324. What Should We Do When We Have Had a Data Breach

you just experienced a data breach. As a you just experienced a data breach. As a developer, what should you do next? Now, developer, what should you do next? Now, developer, what should you do next? Now, I'm not talking about handling the I'm not talking about handling the I'm not talking about handling the breach itself, but there's an important breach itself, but there's an important breach itself, but there's an important set of tasks that developers should do set of tasks that developers should do set of tasks that developers should do post data breach to further secure your post data breach to further secure your post data breach to further secure your systems and ensure that your code is not systems and ensure that your code is not systems and ensure that your code is not causing a future breach. And if you causing a future breach. And if you causing a future breach. And if you haven't experienced a data breach yet, haven't experienced a data breach yet, haven't experienced a data breach yet, this will be a really good proactive set this will be a really good proactive set this will be a really good proactive set of steps you can take to secure your of steps you can take to secure your of steps you can take to secure your systems. So, let's talk about it in systems. So, let's talk about it in systems. So, let's talk about it in today's episode of Dev Questions. Software development is more than just Software development is more than just writing code. So let's talk about the writing code. So let's talk about the writing code. So let's talk about the rest of it. Specifically, let's talk rest of it. Specifically, let's talk rest of it. Specifically, let's talk about what to do after a data breach. about what to do after a data breach. about what to do after a data breach. Now, to be clear, again, this is not Now, to be clear, again, this is not Now, to be clear, again, this is not advice about the actual breach itself. advice about the actual breach itself. advice about the actual breach itself. In the case of a breach, talk to the In the case of a breach, talk to the In the case of a breach, talk to the relevant authorities, employ an expert relevant authorities, employ an expert relevant authorities, employ an expert to help you, and let the affected to help you, and let the affected to help you, and let the affected parties know. parties know. parties know. But as a software developer, you do have But as a software developer, you do have But as a software developer, you do have next steps. Steps that you should be next steps. Steps that you should be next steps. Steps that you should be taken to prevent a breach in the first taken to prevent a breach in the first taken to prevent a breach in the first place, but also that are much more place, but also that are much more place, but also that are much more popular with management after a breach.

popular with management after a breach. popular with management after a breach. Use this time when people are aware of a Use this time when people are aware of a Use this time when people are aware of a danger to do the most good for your danger to do the most good for your danger to do the most good for your application and your company. And if you application and your company. And if you application and your company. And if you haven't had data breach yet, still haven't had data breach yet, still haven't had data breach yet, still follow us advice if you can. Now, the follow us advice if you can. Now, the follow us advice if you can. Now, the boss may say, "Yes, that's great advice, boss may say, "Yes, that's great advice, boss may say, "Yes, that's great advice, but this isn't a priority right now." If but this isn't a priority right now." If but this isn't a priority right now." If you do get that message, well, at least you do get that message, well, at least you do get that message, well, at least you have it in writing that these are you have it in writing that these are you have it in writing that these are the things that you suggested. That way, the things that you suggested. That way, the things that you suggested. That way, if there is a breach later in the if there is a breach later in the if there is a breach later in the future, you can say, "Okay, now we've future, you can say, "Okay, now we've future, you can say, "Okay, now we've had this breach. Let's go back to what I had this breach. Let's go back to what I had this breach. Let's go back to what I suggested and do those steps." That way, suggested and do those steps." That way, suggested and do those steps." That way, not only have you said, "Here's a plan not only have you said, "Here's a plan not only have you said, "Here's a plan for what to do now," but also you kind for what to do now," but also you kind for what to do now," but also you kind of subtly pointed out, "I talked about of subtly pointed out, "I talked about of subtly pointed out, "I talked about this." And then you can further secure this." And then you can further secure this." And then you can further secure your application. your application. your application. Security is hard, right? It's something Security is hard, right? It's something Security is hard, right? It's something that doesn't show up in new features. that doesn't show up in new features. that doesn't show up in new features. It's not something that's that's flashy It's not something that's that's flashy It's not something that's that's flashy and and great to see, but at the same and and great to see, but at the same and and great to see, but at the same time, it's really important. So, by time, it's really important. So, by time, it's really important. So, by going through this list and say, "Hey, going through this list and say, "Hey, going through this list and say, "Hey, let's do these things, being proactive, let's do these things, being proactive, let's do these things, being proactive, you get the opportunity to at least put you get the opportunity to at least put you get the opportunity to at least put it in front of your boss and maybe they it in front of your boss and maybe they it in front of your boss and maybe they say yes." And if they say, "No, you know say yes." And if they say, "No, you know say yes." And if they say, "No, you know what? That feature is more important what? That feature is more important what? That feature is more important than securing your application." Well, than securing your application." Well, than securing your application." Well, that's fine. That's their prerogative, that's fine. That's their prerogative, that's fine. That's their prerogative, but now you have it in writing for when but now you have it in writing for when but now you have it in writing for when it does h come up later. Okay. So, let's it does h come up later. Okay. So, let's it does h come up later. Okay. So, let's say you've had a breach or you're say you've had a breach or you're say you've had a breach or you're preparing for a breach. Either way, what preparing for a breach. Either way, what preparing for a breach. Either way, what are the things you should do? Number are the things you should do? Number are the things you should do? Number one, inspect every place where you're

