Vulnerabilities—The Unavoidable Reality of Software

Whether a vulnerability is leaking private keys or conversations, personal data or identities, the reality is that most software used to make what we simply call “the Internet” work is often vulnerable. Whether part of the unseen systems that make up a cloud service or executing within the confines of data center grade hardware, software is ultimately what makes the digital world run.

Time for Action?

So, you can breathe easy. Or can you?

Organizations need to consider the type of data potentially leaked to chart a course forward. Credentials were leaked. API keys were leaked. Keys were leaked. Cookies were leaked. Full requests and responses were leaked, with headers and data and everything else in it. This is not going to be easy to address. If you are a Cloudflare customer, you should be in full risk assessment mode right now.

Given the breadth of data leaked by Cloudbleed, we don’t have a comprehensive “here is everything you need to do” yet because details of what data was leaked into the wild are still being uncovered. As of right now, you’re going to need to:

• Rotate API keys (if you use them)
• Generate new private keys
• Reset credentials—for employees and customers alike
• Depending on what you used cookies for, you may need to get app dev involved to understand what the potential risk is of having those cookies fall into the wrong hands

We’re Okay; We’re Not a Customer!

Maybe you’re thinking, “Well, I don’t use Cloudflare, so it doesn’t affect me.”

It most certainly does. You have employees who are consumers of many of the services—Uber, Fitbit—that we know may have been compromised. And we know from survey upon survey that employees often “reuse” passwords and credentials not just across sites, but across corporate-consumer lines. My Uber account has a personal and a corporate identity, and if I’m a typical employee (note to my manager, I’m not, really), I may have reused my corporate credentials for my Uber account.

Attackers know this. They count on this. So you need to consider very carefully what your next steps might be. Perhaps you can roll out credential resets with less urgency, but you should definitely consider rolling them out for employees, even if you aren’t a Cloudflare customer.

If you haven’t put multi-factor authentication (MFA) into place, you should plan on it. Having MFA in place means you don’t have to panic every time a provider is compromised. You can reset credentials in a rational fashion. Basically, MFA affords you some peace of mind during a potential identity compromise, the same way a Web Application Firewall (WAF) does with application vulnerabilities. You still need to deal with the underlying issue, you just have gap insurance that gives you the time to deal with it without blowing a gasket (or three).

Remember, It’s Your Data at Stake

Finally, make sure your limitation of liability in all service provider contracts covers the brand impact of a breach and any required disclosure costs. By default, these contracts typically don’t. Given the frequency of disclosures, however, it’s well worth fighting for. (Having that liability number defined is important, anyway. It’s used in many discussions from budgeting, to board presentations, to debates with business leaders about what not to do.)

This is not going to be the last time something bleeds credentials or sensitive data. Software is vulnerable, and it’s software that powers the Internet (that means the cloud, too).

And when you’ve got this under control, sit down with your IT leaders and put together a response plan for dealing with these kinds of potential data leaks in the future. Because the digital economy runs on software, and when software is exploited these days, it bleeds data.