{"id":4536,"date":"2019-08-21T10:35:22","date_gmt":"2019-08-21T14:35:22","guid":{"rendered":"https:\/\/solutionsreview.com\/identity-management\/?p=4536"},"modified":"2019-08-21T10:35:22","modified_gmt":"2019-08-21T14:35:22","slug":"what-the-moviepass-data-exposure-says-about-ciam","status":"publish","type":"post","link":"https:\/\/solutionsreview.com\/identity-management\/what-the-moviepass-data-exposure-says-about-ciam\/","title":{"rendered":"What The MoviePass Data Exposure Says About CIAM"},"content":{"rendered":"

\"What<\/p>\n

Yesterday, <\/span>TechCrunch<\/span><\/i> broke the story<\/span><\/a> on a data exposure by MoviePass. A theater subscription service, MoviePass exposed thousands of customer card numbers and other sensitive pieces on an online database.\u00a0<\/span><\/p>\n

Cybersecurity expert Mossab Hussain of Dubai-based SpiderSilk discovered the exposed server. He informed <\/span>TechCrunch<\/span><\/i> of his discovery almost immediately. The server contained about 161 million records, most of which consisted of automatic logs for maintenance. However, it also contained 58,000 MoviePass customer cards (which continued to grow as the story broke).\u00a0<\/span><\/p>\n

\t\t\t

\"Download<\/a><\/p>\n<\/div>\n\t\t<\/div><\/div><\/p>\n

These MoviePass customer cards function identically to other debit cards. MasterCard issues them, and customers store a cash balance on it. As such, customers can use this balance on the card to pay for movies at the theater at a discounted rate.\u00a0<\/span><\/p>\n

In the exposed database, actual credit card details including credit card numbers, expiration dates, and billing addresses also became exposed. Above all, hackers could easily use the information exposed to enact fraudulent purchases. Some of the cards received protection through masking (only exposing the last four digits). Others did not receive such protection.<\/span><\/p>\n

Additionally, Mr. Hussain and <\/span>TechCrunch <\/span><\/i>discovered the server would store email addresses and failed login attempts in real-time. This information remained exposed and unencrypted.\u00a0\u00a0<\/span><\/p>\n

At the time of writing, it remains unclear whether malicious threat actors discovered the MoviePass exposed server before its discovery. The company did not respond to requests for comment. Unfortunately, MoviePass has experienced other setbacks over the past few months, marked by a significant drop in its subscriber numbers.<\/span><\/p>\n

What The MoviePass Breach Says About CIAM<\/b><\/h2>\n

When identity security experts discuss customer identity and access management (CIAM<\/a>), they usually do so in comparison to traditional IAM. For example, CIAM needs to balance security and convenience far more than traditional IAM; customers demand a smooth user experience and faster authentication procedures than employees. Granted, experts report customers tend to abandon their digital carts with unpleasant customer identity experiences.\u00a0<\/span><\/p>\n

However, CIAM must incorporate identity security as well as convenience. Enterprises have a responsibility to securely store your customers\u2019 personally identifiable information (PII) as a consumer-facing business. In fact, because CIAM<\/a> must provide with the option for less secure logins and maintained sessions, it should emphasize stronger password hashing and storage capabilities. Additionally, it should secure the customer environment whether on-premises or cloud-based.\u00a0<\/span><\/p>\n

Remember, failing to secure your customer\u2019s data adequately can result not only in the loss of revenue and enterprise reputation. You also face compliance failure fines and other serious consequences.\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/span><\/p>\n

What the Experts Say About The MoviePass<\/b> Breach<\/b><\/h3>\n

Kevin Gosschalk<\/b><\/h3>\n

Kevin Gosschalk is CEO of<\/b>\u00a0Arkose Labs<\/b><\/span><\/a><\/p>\n

Companies must realize that digital commerce is built on data and convenience. Far too often data breaches occur due to companies leaving their databases unprotected, as witnessed last week with the first biometric database breach. Unfortunately, MoviePass suffered a breach because of the same severe lapse of security.\u00a0<\/span><\/p>\n