one, inspect every place where you're one, inspect every place where you're gathering user input. So, too often gathering user input. So, too often gathering user input. So, too often people trust users. It just don't do it. people trust users. It just don't do it. people trust users. It just don't do it. Never trust the user. But it's very Never trust the user. But it's very Never trust the user. But it's very easy. Maybe you have just a a comment easy. Maybe you have just a a comment easy. Maybe you have just a a comment field somewhere and you say, "Let leave field somewhere and you say, "Let leave field somewhere and you say, "Let leave a comment here." Well, are you making a comment here." Well, are you making a comment here." Well, are you making sure that that data is is stripped out sure that that data is is stripped out sure that that data is is stripped out of any type of escape characters or of any type of escape characters or of any type of escape characters or other ways to bypass security? Or are other ways to bypass security? Or are other ways to bypass security? Or are you just putting that in the database? you just putting that in the database? you just putting that in the database? Don't just put it in the database. Make Don't just put it in the database. Make Don't just put it in the database. Make sure you clean the data first. Inspect sure you clean the data first. Inspect sure you clean the data first. Inspect every place where you're gaining or every place where you're gaining or every place where you're gaining or gathering user input. Make sure that gathering user input. Make sure that gathering user input. Make sure that every single one of them you are every single one of them you are every single one of them you are stripping out anything that could be an stripping out anything that could be an stripping out anything that could be an escape character. You might say, "Well, escape character. You might say, "Well, escape character. You might say, "Well, Tim, that's that's that list is huge." Tim, that's that's that list is huge." Tim, that's that's that list is huge." Well, then what you do is you just say, Well, then what you do is you just say, Well, then what you do is you just say, "These are the things we allow." And "These are the things we allow." And "These are the things we allow." And don't allow angle brackets or, you know, don't allow angle brackets or, you know, don't allow angle brackets or, you know, double dashes or whatever the case may double dashes or whatever the case may double dashes or whatever the case may be that that might escape out data. And be that that might escape out data. And be that that might escape out data. And then also make sure that when you're then also make sure that when you're then also make sure that when you're using that information that you also using that information that you also using that information that you also store it safely. There are tools that store it safely. There are tools that store it safely. There are tools that will help you put it into the database will help you put it into the database will help you put it into the database safely. So for example, uh when it comes safely. So for example, uh when it comes safely. So for example, uh when it comes to store procedures or using Dapper in to store procedures or using Dapper in to store procedures or using Dapper in general, you can use parameterized SQL.

general, you can use parameterized SQL. general, you can use parameterized SQL. So you're not just saying, hey, let's So you're not just saying, hey, let's So you're not just saying, hey, let's build this string based upon user input. build this string based upon user input. build this string based upon user input. Don't do that. That's SQL injection 101. Don't do that. That's SQL injection 101. Don't do that. That's SQL injection 101. Don't do that. Instead, use parameters. Don't do that. Instead, use parameters. Don't do that. Instead, use parameters. That way, even if there is bad data gets That way, even if there is bad data gets That way, even if there is bad data gets through, you are protected against that. through, you are protected against that. through, you are protected against that. Now, you don't want to let bad data Now, you don't want to let bad data Now, you don't want to let bad data through to that point, but this is through to that point, but this is through to that point, but this is defense in death. Don't just have one defense in death. Don't just have one defense in death. Don't just have one wall, have multiple. Now, that does mean wall, have multiple. Now, that does mean wall, have multiple. Now, that does mean that you need to think about the data that you need to think about the data that you need to think about the data that's in your database and not always that's in your database and not always that's in your database and not always treat it as safe because maybe it got treat it as safe because maybe it got treat it as safe because maybe it got through the first layer and went into through the first layer and went into through the first layer and went into the database and didn't you didn't have the database and didn't you didn't have the database and didn't you didn't have a second layer at that time. Maybe a second layer at that time. Maybe a second layer at that time. Maybe someone edited the database manually. someone edited the database manually. someone edited the database manually. Maybe there is an app out there is Maybe there is an app out there is Maybe there is an app out there is writing to the database that doesn't writing to the database that doesn't writing to the database that doesn't have a safety and security in place. have a safety and security in place. have a safety and security in place. Well, this is where first of all layers Well, this is where first of all layers Well, this is where first of all layers help because if you had a layer closer help because if you had a layer closer help because if you had a layer closer to the database like even the store to the database like even the store to the database like even the store procedures themselves that would protect procedures themselves that would protect procedures themselves that would protect you by catching it at that point. But you by catching it at that point. But you by catching it at that point. But still don't trust data and database just still don't trust data and database just still don't trust data and database just because it's in your database. Make sure because it's in your database. Make sure because it's in your database. Make sure that you're checking that data too. And that you're checking that data too. And that you're checking that data too. And that comes number two. Inspect every that comes number two. Inspect every that comes number two. Inspect every place you get data from that's an place you get data from that's an place you get data from that's an untrusted source. I don't trust most of untrusted source. I don't trust most of untrusted source. I don't trust most of my own database because it came from my own database because it came from my own database because it came from users initially. So even that can be an users initially. So even that can be an users initially. So even that can be an untrusted source. But then if you pull untrusted source. But then if you pull untrusted source. But then if you pull data from an API, if you pull it from data from an API, if you pull it from data from an API, if you pull it from another application in some way, if you

another application in some way, if you another application in some way, if you have any type of data transfer between have any type of data transfer between have any type of data transfer between applications, applications, applications, don't trust those because what if they don't trust those because what if they don't trust those because what if they get hacked? Well, then they're going to get hacked? Well, then they're going to get hacked? Well, then they're going to be inside your walls and they can then be inside your walls and they can then be inside your walls and they can then send unsafe data over to you and then send unsafe data over to you and then send unsafe data over to you and then breach you and it's a cascade effect. breach you and it's a cascade effect. breach you and it's a cascade effect. Instead, have defense in depth. Make Instead, have defense in depth. Make Instead, have defense in depth. Make sure that you put walls around your sure that you put walls around your sure that you put walls around your things so that even if somebody else is things so that even if somebody else is things so that even if somebody else is compromised or another app is compromised or another app is compromised or another app is compromised that you are not compromised compromised that you are not compromised compromised that you are not compromised as well. So inspect every place you get as well. So inspect every place you get as well. So inspect every place you get data from that's an untrusted source and data from that's an untrusted source and data from that's an untrusted source and then figure out how to secure that data then figure out how to secure that data then figure out how to secure that data or then turn it into trusted data. or then turn it into trusted data. or then turn it into trusted data. Number three, shrink down the Number three, shrink down the Number three, shrink down the permissions of every connection string. permissions of every connection string. permissions of every connection string. So talking to a database is very very So talking to a database is very very So talking to a database is very very common. That's you have to do that. But common. That's you have to do that. But common. That's you have to do that. But too often we have connection strings too often we have connection strings too often we have connection strings that are admin level. This should not that are admin level. This should not that are admin level. This should not be. Now, it depends on your database and be. Now, it depends on your database and be. Now, it depends on your database and your data source where you're using what your data source where you're using what your data source where you're using what you can cannot secure. But let's talk you can cannot secure. But let's talk you can cannot secure. But let's talk about Microsoft SQL. It's a pretty about Microsoft SQL. It's a pretty about Microsoft SQL. It's a pretty popular database option.

