Publicly accessible biometric database highlights key failings

Supply chain weakness

John Sheehy, director of strategic security services at IOActive, said the discovery underlines the importance of supply chain security.

“The fact is: the more secure an organisation itself is, the more attractive that organisation’s supply chain becomes in the mind of the attacker – and you can’t get any more secure than a government, bank or police force,” he said.

An attacker typically looks for the easiest pathway to get into the network, said Sheehy, so often it is the supplier who has an exploitable vulnerability that can get them full access into the original target’s network.

“Most threat actors that organisations face today are very smart. They know they don’t actually need to leverage a sophisticated, complex supply chain hack to wreak havoc on a network, steal data or intellectual property, or cause catastrophic damage.

“All they really need to do is look for the weak spots – such as plain text passwords, unpatched servers, unencrypted data and systems or send out a simple phishing email.

“That’s why, if you’re not protecting your own network against basic threat actors, doing your due diligence to properly patch, and holding your suppliers accountable for securing their own networks and encrypting data, you have no hope in protecting against nation-states or more capable threat actors,” he said.

Rohit Ghai, president of RSA Security, said database leaks ultimately originate from human error on the part of the company managing the database.

“Because they’re typically not malicious, they can be difficult to prevent without a very thorough digital risk management programme in place, which affords the same level of oversight on insider threats as it does to external ones.

“Added to this, the scenario highlights the criticality of third-party risk and security assessments as data flows through the digital ecosystem of organisations,” he said.

Oversight of biometric data security

Guy Bunker, CTO at security firm Clearswift, said that when biometrics first came to the fore as a method for authentication, there was little thought given to how the systems could be compromised.

“However, unlike a password, it’s not so easy to change your fingers, eyes and face. With the increased use of biometrics, the protection of the data to disable the ability for replacement was also, all too often overlooked. Replacement is where you have access to the back-end storage and can readily put ‘your’ details in place of the targets and then become them, for access to whatever is being requested.

“In this particular incident, almost every possible issue with biometrics which could occur, actually has. In doing so, data of thousands of organisations across the globe has been compromised as well as a million-plus people. The ‘fix’ is not going to be quick or easy and so during that time the potential for further fraud and malicious behaviour is very high,” he said.

For businesses not immediately affected by this discovery, Bunker said there is an immediate need to check if they are using any form of biometrics.

“What you need to know is whether the data from the biometric is stored in a ‘raw’ form or if it has been transformed. By way of analogy, passwords used to be stored in the clear (readable) form, today they are all encrypted (transformed) and it is virtually impossible to reverse engineer a strong password.

“Biometric data needs to have the same happen to it – the raw data needs to be transformed through encryption, such that it can’t be reversed engineered. Furthermore, systems holding this data need to be protected, including monitoring, against bulk data change or biometric record updates. Signs of this occurring can be an indicator of compromise.

“Sadly, it takes an event such as this for organisations to understand some of the risks they have with solutions which they either didn’t know about or had previously ignored,” he said.

Tamara Quinn, partner at international legal practice Osborne Clarke said businesses must also consider the risks that arise from deploying facial recognition systems as they need to take appropriate steps to comply with the law. 

“Facial recognition and video surveillance are covered by a complex web of regulations which isn’t easy to navigate, plus there is reputational risk if companies aren’t seen to be taking privacy seriously,” she said, pointing out that under the General Data Protection Regulation (GDPR), the use of biometrics, such as facial recognition systems, is covered by stricter safeguard than ordinary personal data. 

“For many companies, this means that they may need to get consent from every person scanned and prove that these individuals were fully informed and have given consent freely, without pressure or being penalised for not participating.

“With the ICO promising to pay closer attention to private organisations that use facial recognition systems that cover public areas, businesses should act now to ensure that their software doesn’t break the law. And this can include reassessing the use of external cameras overlooking the street, public parking or other communal spaces. 

“As well as making sure that their systems comply with strict legal requirements, companies should be looking at their contracts with external suppliers of these systems to make sure that they have strong legal protections in place,” she said.