Ai Editorial: How to prevent “Starwood guest database breach” -like incidents?

First Published on 3rd December, 2018

Ai Editorial: One question that organizations need to dig deep into is – how to go for end-to-end protection for the sensitive data an organization has and how to prevent a data breach? Ai’s Ritesh Gupta looks into it.  


It’s frightening. The number as well as the scale of data breaches is now large enough to scare possibly every organization. Marriott acknowledging Starwood guest reservation database security incident exemplifies the precarious situation pertaining to cybersecurity today.  

The list of post data breach initiatives is a laborious task. Right from analyzing how it happened to what all was stolen to data breach disclosure and informing customers to implementing security measures after the attack, it is a rough ride for many.

One question that organizations need to dig deep into – how to go for end-to-end protection for the sensitive data an organization has and how to prevent a data breach? Even as one might think over whether data could ever be 100% secure, organizations can’t halt and have to assess how to inch closer to it or bridge a possible loophole? For instance, what’s the weakest point that hackers can go for? Common ways are malware infiltration and phishing.

Stronger protection

This year’s list of impacted airlines includes British Airways and Cathay.

Be it for Marriott/ Starwood or any travel company, what is at stake is possibly what an organization is all about – customers and their data. According to Marriott, the database:

“…contains information on up to approximately 500 million guests who made a reservation at a Starwood property.  For approximately 327 million of these guests, the information includes some combination of name, mailing address, phone number, email address, passport number, Starwood Preferred Guest (“SPG”) account information, date of birth, gender, arrival and departure information, reservation date, and communication preferences.  For some, the information also includes payment card numbers and payment card expiration dates, but the payment card numbers were encrypted using Advanced Encryption Standard encryption (AES-128).  There are two components needed to decrypt the payment card numbers, and at this point, Marriott has not been able to rule out the possibility that both were taken.”

Encryption for personal information

Clearly the days of relying on a simple encryption method are over. In encryption, data is hidden using a coding system that swaps one number or letter for a dissimilar one using a refined encryption algorithm. Encryption of personal data is must and this should span at all possible points where it exists. For this, be aware of where data resides and evaluate cloud settings, big data as well as web storehouses, file systems databases and virtualization implementations.

Companies need to assess latest developments pertaining to database and file encryption.

·          It is imperative to assess what field-level encryption stands for, and once data is encrypted, how systems in a company’s architecture only end up viewing the Ciphertext (it is also known as encrypted or encoded information because it contains a form of the original plaintext that is unreadable by a human or computer without the proper cipher to decrypt it).

·          Also, cybersecurity-savvy organizations are looking at automating encryption deployment and management. Specialists point out that data needs to be encrypted even when it is processed by databases or cached in memory. This can be a critical step as it also cuts down on the risk of access to data owing to the staff’s credentials getting compromised, as data would only be available via authentic applications. (As explained by Microsoft Azure, the state of data at “rest” refers to all information storage objects, containers, and types that exist statically on physical media, whether magnetic or optical disk; in “transit” when data is being transferred between components, locations, or programs). A key is to encrypt application data sent to the database and decrypt query results when it is returned by the database to the application.

Other measures

The role of tokenization, too, needs to be looked at. Even if tokens were to be hacked, it promises to shield credit card numbers or any other critical customer data as none of it would be available for access.

Organizations aren’t only looking at shielding sensitive data, but also to meet regulatory or compliance responsibilities that entail implementation of precise key management controls. It is important to focus on key management process and plan for control of keys that access and encrypt data.

Other than encryption, do plan for a robust user management system. Put in place an incisive access control-mechanism to ensure that only authorized accounts and processes can view the data. Also, gear up for supervision of authorized accounts accessing data, to make sure the same have not been compromised.

The issue of breaches happening due to stolen and/or weak passwords can’t be ignored, too.

The approach needs to be sophisticated. Focus on developing capabilities that can stop attackers at each step of the way to help prevent the theft of data in a breach. Other than investment in cybersecurity technologies, organizations have to hire and retain skilled personnel to form a robust end-to-end protection strategy for sensitive data. Otherwise, it could end up being yet another horrendous data breach story.


Follow Ai on Twitter: @Ai_Connects_Us