popular database option. popular database option. With Microsoft SQL, the easiest thing to With Microsoft SQL, the easiest thing to With Microsoft SQL, the easiest thing to do is just give system administrator do is just give system administrator do is just give system administrator permissions to your your credentials and permissions to your your credentials and permissions to your your credentials and then everything works. Don't do that. then everything works. Don't do that. then everything works. Don't do that. Never do that. But I know it's easy and Never do that. But I know it's easy and Never do that. But I know it's easy and your application will work and if you your application will work and if you your application will work and if you give it too strict permissions, it might give it too strict permissions, it might give it too strict permissions, it might break. But that's the thing, you want it break. But that's the thing, you want it break. But that's the thing, you want it to break. You want to say, "Hey, this is to break. You want to say, "Hey, this is to break. You want to say, "Hey, this is too restrictive. Let's loosen it up a too restrictive. Let's loosen it up a too restrictive. Let's loosen it up a bit." Rather than saying, "Hey, this bit." Rather than saying, "Hey, this bit." Rather than saying, "Hey, this works. We think it's secure enough." works. We think it's secure enough." works. We think it's secure enough." Make sure you lock it down. This is why Make sure you lock it down. This is why Make sure you lock it down. This is why I personally love store procedures. And I personally love store procedures. And I personally love store procedures. And I know that some people go, "Oh, that's I know that some people go, "Oh, that's I know that some people go, "Oh, that's that's old technology." It's not. But that's old technology." It's not. But that's old technology." It's not. But one of the things it allows you to do is one of the things it allows you to do is one of the things it allows you to do is say the connection string I'm using only say the connection string I'm using only say the connection string I'm using only has the ability to execute these store has the ability to execute these store has the ability to execute these store procedures. It cannot read tables. It procedures. It cannot read tables. It procedures. It cannot read tables. It cannot list the tables. It cannot drop cannot list the tables. It cannot drop cannot list the tables. It cannot drop tables. It cannot create entries. It tables. It cannot create entries. It tables. It cannot create entries. It cannot do SQL injection and do anything cannot do SQL injection and do anything cannot do SQL injection and do anything bad because of the fact that we're bad because of the fact that we're bad because of the fact that we're locked down to only executing certain locked down to only executing certain locked down to only executing certain store procedures. Which means that even store procedures. Which means that even store procedures. Which means that even if a person grabbed the connection if a person grabbed the connection if a person grabbed the connection string and got the username and string and got the username and string and got the username and password, they still can couldn't do password, they still can couldn't do password, they still can couldn't do anything more than the application can anything more than the application can anything more than the application can do. That's locking down your connection do. That's locking down your connection do. That's locking down your connection string. But if you say, well, it's the string. But if you say, well, it's the string. But if you say, well, it's the entity framework connection string and entity framework connection string and entity framework connection string and it has to be able to create tables and it has to be able to create tables and it has to be able to create tables and drop tables. That's an admin. So if drop tables. That's an admin. So if drop tables. That's an admin. So if you're using the same connection string,

you're using the same connection string, you're using the same connection string, that's a problem. You can use a that's a problem. You can use a that's a problem. You can use a different connection string, one that different connection string, one that different connection string, one that can only read certain tables or or do can only read certain tables or or do can only read certain tables or or do certain things. Lock down every certain things. Lock down every certain things. Lock down every connection string possible. If it's connection string possible. If it's connection string possible. If it's APIs, try to get a readonly API as APIs, try to get a readonly API as APIs, try to get a readonly API as opposed to a read write API if you don't opposed to a read write API if you don't opposed to a read write API if you don't need to write. All these things are need to write. All these things are need to write. All these things are least possible permissions. That's what least possible permissions. That's what least possible permissions. That's what you're looking for. Not the most you're looking for. Not the most you're looking for. Not the most possible permissions, not the easiest to possible permissions, not the easiest to possible permissions, not the easiest to use, the least possible permissions. use, the least possible permissions. use, the least possible permissions. lock this down. Number four, audit who lock this down. Number four, audit who lock this down. Number four, audit who has access to secure data or systems and has access to secure data or systems and has access to secure data or systems and reduce that list as much as possible. reduce that list as much as possible. reduce that list as much as possible. If you have a web server, that web If you have a web server, that web If you have a web server, that web server, let's say it runs on prem, so server, let's say it runs on prem, so server, let's say it runs on prem, so it's it's in a it's in a server room it's it's in a it's in a server room it's it's in a it's in a server room somewhere. Well, that server is going to somewhere. Well, that server is going to somewhere. Well, that server is going to have unencrypted have unencrypted have unencrypted access to connection strings. It's going access to connection strings. It's going access to connection strings. It's going to know how it talked to APIs. It's to know how it talked to APIs. It's to know how it talked to APIs. It's going to know whatever your database going to know whatever your database going to know whatever your database credentials are and it's going to have credentials are and it's going to have credentials are and it's going to have that information unsecured. Even if you that information unsecured. Even if you that information unsecured. Even if you encrypt all that information, it has to encrypt all that information, it has to encrypt all that information, it has to decrypt it in order to use it. So in its decrypt it in order to use it. So in its decrypt it in order to use it. So in its memory, it's unencrypted. So if someone memory, it's unencrypted. So if someone memory, it's unencrypted. So if someone has access to physically access that has access to physically access that has access to physically access that room, well, they might have access to room, well, they might have access to room, well, they might have access to get your unsecured passwords. So secure get your unsecured passwords. So secure get your unsecured passwords. So secure those rooms. Secure access to your those rooms. Secure access to your those rooms. Secure access to your systems. If it's Azure, don't let systems. If it's Azure, don't let systems. If it's Azure, don't let everybody have an Azure admin access.

