Sub-Par Network Security and How the Panama Papers Brought it to Light
Judging from the volume of leaked information, the data breach at the Panamanian law firm Mossack Fonseca is the largest. The leaked Panama papers highlight how numerous high-ranking politicians, their close associates, and relatives from more than 40 countries like; India, Russia, France, U.K and China use offshore companies to hide income and evade tax payments. The leakage includes; 4.8 million emails, 2.2 million PDF’s, 3 million database format files, 320 text documents and 1.1 million images that date back from the 1970s to late 2015.
HOW THE LEAKAGE HAPPENED
According to a Mossack Fonseca’s representative, the leakage is as a result of an email hack that they still do not understand how it occurred. However, independent security experts suggest that Mossack had not encrypted its emails with Transport Layer Security Protocols for protection against hackers. Experts highlight that judging from the amount of leaked information, the server might have been compromised.
Additionally, the hackers could have compromised the entire organization’s network and elevated their privileges to domain or email administrator. They then took advantage of the privileges and downloaded all the crucial data stored in the email server.
Some security experts are of the opinion that Mossack Fonseca was the victim of a spear-phishing attack whereby, an email released malware that gave leeway to the firm’s network. This would support Fonseca’s statement that hack was not an inside job since no insider would unleash the malware knowingly or email it to potential hackers.
However, it does not really matter how the information was obtained. The information was not segmented, its access was not restricted to certain people, it was not encrypted, and nobody was monitoring the organization’s traffic. Thus, once the hackers found their way in the system, they had access to all the information they needed.
Thus, the firm is partly to blame for the leakage. There was no security measure to limit the information accessible to anyone who accessed the network. The hackers had access to all organizational information including highly confidential and private information of some clients.
Worse still, there was nothing to detect intrusion. Anyone could have walked into the law firm’s offices and copy the information which could have taken hours. However, if the breach happened remotely as it is claimed, the hacker needed weeks to siphon all that information.
This implies that the tax security practices at Mossack might have played a major role. Because hackers could not have managed to draw off all that data without attracting attention. Even if the firm could not have eliminated the breach, they could have minimized the damage. This is the second time the company’s information has been compromised.
Over a year back, a hacker grabbed a small portion of their internet records and sold it to German authorities.
Mossback Fonseca has distanced itself from any wrongdoing. They insist that they are a legal company that assists clients to set up legitimate offshore companies. While they may be victims of a security breach, nothing contained in the leaked information is illegal. The company promised to unravel the guilty parties to ensure justice prevails.
Just remember how all of this could have been avoided. A good IT team with their eye on security. Don’t let sub-par network security cost you everything.