An infrastructure should be designed to be secure without sacrifice performance and operativity.
Personally identifiable information (PII) is any kind of data that can be linked back to an identifiable person. This personal data can include driver’s licenses, dates of birth, social security number, email addresses, phone numbers, credit card numbers, or passwords that are tied to a person’s name, username, or other factors that identify them. Financial Information
especially when associated with personal information, is especially vulnerable to data breaches. Any financial information gained in a data breach can be used to commit fraud or identity theft, where a bad actor can make unauthorized purchases or reports in someone else’s name. Health Information
It may sound strange that health information is often stolen and compromised. However, healthcare remains the most expensive industry in terms of data breaches for 12 years running. The cost of a data breach in this industry averaged $10.10 million in 2022, with the financial industry at a distant second incurring $5.97 million in costs on average. Similarly to financial information, health information can include extremely sensitive PII such as social security numbers, which can be used to commit identity theft. In financial breaches, sometimes only one or two pieces of important information can be revealed. With health information, there is often a wider array of PII available in one place. Intellectual Property
If an organization has valuable intellectual property, this may also be the motivation for a data breach. Trade secrets, in-process patents, or other confidential information may be highly valuable if sold to the right buyer. Malicious insiders may know someone who wants this information – just over 10% of all data breaches are attributed to actions from people on the inside. Competitive Intelligence
Similarly, competition information may be of interest to the right audience. Whether a business has collected information about their competitors, or a competitor is interested in uncovering more about the pricing or marketing strategies of a business, certain information can be used to gain a competitive advantage. Legal Information
Legal documents, such as agreements and contracts, may be valuable, especially for the sensitive data they can contain. Data that is found in legal information can be used to commit fraud, similar to financial and health information. IT Security Information
Just like PII can open the floodgates and uncover more sensitive information as criminals connect the dots, IT security information can play the same role in the systems of an organization. Uncovering passwords or other important credentials can serve as an open door, sometimes allowing access to entire systems.
Example managed by nginx
location /kafka-ui {
auth_basic "Administrator s Area";
auth_basic_user_file /etc/apache2/.htpasswd;
proxy_pass http://kafka-ui:8080;
}
Example in python flask:
def token_required(f):
@wraps(f)
def token_dec(*args, **kwargs):
= request.headers.get('token')
token if not token:
return retDict({"status":"token rejected","message":"Missing Token!"}, 400)
if token != app.config['SECRET_KEY']:
return retDict({"status":"token rejected","message":"Invalid Token"}, 401)
return f(*args, **kwargs)
return token_dec
Example in go gorilla/mux
func generateJWT() (tokenString string, err error) {
token := jwt.NewWithClaims(jwt.SigningMethodHS256, jwt.MapClaims{
"iat": time.Now().Unix(),
"exp": time.Now().Add(time.Hour * 1).Unix()})
tokenString, err = token.SignedString([]byte("secret"))
return tokenString, err
}
func authenticateRequest(authHeader string) bool {
data, err := base64.StdEncoding.DecodeString(authHeader)
if err != nil {
fmt.Println("error:", err)
return false
}
userpwd := strings.Split(string(data), ":")
userpwdmap := userpassword()
if userpwdmap[userpwd[0]] == userpwd[1] {
return true
}
return false
}
func authenticateJWT(header http.Header) bool {
jwtString := header.Get("Authentication")
if len(jwtString) == 0 {
return false
}
token, err := jwt.Parse(jwtString, func(token *jwt.Token) (interface{}, error) {
if _, ok := token.Method.(*jwt.SigningMethodHMAC); !ok {
return nil, fmt.Errorf("Unexpected signing method: %v", token.Header["alg"])
}
return []byte("secret"), nil
})
if err == nil && token.Valid {
return true
} else {
return false
}
return false
}
Example in nginx with apache2 password generation
location /secret.html {
auth_basic "Administrator s Area";
auth_basic_user_file /etc/apache2/.htpasswd;
}