Uber Breach a Case Study in Awful Cyber and Business Ethics

The Uber breach, which compromised the data of 57 million drivers and customers worldwide, has just gone from bad to worse. Not only did the company wait for a year to disclose the hack, it scrambled to cover it up by forking over $100,000 in hush money to the hackers – which it funneled through its bug bounty program, no less, possibly in an attempt to keep the entire incident off regulators’ radar. As a result, Uber was facing multiple lawsuits, as well as investigations by governments in several countries.

Now, former Uber security analyst Ric Jacobs is accusing the company of having engaged in KGB-level corporate espionage. In a 37-page letter that has been submitted in the lawsuit competitor Waymo filed against Uber, accusing the latter of having stolen its company secrets, Jacobs claims he witnessed Uber engaging in all manner of unethical and, in some cases, illegal cyber spying, including:

• Hacking into an unnamed competitor’s database to obtain information on their employees for purposes of poaching.
• Hacking into a second company’s database to “steal ideas, exploit any identifiable weaknesses and identify drivers in order to recruit them to Uber.”
• Hacking mobile devices and networks to obtain metadata on opposition figures, politicians, and government regulators.
• Engaging in social engineering tactics to infiltrate private online groups for Uber drivers.
• Recruiting third-party vendors to steal information.
• Recording phone calls and bugging hotel and conference facilities.

A veritable case study in poor cyber security practices, awful data governance and risk management, and the consequences of having no cyber or business ethics, both the Uber breach and the newest allegations being leveled against the company contain cyber security lessons for us all.

Cyber Security Lessons from the Newest Allegations Against Uber

When news of the Uber breach first broke, the focus was on the data governance and risk management mistakes Uber made that led to the hack, such as including login credentials in software code and storing the code on a Github repository, and the company’s attempts to hide the breach instead of promptly disclosing it The newest allegations have some things to teach everyone, too:

• The threat of cyber espionage and digital IP theft is quite real, regardless of the industry you operate in. Whether it’s employee data, a secret recipe, or a proprietary app, all companies have digital IP and trade secrets that other companies want to steal.
• The biggest vulnerability in your cyber security program is your own people. According to the court filing, Uber heavily engaged in social engineering tactics to steal information.
• Hackers may target your third-party vendors to get at your company.
• Securing employees’ mobile devices is just as important as securing your enterprise network and equipment.

Whether Uber will survive this latest firestorm is questionable, especially since, in a settlement with the FTC following a 2014 hack, Uber agreed to “not misrepresent in any manner, expressly or by implication… the extent to which Respondent protects the privacy, confidentiality, security, or integrity of any Personal Information.” At the time this settlement was being negotiated, Uber was in the process of covering up the 2016 hack, as well as possibly engaging in the cyber spying activities Jacobs has accused it of.

Notably, Uber’s failure to disclose, in and of itself, would be illegal under the EU’s new GDPR data privacy rules, set to take effect next May. As the Uber breach drama continues to unfold, don’t be surprised to see calls for similar data privacy legislation in the U.S.

The cyber security experts at Continuum GRC have deep knowledge of the cyber security field, are continually monitoring the latest information security threats, and are committed to protecting your organization from security breaches. Continuum GRC offers full-service and in-house risk assessment and risk management subscriptions, and we help companies all around the world sustain proactive cyber security programs.

Continuum GRC is proactive cyber security®. Call 1-888-896-6207 to discuss your organization’s cyber security needs and find out how we can help your organization protect its systems and ensure compliance.

Data Governance Is at the Core of GDPR Compliance

Organizations have until May 25, 2018, to comply with the EU’s new General Data Protection Regulation (GDPR). Arguably the most comprehensive, far-reaching data privacy law passed to date, the GDPR grants European consumers numerous new data privacy rights and places new data governance responsibilities on organizations.

Similar to HIPAA, the GDPR is light on technical specifics and heavy on end results. Organizations are told what they have to achieve, but not how to make it happen. Because every organization’s risks, vulnerabilities, cyber ecosystem, and data environment are different, the specific technical processes and controls they use to achieve GDPR compliance will vary. However, one thing will be consistent: The way in which affected organizations process, store, and protect their customers’ personal data will be altered, perhaps fundamentally.

Here are some of the key elements of the GDPR that may force significant changes to your company’s data governance:

International Reach

Think that because your company has no locations in the EU, it doesn’t have to worry about GDPR compliance? Think again. The GDPR applies to all companies that sell goods or services to individuals or organizations located in the EU or that “monitor[s] the behaviour of EU data subjects,” regardless of where the company is located. If your company has even one customer located in the EU, you must handle that customer’s data according to the GDPR.

Impact Assessments

Organizations must conduct impact assessments to identify risks to EU citizens’ data and specify how they are addressing those risks.

Sweeping Consumer Data Privacy Rights

EU citizens are granted a number of data privacy rights under the GDPR, including:

• Consent: Organizations must obtain EU citizens’ consent to use and store their data, and they must clearly explain how the data will be used. Further, the data must be necessary to the completion of a task or transaction that the individual initiated.
• Right to Access: Upon request, organizations must tell EU citizens what personal data they are using and how they are using it.
• Data Portability: Upon request, organizations must furnish EU citizens’ personal data in a “commonly used and machine readable format” so that it can be transferred from one company to another.
• Right to Be Forgotten: EU citizens will have the right to have their personal data deleted upon request; further, the organization must stop sharing the data with third parties.

Strict Data Breach Reporting Requirements

To prevent situations like the Equifax breach and the Uber hack, where compromised consumers were left in the dark for some time, the GDPR requires companies to notify both the authorities and affected customers within 72 hours of detecting a breach.

Accountability for Third-Party Vendor Breaches

Under the GDPR, organizations whose third-party vendors get breached won’t be able to pass the buck; it will be up to your company to ensure that your contracts with those vendors comply with the GDPR.

Privacy By Design

The GDPR requires that companies bake data security into their products, policies, procedures, and systems from day one.

“Reasonable” Levels of Security & Privacy

Under the GDPR, organizations will have to provide “reasonable” levels of data privacy and protection to EU customers. However, what is considered “reasonable” is not defined.

Data Protection Officer (DPO) Requirement

Organizations that are public authorities, “engage in large scale systematic monitoring,” or “engage in large scale processing of sensitive personal data” will need to hire or appoint a DPO to oversee GDPR compliance and overall data security.

Complying with the GDPR

If you’re concerned about the costs involved with GDPR compliance, you’re not alone. The International Association of Privacy Professionals (IAPP) estimates that Fortune 500 companies will spend a combined $7.8 billion on GDPR compliance, and medium-sized firms will spend an average of $550,000. However, the costs of non-compliance are much higher; violators can be fined up to 4% of their annual global turnover, or 20 million euros (approximately USD $24 million).

The best way to mitigate initial GDPR compliance costs, and ensure continued compliance going forward, is to employ a GRC automation solution such as Continuum GRC’s IT Audit Machine (ITAM). The ITAM puts everything under one umbrella, giving you a centralized repository of all IT compliance requirements, with associated controls and automated information flow for audits, assessments, and testing.

The cyber security experts at Continuum GRC have deep knowledge of the cyber security field, are continually monitoring the latest information security threats, and are committed to protecting your organization from security breaches. Continuum GRC offers full-service and in-house risk assessment and risk management subscriptions, and we help companies all around the world sustain proactive cyber security programs.

Continuum GRC is proactive cyber security®. Call 1-888-896-6207 to discuss your organization’s cyber security needs and find out how we can help your organization protect its systems and ensure compliance.