Consumers trust companies with their data, so much so that they save their payment and personal credentials for future use. They expect their information to be protected by the platform. Technically, this breach can be interpreted as the company giving away customer data for free. Furthermore, the breached data includes personally identifiable information (PII) and payment card information (PCI), leaving impacted customers vulnerable to future fraud or phishing attacks.<\/span><\/p>\n

Unlike credit cards, debit cards don\u2019t offer the same protection to customers. When a fraudulent transaction occurs on your credit card, you have lost no money and the issue will never impact your bank account. With a debit card, your bank account balance is directly affected from the moment the fraudulent transaction takes place. While the customers can put a hold on their cards, timing is the key in these types of situations. As this <\/span>database was left publicly accessible,<\/span> reportedly for months<\/span>, companies must learn from MoviePass\u2019s mistake and implement a proactive approach to fraud prevention that safeguards their customers\u2019 data.<\/span><\/p>\n

Robert Prigge<\/h3>\n

Robert Prigge is President of <\/b>Jumio<\/b><\/a><\/span><\/p>\n

Another week, another data breach. Today’s MoviePass breach is potentially massive in scale given the 161 million record database that was breached. It’s a little bit unclear how many of these records included sensitive consumer data, but what we should all expect is that a healthy chunk of this data will ultimately find a happy home on the dark web. What’s also clear is that KBA (knowledge-based authentication), which relies on the notion of shared secrets, should be heavily scrutinized as a reliable means of authentication.\u00a0<\/span><\/p>\n

Why? Given that more and more of our supposed shared secrets are now available for pennies on the dark web, the job of the fraudster\u2014especially those focused on account takeovers\u2014just got a little bit easier.<\/span><\/p>\n

Adam Laub<\/b><\/h3>\n

Adam Laub is CMO of <\/b>STEALTHbits Technologies<\/b><\/a><\/span><\/p>\n

There are really two separate, yet closely related components to this story. On one side you have a database rich with sensitive, personally-identifiable information that is readable in plaintext. On the other, you have a misconfiguration that allows anyone with internet access to view that information. Which is worse?\u00a0<\/span><\/p>\n

Had the data been masked, the information would still be accessible, but perhaps not so immediately valuable. If access rights were configured properly and appropriately, this discovery might never have been made and there would be no story in the first place. The right answer is both, as a layered approach to security is the ideal scenario, but either could have conceivably been enough to make this a non-issue.\u00a0<\/span><\/p>\n

While convenient to say in light of this particular situation, organizations of any type or size can drastically mitigate their risk of finding themselves in these types of situations by focusing their time on locating and limiting access to the data attackers would be most interested in, as well as verifying desired configurations are being adhered to across all devices and information assets.<\/span><\/p>\n

Thanks to our experts for their time and expertise!\u00a0<\/b><\/p>\n

To learn more about CIAM and what it can offer your enterprise, check out our 2019 Identity Management Buyer\u2019s Guide<\/a>. We cover the top solution providers and their key capabilities. Also, we provide a Bottom Line analysis for each!\u00a0<\/span><\/p>\n


Widget not in any sidebars
<\/span><\/p>\n","protected":false},"excerpt":{"rendered":"

