Heathrow USB data breach

Following on from an unprecedented data breach, Heathrow Airport is currently in the midst of an investigation that saw crucially sensitive information found on a USB stick dropped in the street.

Hitting headlines across the country, this breach has thrown IT security back into the spotlight, following on from some very high profile Ransomware attacks such as the NHS attack earlier this year.

The USB stick, which was reportedly dropped in the street by an employee and picked up by a passer-by, was packed full of critical security data from the organisation including detailed security arrangements for London Heathrow airport. 

The most alarming part of this breach is that this USB stick contained the Queen’s precise route for when she passes through the airport. A devastatingly crucial piece of information that could land Heathrow in some real hot water.

This will be a disaster for Heathrow and its reputation, especially an airport whose main concern should be security in all things, but it’s also a stark example for other UK businesses. It highlights how important it is to understand how data can move around people and devices and more importantly how it MUST be secured.

It’s reported that many of the documents contained in the USB stick were labelled as confidential or restricted. It’s therefore ironic that these documents weren’t even password protected or encrypted, an open door to any Tom, Dick and Harry without malicious intent and a real bingo for cyber criminals looking for a potentially colossal pay out from Heathrow.

There are so many questions surrounding this shocking and unforeseen breach; why was such sensitive data put onto a USB stick? Why was it taken off-site? Why were the documents not properly protected?

In terms of why the data was moved onto a USB stick, there are multiple aspects to consider. Firstly human error, there was a serious lack in judgement to do this and then take it off-site. There’s also a lack of awareness and understanding within the organisation if staff think it appropriate to freely move sensitive information from a secure environment.

There are technologies available that can combat human error and or lack of awareness. Data loss prevention solutions have the ability to prevent employees from moving information in the first place. For example DLP (data loss prevention) renders any attempts to copy a restricted document onto a USB drive impossible (or any other device for that matter).

The man who found the USB stick happened upon a real treasure trove of information, luckily for Heathrow he was an innocent passer-by not looking for financial gain. Other organisations have not been so lucky, cyber criminals looking to maliciously attack businesses are consistently looking for holes in your systems in order to steal data and ultimately hold you to ransom. So keeping your data safe is paramount.

Encryption, had it been in place, would have safeguarded the information on the lost USB stick. Data encryption is a highly effective way to secure data you don’t want people to be able to access outside of your organisation. Encryption is essentially translating your information into a code that can be unlocked for those with access, but has the ability to keep anyone out that shouldn’t be trying to gain access.

Some features of encryption solutions such as Sophos SafeGuard are:

Preventing unauthorised users accessing lost or stolen company data, this could be a disgruntled ex-employee, human error or intentional – if your workforce isn’t fully aware of the IT security risks

Encryption can work in the background to prevent impact on users. Securing data is vital but so is staff being able to access what they need in order to work effectively.

Reporting features are massively valuable so businesses can clearly see the security status on all devices. This is important to be able to audit and monitor compliance. When GDPR comes into place in May 2018 you will have to supply evidence to the Information Commissioners Office (ICO) should a data breach occur, these report can do that for you.