Macy’s Unhappy Thanksgiving – Unauthorized Application Causes Data Breach
November 20, 2019
March 31, 2020
Macy’s reported an unauthorized data breach, includingcustomer’s financial information due to an unauthorized third-party installingcode to its macys.com website to capture checkout and wallet information. Thesetypes of acts can remain undetected for long periods and return troves of datafor thieves to mine and sell.
Inserting an unauthorized application within the dataworkflow has become a widespread exploit for servers and point of sale devices.Hy-Vee, Huddle House, DiscountMugs.com, Checkers, OXO, Graeters Ice Cream, andthe Atlanta Hawks are just a few recent examples of this exploit.
Regardless of the type of data and the unique workflows datamay have, companies should aim toward a data workflow where data is alwaysprotected. A persistent data protection solution that protects data at rest, intransit, and in use. The protection should expand to include access control forusers, devices, and applications. Proper application access control can preventthe type of data loss seen at Macy’s.
Application access control would enable companies todetermine which applications have access to protected data and which do not.Administrators could enforce that protected PDF files can only be viewed byAdobe Acrobat. Eliminating the risk of employees using PDF to Word convertersdownloaded off the Internet, which are known to have malware and send copies ofdata to third parties.
SecureCircle’s Data Access Security Broker (DASB) eliminatesattacks via unauthorized applications by delivering data-centric accesscontrol. Data remains persistently protected without impacting applications,workflow, or end-user experience.
With SecureCircle, protected files are never decrypted evenin use. Users can utilize Save-As, and derivative works will also be protectedautomatically. Administrators control access policies for applications,devices, and users without permissions that can change at any time.
With SecureCircle’s DASB, organizations can eliminateunauthorized application threats.
Prevent Data Breaches
Let’s discuss your unique cybersecurity challenges and needs.