Yesterday, TechCrunch broke the story on a data exposure by MoviePass. A theater subscription service, MoviePass exposed thousands of customer card numbers and other sensitive pieces on an online database.\u00a0 Cybersecurity expert Mossab Hussain of Dubai-based SpiderSilk discovered the exposed server. He informed TechCrunch of his discovery almost immediately. The server contained about 161 million […]<\/p>\n","protected":false},"author":41,"featured_media":4537,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"footnotes":""},"categories":[5,1],"tags":[142,1166,125,153,16,112,1204,76,1169,1221,30,1011],"acf":[],"yoast_head":"\nWhat The MoviePass Data Exposure Says About CIAM<\/title>\n<meta name=\"description\" content=\"A theater subscription service, MoviePass exposed thousands of customer card numbers and other sensitive pieces on an online database.\u00a0\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/solutionsreview.com\/identity-management\/what-the-moviepass-data-exposure-says-about-ciam\/\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Ben Canner\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"5 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/solutionsreview.com\/identity-management\/what-the-moviepass-data-exposure-says-about-ciam\/\",\"url\":\"https:\/\/solutionsreview.com\/identity-management\/what-the-moviepass-data-exposure-says-about-ciam\/\",\"name\":\"What The MoviePass Data Exposure Says About CIAM\",\"isPartOf\":{\"@id\":\"https:\/\/solutionsreview.com\/identity-management\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/solutionsreview.com\/identity-management\/what-the-moviepass-data-exposure-says-about-ciam\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/solutionsreview.com\/identity-management\/what-the-moviepass-data-exposure-says-about-ciam\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/solutionsreview.com\/identity-management\/files\/2019\/08\/new-hacker-image-resize-compressed.jpg\",\"datePublished\":\"2019-08-21T14:35:22+00:00\",\"dateModified\":\"2019-08-21T14:35:22+00:00\",\"author\":{\"@id\":\"https:\/\/solutionsreview.com\/identity-management\/#\/schema\/person\/357f925262827fcf840b4341920a1541\"},\"description\":\"A theater subscription service, MoviePass exposed thousands of customer card numbers and other sensitive pieces on an online database.\u00a0\",\"breadcrumb\":{\"@id\":\"https:\/\/solutionsreview.com\/identity-management\/what-the-moviepass-data-exposure-says-about-ciam\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/solutionsreview.com\/identity-management\/what-the-moviepass-data-exposure-says-about-ciam\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/solutionsreview.com\/identity-management\/what-the-moviepass-data-exposure-says-about-ciam\/#primaryimage\",\"url\":\"https:\/\/solutionsreview.com\/identity-management\/files\/2019\/08\/new-hacker-image-resize-compressed.jpg\",\"contentUrl\":\"https:\/\/solutionsreview.com\/identity-management\/files\/2019\/08\/new-hacker-image-resize-compressed.jpg\",\"width\":800,\"height\":400,\"caption\":\"Morgan Stanley Suffers Data Breach Due to Third-Party Attack\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/solutionsreview.com\/identity-management\/what-the-moviepass-data-exposure-says-about-ciam\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/solutionsreview.com\/identity-management\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"What The MoviePass Data Exposure Says About CIAM\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/solutionsreview.com\/identity-management\/#website\",\"url\":\"https:\/\/solutionsreview.com\/identity-management\/\",\"name\":\"Best Identity Access Management (IAM) Software, Tools, Vendors, Solutions, & Services\",\"description\":\"Identity Access Management (IAM) News, Best Practices and Buyer's Guide\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/solutionsreview.com\/identity-management\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/solutionsreview.com\/identity-management\/#\/schema\/person\/357f925262827fcf840b4341920a1541\",\"name\":\"Ben Canner\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/solutionsreview.com\/identity-management\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/63f68345052a446ce0cc9c802dd3f373?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/63f68345052a446ce0cc9c802dd3f373?s=96&d=mm&r=g\",\"caption\":\"Ben Canner\"},\"description\":\"Ben Canner is an enterprise technology writer and analyst covering Identity Management, SIEM, Endpoint Protection, and Cybersecurity writ large. He holds a Bachelor of Arts Degree in English from Clark University in Worcester, MA. He previously worked as a corporate blogger and ghost writer. You can reach him via Twitter and LinkedIn.\",\"url\":\"https:\/\/solutionsreview.com\/identity-management\/author\/bcanner\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"What The MoviePass Data Exposure Says About CIAM","description":"A theater subscription service, MoviePass exposed thousands of customer card numbers and other sensitive pieces on an online database.