Companies may think of cloud security in terms of protection from external hackers, but a jail sentence handed down in March makes it clear that cloud-based data can fall foul of insider threats too.
Steffan Needham, 36, was jailed on March 1 for deleting 23 Amazon Web Services servers while working at digital marketing and software company Voova. Needham got two years in prison for costing the company £500,000 and giving it little choice but to let several employees go.
Reading Crown Court originally heard the case against Needham in January. According to reports, he had taken a job at Voova in 2016, but the company had to let him go after a month's trial due to sub-par performance.
Rather than going quietly, he used a colleague's computer account to access the company's Amazon Web Services account, changed the password, and created another user login. He used that account to delete his employer's online servers in the hope of covering his tracks.
The hack left Voova losing contracts with its clientele, which consisted mostly of transport companies. The servers were mostly client-related, and it was never able to recover that data.
It’s a sorry tale, but one that could have been averted with some simple cybersecurity measures.
The simplest involves the use of multi-factor authentication (MFA), which Voova admitted during the trial that it hadn’t implemented. That would have stopped the disgruntled IT worker from accessing his colleague’s account.
Other measures could include separation of duties, requiring multiple admins to approve access to operations such as server deletions.
“We would like to remind companies to ensure that log in details of former employees are no longer accessible once they have parted ways,” said investigating officer Detective Constable Giles Murphy of the cyber crime team at Loddon Valley police station.
The topic of Cloud Security will be covered throughout the free-to-attend conference at Infosecurity Europe in London from 4-6 June. See all the talks on Cloud Security here. Infosecurity Europe is the leading European event for information and cyber security; find out more and secure your free visitor badge.
