Data Vulnerabilities and Risk

Before the spring season, a parent who works in IT looked over where the soccer league keeps its data and wrote up four findings. The league has about 900 players and one part-time registrar; everyone else is a volunteer.

Suppose the laptop goes missing at a tournament. What would the person who picks it up need in order to read finding 1's files?

The finder needs no password at all. The password guards the sign-in screen, and encryption is what would stand between the drive and its files, so anyone who starts the laptop from a USB stick, or pulls its drive and plugs it into another computer, can read every child's medical notes.

Finding 4's data matters less, but its sign-in is a problem of its own. Every volunteer uses the same account, and it is an administrator. Whoever learns its password from any one of them controls the whole machine, with its programs and every file on it, including anything more sensitive that someone saves there later.

Finding 3 is weak in a different way. Nobody would steal a drill library, but any of a few hundred volunteer accounts can rewrite or empty it, and so can anyone who takes over one of those accounts.

Each finding threatens something different. The medical notes are a confidentiality problem, since the harm is someone reading them. The drill library is an integrity and availability problem, since the harm is someone changing it or wiping it out.

Finding 2 is a confidentiality problem, like finding 1. Finding 4 could turn into any of the three, because an administrator can read, change, or delete whatever the machine holds.

Rate the four findings that way.

Children's medical notes and birth dates are about as sensitive as the league's data gets, and a laptop passed from coach to coach at crowded fields is likely to go missing at some point, so finding 1 is high. Finding 2 is moderate: the forms are sensitive and they are locked, but a 56-bit key is a length retired years ago, because computers can try every possible key in hours. Finding 4 can look like the worst of the four, since one leaked password hands someone a whole machine as its administrator. The rating starts from the data, though, and findings 3 and 4 are low, since neither the drills nor the minutes are sensitive, although both weaknesses should still be fixed. The ratings set the order of the work: finding 1 this week, finding 2 before the season starts, and the low ones as volunteers have time.

Microsoft AI researchers posted the code for a research project on GitHub, a public site for sharing code, in July 2020. The post included a link for downloading their trained AI models from Microsoft's cloud storage. Cloud storage is space on computers in a cloud provider's data centers, rented out to customers and reached over the internet. A storage account is one customer's share of it, with its own web address.

The link carried a token, a long string that grants access to whoever holds it. This token covered the entire storage account rather than the folder of models. It granted full control, so anyone with the link could delete or overwrite files as well as read them, and in October 2021 its expiry date was pushed out to 2051.

The account held 38 terabytes of other data. Among it were backups of two former employees' computers, with passwords to Microsoft services, private keys, and more than 30,000 internal messages from 359 employees. Researchers at Wiz, a cloud security company, found the link in June 2023 and reported it. How would this exposure rate?

Private keys and passwords to Microsoft services are as sensitive as anything a company holds, and the link sat on a public page, meant to be clicked, for almost three years, so someone finding it was close to certain. That makes the exposure high. It was an integrity risk as well, because full control meant an adversary could have replaced the models with altered ones that the people downloading them would have trusted.

Microsoft revoked the token two days after the report and said no customer data had been exposed. Microsoft said its own scanning for leaked secrets had caught the link, but the finding had been marked a false alarm. Afterward Microsoft said it had widened that scanning to catch links that grant more access than they should.