Why does the Capita data breach have something to teach every organisation about cyber security?
When a company has many clients for whom they do so many things, it stands to reason that threat actors will take an interest. One breach and the criminals get access to a wide range of information from many organisations and potential victims.
That’s the Capita data breach. Capita is the largest contracting company in the UK and works for many, many organisations, including the UK Government and the Ministry of Defence. These client organisations are now finding that information they entrusted to Capita has been stolen.
Such as Colchester City Council:
Colchester City Council investigating Capita over ‘serious data breach’ – BBC News
Are there any takeaways for you from the Capita Data Breach?
It is difficult. If you were looking for a contractor to deliver training courses on nuclear submarines, you would probably choose the largest contracting company in the country as you reasonably expect them to have excellent cyber security. And they probably do.
Nothing definitive has been said about the cause of the data breach, yet, but the speculation is that an employee’s Microsoft credentials were compromised and that gave the threat actors their way in.
So here are two takeaways:
- Make sure your people are training to recognise phishing and social engineering attacks. Especially emphasise the value of their credentials for Microsoft or any other systems or services.
- Follow the principle of least privilege when giving people access to systems.
Clive Catton MSc (Cyber Security) – by-line and other articles
Further Reading
Outsourcing company for the MoD suffers a “cyber incident” – Smart Thinking Solutions