everybody have an Azure admin access. everybody have an Azure admin access. Give them only the rights that they Give them only the rights that they Give them only the rights that they need. And the same is true for your need. And the same is true for your need. And the same is true for your data. Not everybody needs to even be data. Not everybody needs to even be data. Not everybody needs to even be able to see the production database. able to see the production database. able to see the production database. Personally, I don't like any of my Personally, I don't like any of my Personally, I don't like any of my developers to have any access to developers to have any access to developers to have any access to anything production, which may be anything production, which may be anything production, which may be mind-blowing. How do you debug things? mind-blowing. How do you debug things? mind-blowing. How do you debug things? Well, the way we do it is we take the Well, the way we do it is we take the Well, the way we do it is we take the production database every night, we back production database every night, we back production database every night, we back it up, we clean out the sensitive data, it up, we clean out the sensitive data, it up, we clean out the sensitive data, and then we create a new dev database and then we create a new dev database and then we create a new dev database from that. Well, now we have as close as from that. Well, now we have as close as from that. Well, now we have as close as possible to production to recreate possible to production to recreate possible to production to recreate almost everything. And the same is true almost everything. And the same is true almost everything. And the same is true for debugging when it comes to, you for debugging when it comes to, you for debugging when it comes to, you know, connecting to servers and systems. know, connecting to servers and systems. know, connecting to servers and systems. I have a a pre-production site. I have a I have a a pre-production site. I have a I have a a pre-production site. I have a staging site. I have a dev site that are staging site. I have a dev site that are staging site. I have a dev site that are as close as possible to the production as close as possible to the production as close as possible to the production site. So that we should be able to site. So that we should be able to site. So that we should be able to recreate things that happen in recreate things that happen in recreate things that happen in production, in development or in pre-pro production, in development or in pre-pro production, in development or in pre-pro or in staging. So we never have to have or in staging. So we never have to have or in staging. So we never have to have access to production. So that as few access to production. So that as few access to production. So that as few people as possible have access to that people as possible have access to that people as possible have access to that secure data. This reduces your overall secure data. This reduces your overall secure data. This reduces your overall exposure level as an organization.

exposure level as an organization. exposure level as an organization. Number five, if you've had a databach or Number five, if you've had a databach or Number five, if you've had a databach or if it's been a long time, rotate all if it's been a long time, rotate all if it's been a long time, rotate all your keys and passwords. All your API your keys and passwords. All your API your keys and passwords. All your API keys, all your database passwords, keys, all your database passwords, keys, all your database passwords, everything. And you may say, "Well, I everything. And you may say, "Well, I everything. And you may say, "Well, I don't even know where all those are." don't even know where all those are." don't even know where all those are." There's a red flag. Figure it out. There's a red flag. Figure it out. There's a red flag. Figure it out. Document it. Make sure you know every Document it. Make sure you know every Document it. Make sure you know every single security entry, every single single security entry, every single single security entry, every single password, every single API, what it's password, every single API, what it's password, every single API, what it's used for, by who, who has access to it, used for, by who, who has access to it, used for, by who, who has access to it, when it was last changed, and how to when it was last changed, and how to when it was last changed, and how to change it. These should all be change it. These should all be change it. These should all be procedures. And I know we get busy, we procedures. And I know we get busy, we procedures. And I know we get busy, we don't do it. This is a great opportunity don't do it. This is a great opportunity don't do it. This is a great opportunity to change that. to change that. to change that. Put some security in place so that when Put some security in place so that when Put some security in place so that when it comes to rotating keys and password, it comes to rotating keys and password, it comes to rotating keys and password, it's just easy to do. When it's hard to it's just easy to do. When it's hard to it's just easy to do. When it's hard to do, here's what happens. Maybe you have do, here's what happens. Maybe you have do, here's what happens. Maybe you have an employee who goes rogue or, you know, an employee who goes rogue or, you know, an employee who goes rogue or, you know, gets frustrated organization and they gets frustrated organization and they gets frustrated organization and they end up being fired. So, security comes end up being fired. So, security comes end up being fired. So, security comes by, sends it to HR. HR says, "Hey, we're by, sends it to HR. HR says, "Hey, we're by, sends it to HR. HR says, "Hey, we're going to frog marsh you out of here. You going to frog marsh you out of here. You going to frog marsh you out of here. You can't have access to anything. We've can't have access to anything. We've can't have access to anything. We've locked down your passwords, all this all locked down your passwords, all this all locked down your passwords, all this all this stuff, right?"

this stuff, right?" this stuff, right?" But if your security keys for your But if your security keys for your But if your security keys for your database or your your Azure information database or your your Azure information database or your your Azure information or whatever these API keys, whatever or whatever these API keys, whatever or whatever these API keys, whatever these other things are, if they're hard these other things are, if they're hard these other things are, if they're hard to rotate, well, all of a sudden now you to rotate, well, all of a sudden now you to rotate, well, all of a sudden now you have an exposure window where you have a have an exposure window where you have a have an exposure window where you have a disgruntled worker who has had access to disgruntled worker who has had access to disgruntled worker who has had access to all these things, who might have written all these things, who might have written all these things, who might have written it down or might still remember a it down or might still remember a it down or might still remember a password, who could do things that you password, who could do things that you password, who could do things that you don't want done. This happens a lot. So, don't want done. This happens a lot. So, don't want done. This happens a lot. So, make sure it's very easy to change these make sure it's very easy to change these make sure it's very easy to change these things. Here's another thing. Maybe you things. Here's another thing. Maybe you things. Here's another thing. Maybe you have a a fellow co-orker that you love. have a a fellow co-orker that you love. have a a fellow co-orker that you love. They're great. They're awesome. And they They're great. They're awesome. And they They're great. They're awesome. And they just get a better opportunity. Maybe just get a better opportunity. Maybe just get a better opportunity. Maybe they're moving out of the country. Maybe they're moving out of the country. Maybe they're moving out of the country. Maybe they're, you know, moving to a different they're, you know, moving to a different they're, you know, moving to a different state and they found a great job state and they found a great job state and they found a great job somewhere else. There's no hard feelings somewhere else. There's no hard feelings somewhere else. There's no hard feelings at all. Everyone's happy. You have a at all. Everyone's happy. You have a at all. Everyone's happy. You have a party, etc. They leave. What's the first party, etc. They leave. What's the first party, etc. They leave. What's the first thing you should do? Change all the thing you should do? Change all the thing you should do? Change all the passwords. Now, is this because you hate passwords. Now, is this because you hate passwords. Now, is this because you hate them? No. Is this because you don't them? No. Is this because you don't them? No. Is this because you don't trust them? No. What this is is a trust them? No. What this is is a trust them? No. What this is is a security measure. It protects them and security measure. It protects them and security measure. It protects them and it protects you. I have been in it protects you. I have been in it protects you. I have been in situations where we trusted the person.

