor based on its behavior.
- Risk mitigation: Provides visibility and control over the sensitive data being inserted on web forms and which vendors are accessing and transferring sensitive data from your website – allowing you to block unauthorized access.
- Script control: Provides precise control over all first- and third-party script behavior by enforcing comprehensive data access rules, allowing you to block unauthorized behaviors, including data transfers to external domains.
Another critical element of data leak management has been amplified by a recent update to its provisions: PCI DSS (Payment Card Industry Data Security Standard) compliance—a set of security standards designed to ensure that all companies that accept, process, store, or transmit credit card information maintain a secure environment.
PCI DSS Compliance
PCI DSS v4 aims to meet the payment industry’s evolving security needs, promote security as an ongoing process, increase flexibility, and improve procedures to help organizations achieve their security goals. The new PCI DSS v4 requirements, which focus on managing payment page scripts, notably JavaScript, can help address data leakage risks alongside other cybersecurity standards and regulations, such as HIPAA.
JavaScript, which runs on all major browsers, is the building block of nearly every modern web page. Its appeal comes from its ability to bring online applications to life, create dynamic user experiences, and work across platforms. While its benefits are compelling, insufficient monitoring can create security risks that go undetected for long periods, especially with the widespread use of third-party JavaScript.
Online businesses struggle to maintain complete visibility and control over these scripts. In 2023, research by Jscrambler found that 80% of the 20 most highly trafficked US e-commerce websites had an average of 148 JavaScript files on their payment pages.
Amid this opaque view of JavaScript, PCI DSS includes specific requirements (6.4.3 and 11.6.1) designed in part to detect tampering or unauthorized alterations to the payment page that can result in cardholder data leakage. PCI DSS defines the scope of its requirements based on the cardholder data environment (CDE), which includes systems and processes that store, process, or transmit cardholder data. Any data leakage within the CDE is a significant PCI DSS violation.
Conclusion
Effective data leakage management relies on robust controls that define who can access which data. This essential requirement is achieved by blocking script misbehavior through granular control of actions and access levels, allowing you to maintain your website’s integrity without compromising functionality.
Jscrambler can also help you keep pace with the dynamic regulatory compliance landscape—a challenge the updated PCI DSS has brought into sharp focus. With the right structure in place to maintain compliance with its new provisions, your organization can strengthen its data leakage controls.
