Everything You Need to Know About The Adobe Data Exposure

On Friday of last week, software giant Adobe announced a significant data exposure; nearly 7.5 million users of their Creative Cloud service suffered from an unsecured server. 

Security researcher Bob Diachenko, working alongside Comparitech, discovered the unsecured ElasticSearch server which proved accessible to the web; in fact, the server did not possess any password or authentication requirements of any kind. They made their discovery on October 19. 

Adobe closed the exposed server immediately on receiving the alert from Mr. Diachenko and Comparitech. Then the software company released a statement on the data exposure. 

“Late last week, Adobe became aware of a vulnerability related to work on one of our prototype environments. We promptly shut down the misconfigured environment, addressing the vulnerability.”

The exposed data included email addresses, account creation dates, subscribes products, subscription records, payment records, and member IDs. However, Adobe stressed the exposed information did not contain passwords or financial information. Also, the exposure did not affect Adobe products or services.

According to reports, The Adobe Creative Cloud estimated subscriber base numbers at 15 million. Of course, this indicates at least half of all Creative Cloud users suffered in this data exposure. 

What the Abode Data Exposure Means for Enterprises

Paul Bischoff, privacy advocate for Comparitech, wrote on the Adobe exposure. “The information exposed in this leak could be used against Adobe Creative Cloud users in targeted phishing emails and scams. Fraudsters could pose as Adobe or a related company and trick users into giving up further info, such as passwords, for example.”

Additionally, Alexander García-Tobar, CEO and Co-Founder of Valimail, shared his thoughts on the breach. “Phishing campaigns often follow hot on the heels of breaches like this, targeting the victims with fake security warnings that look like they came from the breached company.” 

“In fact, 83 percent of phishing emails overall are brand or company impersonations. CISOs and CIOs face a daunting task against a relentless wave of impersonation attacks. Sender identity-based email security solutions are a powerful defense that can help stem these attacks.”

In addition to email security to prevent phishing attacks, enterprises need to consider preventative identity and access management. First, your enterprise must improve its visibility over all of your databases. Incidents like the Adobe exposure often result in databases becoming blindspots in your network. These blind spots do not receive adequate identity protections because they remain obscured from view. Obviously, your enterprise can’t allow this to happen. 

Additionally, multifactor authentication (MFA) can help protect your databases from exposure. MFA helps enterprises move beyond legacy password protections, layering defenses against malicious access requests. Every additional authentication factor—including time of access request monitoring, geofencing, and biometric authentication—increases the security of your databases. 

Of course, hackers could attempt to subvert your MFA; however, it also deters most hackers away. Why would they waste their malicious time when easier enterprise targets exist? 

How to Learn More

Be sure to check out our 2019 Identity Management Buyer’s Guide for more on multifactor authentication and identity solutions. We cover key solution providers and their key capabilities. 

Widget not in any sidebars