situations where we trusted the person. situations where we trusted the person. The person had no ill intent, but they The person had no ill intent, but they The person had no ill intent, but they still had access to a system they should still had access to a system they should still had access to a system they should not have had access to. And they wanted not have had access to. And they wanted not have had access to. And they wanted to help someone out. So, they accessed to help someone out. So, they accessed to help someone out. So, they accessed the system they should not have had the system they should not have had the system they should not have had access to. and they did things that were access to. and they did things that were access to. and they did things that were no longer the correct policy no longer the correct policy no longer the correct policy and because they didn't know because and because they didn't know because and because they didn't know because they had left. Well, now they have done they had left. Well, now they have done they had left. Well, now they have done something that caused a problem that something that caused a problem that something that caused a problem that blows back on them. They get blamed for blows back on them. They get blamed for blows back on them. They get blamed for something. They get in trouble for something. They get in trouble for something. They get in trouble for something that really what it was was something that really what it was was something that really what it was was just a allaround bad situation. They just a allaround bad situation. They just a allaround bad situation. They shouldn't have had access. They should shouldn't have had access. They should shouldn't have had access. They should have tried it and go, "Oh, that's right. have tried it and go, "Oh, that's right. have tried it and go, "Oh, that's right. I'm no longer employee there. I can't I'm no longer employee there. I can't I'm no longer employee there. I can't access it." they don't feel bad anymore access it." they don't feel bad anymore access it." they don't feel bad anymore telling the person they're trying to telling the person they're trying to telling the person they're trying to help, hey, I can't help you anymore. So, help, hey, I can't help you anymore. So, help, hey, I can't help you anymore. So, they don't feel bad and then you don't they don't feel bad and then you don't they don't feel bad and then you don't have to track down problems. You don't have to track down problems. You don't have to track down problems. You don't have this whole big issue because they have this whole big issue because they have this whole big issue because they did help somebody in the wrong way. So, did help somebody in the wrong way. So, did help somebody in the wrong way. So, rotate all your keys and passwords every rotate all your keys and passwords every rotate all your keys and passwords every time that person leaves on a routine time that person leaves on a routine time that person leaves on a routine schedule and definitely anytime you have schedule and definitely anytime you have schedule and definitely anytime you have any kind of disgruntled person. That's any kind of disgruntled person. That's any kind of disgruntled person. That's number five. Number six, reduce the number five. Number six, reduce the number five. Number six, reduce the amount of data you retain.

amount of data you retain. amount of data you retain. Companies tend to be hoarders when it Companies tend to be hoarders when it Companies tend to be hoarders when it comes to data. They store everything. comes to data. They store everything. comes to data. They store everything. And developers, we kind of encourage And developers, we kind of encourage And developers, we kind of encourage this. Hey, you know what? We might need this. Hey, you know what? We might need this. Hey, you know what? We might need this. We might need this. And before you this. We might need this. And before you this. We might need this. And before you know it, you have these massive know it, you have these massive know it, you have these massive databases where you're storing things databases where you're storing things databases where you're storing things indefinitely. When we used to store indefinitely. When we used to store indefinitely. When we used to store things in filing cabinets, it was a things in filing cabinets, it was a things in filing cabinets, it was a little easier because at some point little easier because at some point little easier because at some point we're like, we have too much stuff. And we're like, we have too much stuff. And we're like, we have too much stuff. And so we create a system to say hey every so we create a system to say hey every so we create a system to say hey every three years this gets archived every three years this gets archived every three years this gets archived every seven years these get deleted every 10 seven years these get deleted every 10 seven years these get deleted every 10 years this was hap this what happens years this was hap this what happens years this was hap this what happens because we knew we didn't have the because we knew we didn't have the because we knew we didn't have the physical space but when it's digital physical space but when it's digital physical space but when it's digital it's a little easier to say well we it's a little easier to say well we it's a little easier to say well we could store this you know forever. We could store this you know forever. We could store this you know forever. We don't need to have the order history don't need to have the order history don't need to have the order history with address and other sensitive with address and other sensitive with address and other sensitive personal identifiable information of a personal identifiable information of a personal identifiable information of a person who hasn't been an employee for person who hasn't been an employee for person who hasn't been an employee for or hasn't been a user for a decade, or hasn't been a user for a decade, or hasn't been a user for a decade, right? There has to be some type of of right? There has to be some type of of right? There has to be some type of of scenario where you say, you know what, scenario where you say, you know what, scenario where you say, you know what, we're going to archive off this data. It we're going to archive off this data. It we're going to archive off this data. It doesn't mean you delete the data. It doesn't mean you delete the data. It doesn't mean you delete the data. It might just mean that you put it into a might just mean that you put it into a might just mean that you put it into a different place that doesn't have direct different place that doesn't have direct different place that doesn't have direct access very often. and it might take access very often. and it might take access very often. and it might take some type of background job to retrieve some type of background job to retrieve some type of background job to retrieve that information. So maybe that person that information. So maybe that person that information. So maybe that person has been gone for a decade, maybe come has been gone for a decade, maybe come has been gone for a decade, maybe come back a year later. Well, you could have back a year later. Well, you could have back a year later. Well, you could have a system that says, "Okay, hey, we're a system that says, "Okay, hey, we're a system that says, "Okay, hey, we're going to retrieve your old information, going to retrieve your old information, going to retrieve your old information, but it might take a day or two and but it might take a day or two and but it might take a day or two and really it might take 15 minutes, really it might take 15 minutes, really it might take 15 minutes, whatever the case may be, but you have a whatever the case may be, but you have a whatever the case may be, but you have a background job that says, "Hey, let's go background job that says, "Hey, let's go background job that says, "Hey, let's go out to the repository. Let's find the

