Perimeter security has historically provided the analogy of protecting the keys to the kingdom for Enterprises. Once you have been approved to enter the drawbridge which typically consists of verifications such as password, VPN, 2-Factor, a user can have access to all the data and applications within the castle. However once you are in the […]

We have built and/or integrated various machine learning (ML) models over the years within Financial Services. The success of these projects generally lie in tight requirements and good data quality. Following are some takeaways based on NLP work we did for an investment bank’s trading desk based in NYC (used with permission of course). Reason […]

Pressure leads to shortcuts. Commenting in code is one of those shortcuts and shortcuts can introduce risks. A typical issue with commented code? Confidential data is left exposed. Maybe the programmer intended to edit it out – or simply didn’t think of it as consequential. Comments with exposed data is not a huge issue when […]

Large number of businesses leverage offshore technology teams. However, very few of those companies have data governance on customer data nor understanding of the cyber-security risks involving some amazing and cheap talent. Chances of breaching GDPR, CCPA and other global privacy regulations is high when working with offshore development teams.  Risks of working with remote and […]

Client facing Slack and Zoom channels are especially useful for the direct and safe communication and support environment. For this reason, these client-facing chat rooms can also act as sources of sensitive data leaks, commercial chatter that could affect stock price or highly confidential data that stays is memorialized in ‘history’. Efficiency and organization at […]

Many Slack users are unaware of the permissions that may become enabled when third-party applications are linked with one’s Slack account. According to the Slack Help Center, “an app’s permission scopes depend on the kinds of things it’s supposed to do.”  Typically, such permissions may encompass the ability to view information, post information, and carry out […]

In the US alone, the overall cost of healthcare breaches in 2019 was US$ 11.8 billion (£9.2 billion) – more than double the 2018 figure, & healthcare breach discovery time is the longest for any industry. Technology and process audits such as SOC2, ISO and HIPAA compliance certificate often creates a false sense of security […]

Slack, a proprietary business communication platform that provides long-lasting chat rooms — ranging from channels to direct messages — offers users the capability to comply with HIPAA regulations for messaging and file collaboration via the platform’s paid Enterprise Grid plan.  “The Health Insurance Portability and Accountability Act of 1996 (HIPAA) is a U.S. federal law […]

Work-from-home security risks within collaborative and productivity apps such as Slack is being under appreciated. Security failures on platforms like Slack may not manifest directly as ‘platform breaches’ but indirectly through leaks of files downloaded and data shared that is then saved locally. Data breaches, malware infestations, brand or credibility damage have occurred when vulnerable […]

Enterprise privacy practices and security posture in general have not kept up with the increasingly decentralized tech stack.  The remote workforce phenomenon recently, and cloud adoption in general, is accelerating adoption of tools and services that should trigger a ‘rethink’ by enterprises to look deep into data breach risks from within. Background As an organization […]