← All threats
HIGH
Database Leak / Unauthorised Data Exposure
Attacker dumps or sells a customer database. Implies the data store was accessible from the internet, lacked encryption at rest, or had weak access controls. DLP, classification, encryption and database access auditing close the gap.
Attacker dumps or sells a customer database. Implies the data store was accessible from the internet, lacked encryption at rest, or had weak access controls. DLP, classification, encryption and database access auditing close the gap.
MITRE ATT&CK
Tactics, Techniques & Procedures
TA0009 Collection
tactic
TA0006 Credential Access
tactic
TA0010 Exfiltration
tactic
Defensive mapping
Mapped controls
The audit will verify each of these controls is in place and effective.
| Control | Confidence | Why it matters |
|---|---|---|
| Data loss prevention (DLP) suggested | 75% | Recommended control for data breach |
| Data classification and labelling suggested | 75% | Recommended control for data breach |
| Encryption at rest suggested | 75% | Recommended control for data breach |
| Encryption in transit suggested | 75% | Recommended control for data breach |
| Privileged access management (PAM) suggested | 75% | Recommended control for data breach |
| Logging and alerting suggested | 75% | Recommended control for data breach |