out to the repository. Let's find the out to the repository. Let's find the archived data. Let's look through it for archived data. Let's look through it for archived data. Let's look through it for this person. Let's repopulate the this person. Let's repopulate the this person. Let's repopulate the information, etc." But that way you're information, etc." But that way you're information, etc." But that way you're not storing on your server all the not storing on your server all the not storing on your server all the sensitive information that if you did sensitive information that if you did sensitive information that if you did have a data breach, all of it goes. You have a data breach, all of it goes. You have a data breach, all of it goes. You have to let people for the past decade have to let people for the past decade have to let people for the past decade know that you lost their information. know that you lost their information. know that you lost their information. Instead, try to retain as little as Instead, try to retain as little as Instead, try to retain as little as possible. You don't need every bit of possible. You don't need every bit of possible. You don't need every bit of data. Here's a key way to see if you data. Here's a key way to see if you data. Here's a key way to see if you need it. Do you use it? Do you use it? need it. Do you use it? Do you use it? need it. Do you use it? Do you use it? Do you actually use it? Not just a Do you actually use it? Not just a Do you actually use it? Not just a display. Do you actually use it for display. Do you actually use it for display. Do you actually use it for something? something? something? What you could do, for example, yes, my What you could do, for example, yes, my What you could do, for example, yes, my Amazon history, my purchase history, Amazon history, my purchase history, Amazon history, my purchase history, yeah, that's something that is probably yeah, that's something that is probably yeah, that's something that is probably important because I can go back and say, important because I can go back and say, important because I can go back and say, "Hey, when did I last purchased this?" "Hey, when did I last purchased this?" "Hey, when did I last purchased this?" And it may have been six years ago, but And it may have been six years ago, but And it may have been six years ago, but my search history, no, that's not my search history, no, that's not my search history, no, that's not important. Get rid of it after 30 days important. Get rid of it after 30 days important. Get rid of it after 30 days or 60 days because at that point, it's or 60 days because at that point, it's or 60 days because at that point, it's no longer relevant. And there's other no longer relevant. And there's other no longer relevant. And there's other things as well. what I watched all all things as well. what I watched all all things as well. what I watched all all the things that it's not highlevel the things that it's not highlevel the things that it's not highlevel important data. So figure out how to important data. So figure out how to important data. So figure out how to identify what's important, what's not.

identify what's important, what's not. identify what's important, what's not. Even if you say, you know what, you Even if you say, you know what, you Even if you say, you know what, you watched this movie, but we didn't track watched this movie, but we didn't track watched this movie, but we didn't track how far into it you watched. We didn't how far into it you watched. We didn't how far into it you watched. We didn't track where you left off because it's track where you left off because it's track where you left off because it's been a year. So we tracked that. Yes, been a year. So we tracked that. Yes, been a year. So we tracked that. Yes, you watched it. It's just one bit in the you watched it. It's just one bit in the you watched it. It's just one bit in the database. Whereas where you wa, you database. Whereas where you wa, you database. Whereas where you wa, you know, how long you watched it for, where know, how long you watched it for, where know, how long you watched it for, where you left off, etc. That's just you left off, etc. That's just you left off, etc. That's just information you don't need to keep. It's information you don't need to keep. It's information you don't need to keep. It's additional storage. Okay. Number seven, additional storage. Okay. Number seven, additional storage. Okay. Number seven, check every boundary. So if you have two check every boundary. So if you have two check every boundary. So if you have two applications and they talk to each applications and they talk to each applications and they talk to each other, other, other, make sure that communication is secure. make sure that communication is secure. make sure that communication is secure. Whether it be using HTTPS, whether it be Whether it be using HTTPS, whether it be Whether it be using HTTPS, whether it be credentials, whether it be some type of credentials, whether it be some type of credentials, whether it be some type of authentication, encryption system, authentication, encryption system, authentication, encryption system, whatever the case may be, check between whatever the case may be, check between whatever the case may be, check between the systems. This is where people get in the systems. This is where people get in the systems. This is where people get in is in the boundaries where they sit is in the boundaries where they sit is in the boundaries where they sit between two things. Maybe they listen between two things. Maybe they listen between two things. Maybe they listen for that communication between each for that communication between each for that communication between each other or whether they can impersonate other or whether they can impersonate other or whether they can impersonate one thing to talk to another thing.

