The OWASP Foundation has revealed a data leak when some member biographies were exposed online due to a misconfiguration of its old Wiki web server
See also: Possible leak of 740GB of data from Viber
The abbreviation OWASP refers to the Open Web Application Security Project, a non-profit organization founded in December 2001 that focuses on security .
It now has tens of thousands of members and more than 250 chapters that organize educational and training conferences worldwide.
OWASP discovered the Media Wiki misconfiguration in late February, after several support requests, which resulted in the data leak.
The event only affected members who joined the foundation between 2006 and 2014 and provided resumes as part of the old membership process.
OWASP CEO Andrew van der Stocksaid :“The CVs contained names, email addresses, phone numbers, physical addresses and other personally identifiable information.”
Initially, OWASP collected resumes as part of the early membership process, where members were required to demonstrate a connection to the OWASP community from 2006 to 2014. OWASP no longer collects resumes as part of the membership process.
See also: What did we learn from China's massive cyber data leak?
The OWASP foundation will send emails to affected individuals to inform them of the data leak, even though many of them are no longer members and the exposed personal information is, in many cases, old.
OWASP resolved the data leak issue by taking several measures, disabling directory browsing and checking the server and Media Wiki for other security issues.
To prevent further access, it removed all resumes from the wiki page and cleared Cloudflare 's cache . Additionally, OWASP contacted the Web Archive and requested removal of the exposed resume information.
Mr. van der Stock added that the OWASP organization has already removed the information from the internet, so no immediate action is required from members. If the information at risk is old, then nothing needs to be done.
However, if the information is new, such as the mention of a mobile phone number, members will need to take the usual precautions, such as when responding to unsolicited emails, letters or phone calls.
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
See also: Brazil: Has the data of millions of citizens been leaked?
How can a company protect itself from data leaks?
Protecting organizations from data breaches, such as those outlined by OWASP, can be achieved through a number of measures. First, implementing a robust IT security system that includes protection against viruses, malware, and other attacks is essential. In addition, training staff on good security practices can be a valuable tool. This can include learning how to recognize and avoid phishing, using strong passwords, and avoiding using insecure networks. Implementing data security and protection policies is also critical. This can include restricting access to sensitive data, regularly reviewing and updating policies, and ensuring that all employees are aware of and adhere to these policies. Finally, using technologies such as encryption and identity management can help protect data from breaches.
Source: bleepingcomputer