\u00a0","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/solutionsreview.com\/identity-management\/what-the-moviepass-data-exposure-says-about-ciam\/","twitter_misc":{"Written by":"Ben Canner","Est. reading time":"5 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/solutionsreview.com\/identity-management\/what-the-moviepass-data-exposure-says-about-ciam\/","url":"https:\/\/solutionsreview.com\/identity-management\/what-the-moviepass-data-exposure-says-about-ciam\/","name":"What The MoviePass Data Exposure Says About CIAM","isPartOf":{"@id":"https:\/\/solutionsreview.com\/identity-management\/#website"},"primaryImageOfPage":{"@id":"https:\/\/solutionsreview.com\/identity-management\/what-the-moviepass-data-exposure-says-about-ciam\/#primaryimage"},"image":{"@id":"https:\/\/solutionsreview.com\/identity-management\/what-the-moviepass-data-exposure-says-about-ciam\/#primaryimage"},"thumbnailUrl":"https:\/\/solutionsreview.com\/identity-management\/files\/2019\/08\/new-hacker-image-resize-compressed.jpg","datePublished":"2019-08-21T14:35:22+00:00","dateModified":"2019-08-21T14:35:22+00:00","author":{"@id":"https:\/\/solutionsreview.com\/identity-management\/#\/schema\/person\/357f925262827fcf840b4341920a1541"},"description":"A theater subscription service, MoviePass exposed thousands of customer card numbers and other sensitive pieces on an online database.\u00a0","breadcrumb":{"@id":"https:\/\/solutionsreview.com\/identity-management\/what-the-moviepass-data-exposure-says-about-ciam\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/solutionsreview.com\/identity-management\/what-the-moviepass-data-exposure-says-about-ciam\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/solutionsreview.com\/identity-management\/what-the-moviepass-data-exposure-says-about-ciam\/#primaryimage","url":"https:\/\/solutionsreview.com\/identity-management\/files\/2019\/08\/new-hacker-image-resize-compressed.jpg","contentUrl":"https:\/\/solutionsreview.com\/identity-management\/files\/2019\/08\/new-hacker-image-resize-compressed.jpg","width":800,"height":400,"caption":"Morgan Stanley Suffers Data Breach Due to Third-Party Attack"},{"@type":"BreadcrumbList","@id":"https:\/\/solutionsreview.com\/identity-management\/what-the-moviepass-data-exposure-says-about-ciam\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/solutionsreview.com\/identity-management\/"},{"@type":"ListItem","position":2,"name":"What The MoviePass Data Exposure Says About CIAM"}]},{"@type":"WebSite","@id":"https:\/\/solutionsreview.com\/identity-management\/#website","url":"https:\/\/solutionsreview.com\/identity-management\/","name":"Best Identity Access Management (IAM) Software, Tools, Vendors, Solutions, & Services","description":"Identity Access Management (IAM) News, Best Practices and Buyer's Guide","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/solutionsreview.com\/identity-management\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/solutionsreview.com\/identity-management\/#\/schema\/person\/357f925262827fcf840b4341920a1541","name":"Ben Canner","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/solutionsreview.com\/identity-management\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/63f68345052a446ce0cc9c802dd3f373?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/63f68345052a446ce0cc9c802dd3f373?s=96&d=mm&r=g","caption":"Ben Canner"},"description":"Ben Canner is an enterprise technology writer and analyst covering Identity Management, SIEM, Endpoint Protection, and Cybersecurity writ large. He holds a Bachelor of Arts Degree in English from Clark University in Worcester, MA. He previously worked as a corporate blogger and ghost writer. You can reach him via Twitter and LinkedIn.","url":"https:\/\/solutionsreview.com\/identity-management\/author\/bcanner\/"}]}},"_links":{"self":[{"href":"https:\/\/solutionsreview.com\/identity-management\/wp-json\/wp\/v2\/posts\/4536"}],"collection":[{"href":"https:\/\/solutionsreview.com\/identity-management\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/solutionsreview.com\/identity-management\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/solutionsreview.com\/identity-management\/wp-json\/wp\/v2\/users\/41"}],"replies":[{"embeddable":true,"href":"https:\/\/solutionsreview.com\/identity-management\/wp-json\/wp\/v2\/comments?post=4536"}],"version-history":[{"count":0,"href":"https:\/\/solutionsreview.com\/identity-management\/wp-json\/wp\/v2\/posts\/4536\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/solutionsreview.com\/identity-management\/wp-json\/wp\/v2\/media\/4537"}],"wp:attachment":[{"href":"https:\/\/solutionsreview.com\/identity-management\/wp-json\/wp\/v2\/media?parent=4536"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/solutionsreview.com\/identity-management\/wp-json\/wp\/v2\/categories?post=4536"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/solutionsreview.com\/identity-management\/wp-json\/wp\/v2\/tags?post=4536"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}