one thing to talk to another thing. one thing to talk to another thing. Check every boundary. Which is why Check every boundary. Which is why Check every boundary. Which is why microservices are the worst in this type microservices are the worst in this type microservices are the worst in this type of situation of situation of situation because there's lots of boundaries. because there's lots of boundaries. because there's lots of boundaries. There might be thousands of different There might be thousands of different There might be thousands of different ways to connect to all these different ways to connect to all these different ways to connect to all these different systems. That can be a massive security systems. That can be a massive security systems. That can be a massive security nightmare. So be very careful. You might nightmare. So be very careful. You might nightmare. So be very careful. You might say, "Well, our microservices are all say, "Well, our microservices are all say, "Well, our microservices are all internal." Guess what? So are your users internal." Guess what? So are your users internal." Guess what? So are your users and not all of those should you trust. and not all of those should you trust. and not all of those should you trust. Not all of your admins should you trust. Not all of your admins should you trust. Not all of your admins should you trust. So let's make sure you check every So let's make sure you check every So let's make sure you check every boundary to make sure that you're not boundary to make sure that you're not boundary to make sure that you're not leaking information, that you're not leaking information, that you're not leaking information, that you're not leaving a hole open for someone to leaving a hole open for someone to leaving a hole open for someone to exploit. And if you do find, hey, we exploit. And if you do find, hey, we exploit. And if you do find, hey, we didn't do this, look at every other didn't do this, look at every other didn't do this, look at every other boundary to see if that same thing was boundary to see if that same thing was boundary to see if that same thing was occurred in other boundaries as well. occurred in other boundaries as well. occurred in other boundaries as well. Number eight, check your logs for Number eight, check your logs for Number eight, check your logs for sensitive data. sensitive data. sensitive data. Logging is a good thing. Logging helps Logging is a good thing. Logging helps Logging is a good thing. Logging helps you track down errors. Log having good you track down errors. Log having good you track down errors. Log having good logs that really give you a sense of logs that really give you a sense of logs that really give you a sense of what was going on before an issue what was going on before an issue what was going on before an issue occurred, during the issue, and after occurred, during the issue, and after occurred, during the issue, and after the issue. Really, really helpful. And the issue. Really, really helpful. And the issue. Really, really helpful. And too often what you'll find is when too often what you'll find is when too often what you'll find is when you're trying to track down an issue, you're trying to track down an issue, you're trying to track down an issue, the logs weren't detailed enough. And the logs weren't detailed enough. And the logs weren't detailed enough. And that's frustrating. But your logs are a that's frustrating. But your logs are a that's frustrating. But your logs are a place to accidentally send out sensitive place to accidentally send out sensitive place to accidentally send out sensitive information. So let's say you have an information. So let's say you have an information. So let's say you have an exception where a user is filling a form exception where a user is filling a form exception where a user is filling a form out and they fill out this data out and they fill out this data out and they fill out this data including maybe their phone number, including maybe their phone number, including maybe their phone number, their social security number, something

their social security number, something their social security number, something else is sensitive and they fill out the else is sensitive and they fill out the else is sensitive and they fill out the whole thing out, but they put some kind whole thing out, but they put some kind whole thing out, but they put some kind of data in there that crashes the of data in there that crashes the of data in there that crashes the application. It shouldn't, but let's say application. It shouldn't, but let's say application. It shouldn't, but let's say it does. and your log catches that it does. and your log catches that it does. and your log catches that exception and stores all the data that's exception and stores all the data that's exception and stores all the data that's in the form. Well, that might include in the form. Well, that might include in the form. Well, that might include the phone number, the person's name, the the phone number, the person's name, the the phone number, the person's name, the person's address, their social security person's address, their social security person's address, their social security number, or other sensitive information. number, or other sensitive information. number, or other sensitive information. Now, that's in the log files, not just Now, that's in the log files, not just Now, that's in the log files, not just in your database. Now, your log files in your database. Now, your log files in your database. Now, your log files probably have a different level of probably have a different level of probably have a different level of security than your database does. Maybe security than your database does. Maybe security than your database does. Maybe your entire development team has access your entire development team has access your entire development team has access to your logs where almost none of your to your logs where almost none of your to your logs where almost none of your developers have access to production developers have access to production developers have access to production data. So all of a sudden you've exported data. So all of a sudden you've exported data. So all of a sudden you've exported this secure information to a less secure this secure information to a less secure this secure information to a less secure information place. So that's a problem. information place. So that's a problem. information place. So that's a problem. Check your logs. Make sure you're not Check your logs. Make sure you're not Check your logs. Make sure you're not capturing sensitive information. And if capturing sensitive information. And if capturing sensitive information. And if you are, delete it. Figure out how to you are, delete it. Figure out how to you are, delete it. Figure out how to get rid of it. Obuscate it. You know, get rid of it. Obuscate it. You know, get rid of it. Obuscate it. You know, swap it out. So when you're capturing swap it out. So when you're capturing swap it out. So when you're capturing things that are sensitive, maybe put things that are sensitive, maybe put things that are sensitive, maybe put stars in their place. Whatever the case stars in their place. Whatever the case stars in their place. Whatever the case may be, make sure that you clean the may be, make sure that you clean the may be, make sure that you clean the data in your logs. Clean it out of data in your logs. Clean it out of data in your logs. Clean it out of anything sensitive.

anything sensitive. anything sensitive. Number nine, update what you log to make Number nine, update what you log to make Number nine, update what you log to make it easier to catch problems. So yeah, it easier to catch problems. So yeah, it easier to catch problems. So yeah, sometimes that means more log sometimes that means more log sometimes that means more log statements, but realistically going back statements, but realistically going back statements, but realistically going back to what we talked about with reducing to what we talked about with reducing to what we talked about with reducing the data, what do you actually use of the data, what do you actually use of the data, what do you actually use of your logs? your logs? your logs? Too often people say, "Well, I need to Too often people say, "Well, I need to Too often people say, "Well, I need to catch every single problem and I need to catch every single problem and I need to catch every single problem and I need to make sure I can track all these things make sure I can track all these things make sure I can track all these things and you have massive logs that you never and you have massive logs that you never and you have massive logs that you never look at or the only thing you look at is look at or the only thing you look at is look at or the only thing you look at is a graph where you say, "Oh, the number a graph where you say, "Oh, the number a graph where you say, "Oh, the number of exceptions has gone down recently or of exceptions has gone down recently or of exceptions has gone down recently or whatever the case may be." That's not whatever the case may be." That's not whatever the case may be." That's not actually helpful and you're you're actually helpful and you're you're actually helpful and you're you're catching way too much stuff, which means catching way too much stuff, which means catching way too much stuff, which means you don't look at anything. It's better you don't look at anything. It's better you don't look at anything. It's better to have three log entries that are to have three log entries that are to have three log entries that are valuable than to have 300 where 30 of valuable than to have 300 where 30 of valuable than to have 300 where 30 of them might be valuable because you might them might be valuable because you might them might be valuable because you might not ever find those 30, but you'll see not ever find those 30, but you'll see not ever find those 30, but you'll see all three if there's only three. So, all three if there's only three. So, all three if there's only three. So, make sure that you log what is important make sure that you log what is important make sure that you log what is important and you make sure that you're making it and you make sure that you're making it and you make sure that you're making it easier to actually catch problems. That easier to actually catch problems. That easier to actually catch problems. That probably means reducing a lot of your probably means reducing a lot of your probably means reducing a lot of your logging. It also might mean adding some logging. It also might mean adding some logging. It also might mean adding some login too. That's that's for sure. But login too. That's that's for sure. But login too. That's that's for sure. But it probably means reducing a lot of your it probably means reducing a lot of your it probably means reducing a lot of your logging. Number 10, update your logging. Number 10, update your logging. Number 10, update your documentation on how to secure data.

