Recently, in a webinar panel discussion moderated by Juha Sallinen, the colossal data breach at Pegasus Airlines in 2022 came under the spotlight. Panel members included Nina Barzey, a lawyer and advocate, and Petri Aalto, a modern workplace and security solution architect.
The data breach of Turkish Pegasus Airlines in 2022 reignited discussions around unstructured data and the nuances surrounding its security, especially in cloud environments. With the breach compromising about 6.5TB of data, in this case equivalent to whopping 23 million file, the experts are pushing for better strategies and policies in handling such vast amounts of information. The exposed data was stored in an AWS S3 bucket – a cloud storage solution.
The discussion gravitated towards several vital questions: What measures should organizations adopt to avoid such breaches? Is cloud storage of personal information safe? Who holds the responsibility when such breaches occur?
Data Breach: The Case of Pegasus Airlines
Pegasus Airlines’ breach exposed approximately 23 million files, all stored in an AWS S3 bucket. The fact that such a large dataset was improperly secured and without any password in a cloud environment prompts crucial questions:
- Is it safe to store personal data in the cloud?
- How can breaches like this be prevented?
- What are the implications for individuals whose data has been leaked?
Architectural Challenges and Design Solutions
Petri Aalto, an expert on the panel, identified potential root causes of such breaches. He pointed out that many organizations opt for cloud storage simply because it’s economical. Other times, mergers, acquisitions, or data migrations drive the shift. Regardless of the reasons, if there’s no proper architectural design and risk assessment, such breaches are bound to occur. Another concern he raised was the possible absence of proper security processes when business units use personal credit cards to make cloud purchases.
Moreover, as businesses look to automate their operations, ensuring that security protocols are maintained and updated becomes paramount. Otherwise, the ease of cloud storage could be offset by the vulnerability it presents.
Legal Ramifications and International Data Transfers
While the advantages of cloud storage are evident, the legal complications cannot be ignored. Nina Barzey, another panellist, points out that businesses often overlook GDPR guidelines. For example, where data is stored becomes irrelevant if the organization isn’t clear about the nature of the data they possess. Barzey emphasized the importance of educating staff about data privacy rules. According to Barzey, even if top management is familiar with regulations like GDPR, it’s often the case that the general staff isn’t.
Barzey also pointed out that storing data in the cloud, especially sensitive information, poses severe challenges. These challenges range from the legal implications of international data transfers to ensuring proper oversight over sub-suppliers or IT suppliers. Furthermore, the transfer of data from one country to another, as in the Pegasus case where a Turkish company stored data on an American-based cloud, brings in complexities related to data privacy laws.
Recognizing and Addressing the Data Breach
One of the more pressing issues highlighted during the conversation was the responsibility that comes with data control. If a company, as a data controller, collects data from subjects, they must be accountable for how their IT suppliers manage that data, especially in a cloud environment. Without this insight, there’s a clear breach of data protection laws like GDPR.
“If you are a data controller who owns and collects data from data subjects, it’s imperative that you maintain oversight over any sub-suppliers, including IT providers. This is a primary reason why public authorities in Sweden often opt out of storing sensitive or integrity-sensitive data in the cloud; they can’t conduct a thorough legal analysis of all the data. Many major IT and cloud service providers don’t permit scrutiny of their internal operations. A breach occurs when an organization, such as one using a cloud, doesn’t maintain proper insight and control over stored data, violating GDPR guidelines. If you can’t oversee your sub-suppliers, it’s advisable not to engage them. However, the level of oversight might vary based on the data’s sensitivity, whether it’s highly confidential or basic details like contact information. Ultimately, the onus of responsibility rests with the data controller,” Barzey notes.
Such large-scale data breaches are alarming, primarily when they involve personal details. Barzey emphasizes the importance of notifying affected individuals, particularly when sensitive data, such as health-related information, is involved.
The Cloud Dilemma: Public vs. Private
Different cloud types bring various security measures. The debate between public and private clouds often centres on the kind of data being stored. Aalto suggests that the nature of the data should dictate the choice. For instance, sensitive data might be best placed in private clouds, while less critical data can reside in public clouds. Public clouds, private clouds, and on-premises services all have their pros and cons. The decision on which one to opt for should be rooted in an organization’s data strategy, considering the kind of data to be stored.
“The nature of the data largely dictates the choices we make. When considering the private or public cloud, decisions hinge on specific requirements. What do you expect from your service provider? There are ongoing debates regarding the security of public cloud services compared to in-house solutions. For instance, while we might consider using our own HSM module to encrypt data, we must also ensure that our encryption mechanisms and processes align with those in a public cloud environment,” Aalto summarized.
The Way Forward
In conclusion, the Pegasus Airlines breach serves as a potent reminder of the challenges and responsibilities tied to unstructured data. Summarizing the discussion, Juha Sallinen asserted that organizations must prioritize understanding their data and they need a robust data strategy. This strategy should define the type of data to be stored and the preferred storage mediums. Monitoring and ensuring adherence to this strategy is just as crucial.
An approach backed by legal compliance and accountability would likely yield a resilient data protection framework, minimizing the risks of breaches in the future. From a legal standpoint, Nina advocates continuous training. Ensuring staff understand the nature and importance of the data they handle is crucial for maintaining data integrity and security. Encrypting sensitive data and deploying techniques like data loss prevention can further enhance security.
Gain further understanding by viewing the entire webinar. Click here to view it for free!
Explore Further and delve into “Unstructured Data Threats and Expert Solutions” in our premier blog post. Click here to read more!
Meet the Webinar Panellists
Juha Sallinen: Founder and manager of GDPR Tech, Juha brings to the table a deep understanding of data protection and its real-world applications.
Nina Barzey: Hailing from Sweden, Nina is a seasoned lawyer who spearheads her own advocate bureau. A specialist in data privacy law, she’ll be shedding light on the legal intricacies of our discussion.
Petri Aalto: Based in Finland, Petri is a solution architect with a rich history of crafting and implementing global architectural designs. His vast experience with various global organizations offers a unique perspective on today’s topics.