documentation on how to secure data. documentation on how to secure data. This means when new developers come in, This means when new developers come in, This means when new developers come in, they know exactly how to, you know, they know exactly how to, you know, they know exactly how to, you know, scrub information that comes from the scrub information that comes from the scrub information that comes from the user. They know how to check the user. They know how to check the user. They know how to check the boundaries for any type of data loss. boundaries for any type of data loss. boundaries for any type of data loss. They know they know how to make sure They know they know how to make sure They know they know how to make sure they protect certain fields from going they protect certain fields from going they protect certain fields from going into the log files. All these things are into the log files. All these things are into the log files. All these things are important to document so you know very important to document so you know very important to document so you know very clearly how to do these things so that clearly how to do these things so that clearly how to do these things so that maybe your system is secure today but it maybe your system is secure today but it maybe your system is secure today but it [clears throat] might not be tomorrow [clears throat] might not be tomorrow [clears throat] might not be tomorrow when the new developer works on a new when the new developer works on a new when the new developer works on a new system. You want to make sure that system. You want to make sure that system. You want to make sure that you're secure today and in the future. you're secure today and in the future. you're secure today and in the future. So, there's my top 10 list. And you know So, there's my top 10 list. And you know So, there's my top 10 list. And you know what? That's not a comprehensive list. what? That's not a comprehensive list. what? That's not a comprehensive list. There's definitely more things you could There's definitely more things you could There's definitely more things you could you could do after a data breach you could do after a data breach you could do after a data breach depending on your circumstances, but depending on your circumstances, but depending on your circumstances, but this list is going to get you well on this list is going to get you well on this list is going to get you well on your way to securing your applications. your way to securing your applications. your way to securing your applications. The two biggest things that endanger The two biggest things that endanger The two biggest things that endanger your applications are obvious mistakes your applications are obvious mistakes your applications are obvious mistakes and compromised employees.

and compromised employees. and compromised employees. So obvious mistakes it's you know what So obvious mistakes it's you know what So obvious mistakes it's you know what we allowed users to just put whatever we allowed users to just put whatever we allowed users to just put whatever they want and we didn't check to make they want and we didn't check to make they want and we didn't check to make sure it's valid data. Obvious mistakes sure it's valid data. Obvious mistakes sure it's valid data. Obvious mistakes is we forgot to put HTTPS on the is we forgot to put HTTPS on the is we forgot to put HTTPS on the communication between those two communication between those two communication between those two microservices. Obvious mistakes is where microservices. Obvious mistakes is where microservices. Obvious mistakes is where you use a SA password the system you use a SA password the system you use a SA password the system administrator password on your administrator password on your administrator password on your connection string. These are all obvious connection string. These are all obvious connection string. These are all obvious mistakes. And then compromised employees mistakes. And then compromised employees mistakes. And then compromised employees might mean that yes, they're being might mean that yes, they're being might mean that yes, they're being blackmailed to do something. That's blackmailed to do something. That's blackmailed to do something. That's probably not, you know, the case probably not, you know, the case probably not, you know, the case normally. It may be that they're trying normally. It may be that they're trying normally. It may be that they're trying to be helpful and going places they to be helpful and going places they to be helpful and going places they shouldn't go. It may mean that they shouldn't go. It may mean that they shouldn't go. It may mean that they don't realize the danger and they just don't realize the danger and they just don't realize the danger and they just do something. It may mean that they're do something. It may mean that they're do something. It may mean that they're disgruntled and want to hurt you. the disgruntled and want to hurt you. the disgruntled and want to hurt you. the the ways that people can be compromised the ways that people can be compromised the ways that people can be compromised is pretty much endless, but these are is pretty much endless, but these are is pretty much endless, but these are the two biggest areas of security holes the two biggest areas of security holes the two biggest areas of security holes in your organization. It's not about the in your organization. It's not about the in your organization. It's not about the this dark, you know, hacker that's this dark, you know, hacker that's this dark, you know, hacker that's sitting in a back room that's got his sitting in a back room that's got his sitting in a back room that's got his whole team working on, you know, nuanced whole team working on, you know, nuanced whole team working on, you know, nuanced ways of getting in. You may have that, ways of getting in. You may have that, ways of getting in. You may have that, but that's not the most common thing.

but that's not the most common thing. but that's not the most common thing. The most common thing is that you make The most common thing is that you make The most common thing is that you make mistakes and leak data because of it. mistakes and leak data because of it. mistakes and leak data because of it. you make mistakes and it make it easy you make mistakes and it make it easy you make mistakes and it make it easy for a kid who's just learned how to do a for a kid who's just learned how to do a for a kid who's just learned how to do a basic SQL injection to access your basic SQL injection to access your basic SQL injection to access your system and access your data. Like these system and access your data. Like these system and access your data. Like these basic mistakes are a big part of data basic mistakes are a big part of data basic mistakes are a big part of data breaches. So this list is going to help breaches. So this list is going to help breaches. So this list is going to help you eliminate both those issues and it's you eliminate both those issues and it's you eliminate both those issues and it's going to make it harder for you to be going to make it harder for you to be going to make it harder for you to be breached. Now no system is breach proof breached. Now no system is breach proof breached. Now no system is breach proof but that's no excuse for making it easy. but that's no excuse for making it easy. but that's no excuse for making it easy. Make sure that you protect your system Make sure that you protect your system Make sure that you protect your system as much as possible. Thanks for as much as possible. Thanks for as much as possible. Thanks for listening. As always, I am Tim Corey. listening. As always, I am Tim Corey. listening. As always, I am Tim Corey. [music]