Inside a Mega Data Breach: The Cost of Mismanaged Information Governance - Data Xposure | Episode 2

如果IT和安全团队面临的最大问题不是缺乏网络安全防御，而是他们投入了过多精力去保护本不该存在的数据呢？

What if the biggest problem for IT and security teams isn't a lack of cyber defense, but is the amount of effort that those teams put in to protecting the data that shouldn't exist?

在本期节目中，我们将探讨你遗忘的数据如何成为攻击者最强大的武器。

In this episode, we'll explore how your forgotten data becomes your attacker's greatest weapon.

我是贾斯汀·托尔曼，法证领域的专家，也是由Exterro出品的面向数据风险领导者播客《数据泄露》的主持人。

I'm Justin Tolman, forensic subject matter expert and forensic host of Data Exposure, a podcast for data risk leaders brought to you by exterro.

今天，我们将深入探讨有效的信息治理如何降低你的风险，并在出现问题时减轻法证调查的负担。

Today, we dive into how effective information governance will mitigate your risk and also reduce the weight of a forensic investigation if there is a problem.

与我一同探讨的是约翰·威尔逊，HaystackID的首席信息安全官兼法证业务总裁。

Joining me is John Wilson, the chief information security officer and president of forensics at HaystackID.

你可以说是法证领域的元老级人物了，已经在这个领域很久了。

You're kind of one of the OGs of forensics, been around for a bit.

从九十年代中期一直到现在。

Started in the mid nineties till now.

除了技术本身，因为显然软件已经发生了变化。

Outside of, like, the technology, like because obviously, software has changed.

你知道，自九十年代中期以来，技术已经取得了长足进步。

You know, technology has moved forward from the mid nineties.

在取证领域，你看到过哪些真正发生改变的地方？

What are kind of the things that you've seen in forensics that have really changed?

我想把事件响应也包括在内，也就是DFIR。

And I would include incident response in that, DFIR.

在你的职业生涯中，你观察到的主要趋势和变化有哪些？

What are some of the main trends and things that you've seen over your career?

是的。

Yeah.

我的意思是，当我刚入行时，根本没有什么工具，我们那时候……我不想过多谈论技术进步，但说实话，我刚开始时都是用十六进制编辑器。

Well, I mean, so, you know, obviously, when I when I first started, there was no tooling and, you know, you do you know, we we I don't wanna get too much into the technology advancements, but, I mean, you know, it was hex editing when I first started.

就是直接去磁盘上查看数据，用十六进制编辑器，哦，等等。

It was going in, looking at data on disk and hex editing and, oh, hey.

我找的模式出现了。

There's the pattern I'm looking for.

这些是感兴趣的数据。

This is the data that's of interest.

让我看看我能用这些数据做些什么。

Let me see what I can do with that.

逐步向前推进。

Working your way forward.

显然，工具已经发展得能够比直接查看原始数据更容易地完成这些工作。

Obviously, tools have evolved to do these things much easier than just raw looking at raw data.

但我不确定。

But I don't know.

前十五年，都是电脑。

The first, you know, fifteen years, it was computers.

就是电脑。

It was just computers.

你查看一台电脑或者一块硬盘，所有的取证工作都在那里进行。

You looked at a computer or you looked at a hard disk, and that was where all the forensics was done.

现在有太多东西不再存储在硬盘上了。

So many things don't live on a hard disk anymore.

数据存在于移动设备的内存中，或者在云端，甚至在一些没人能访问的Santa Ray里。

It's it's in memory on a mobile device or it's in the cloud and, you know, a a a Santa Ray that nobody has access to.

因此，这彻底改变了你处理这一切的方式——关键在于数据可能存放的位置正在不断扩展。

And so that's really change to, you know, how you have to start approaching all of this is just the growth of, you know, where data can sit.

我的确为政府处理过一个取证案件，结果我们在微波炉里找到了数据。

I mean, you know, I I've actually worked at forensic case for the government where we found the data in a microwave.

所以，你知道的，一些奇怪的事情。

So, you know, bizarre stuff.

但数据无处不在。

But data lives everywhere.

人们现在都有智能冰箱。

I mean, people have smart fridges.

你看看他们的冰箱，冰箱会不断扫描内部情况，然后提醒他们：嘿。

You look at their fridge and their fridge is scanning their refrigerator constantly and telling them, hey.

你快没牛奶了。

You're almost out of milk.

嘿。

Hey.

你需要再多买些鸡蛋。

You need more eggs.

诸如此类的事情。

Those sort of things.

所有这些都会产生数据。

All that generates data.

但人们并没有真正意识到，这些信息是可以被利用的。

And what people don't really realize is that information can be leveraged.

你知道的。

You know?

现在这些攻击者如果能够访问你的物联网设备，了解你何时进出家门，就能在你匆忙赶时间、没时间遵循常规流程的那一刻精准下手。

So now these these threat actors, if they're getting access to your IoT devices and they're understanding when you're walking into your house, when you're leaving your house, they can catch you right at that right moment when, you know, you don't have time to follow all the normal processes because you're in a hurry.

他们知道你通常四点离开，但你还在那里。

They know that you normally leave at four, but you're still there.

你迟到了。

You're running late.

所以他们会就在那时给你发消息。

So they're gonna ping you right then.

这些信息对威胁行为者来说非常有价值，他们可以利用这些信息对你采取行动。

That's amazing information for threat actors to leverage and, you know, take action against you.

他们正在利用这些信息，再加上所有这些你所谓的文件资料，以及社交媒体——另一个迅速发展和爆炸性增长的领域，不仅被威胁行为者利用。

And they're taking that information, and then they're taking all this, you know, filed information, all of the social media, which is another area that just has really blossomed and exploded and getting leveraged in not just threat actors.

我的意思是，我们经常谈论威胁行为者，因为显然我们经常处理事件响应和数据泄露事件。

I mean, you know, we talk about threat actors a lot because, obviously, we do a lot of incident response and breach activity.

但即使在诉讼案件中，所有这些信息也可能变得非常重要。

But even just in a in a litigation case, all of this information can become very important.

如果错误的人了解或在不该获取时获得了这些信息，他们可能会制造严重问题。

If the wrong people are understanding that information or getting access to that information when they shouldn't, they can create a real problem.

所以你真的必须明白，数据已经不再是，嘿。

And so you really do have to understand that, you know, data is no longer, hey.

我有个硬盘，但我需要你的电脑做取证。

I I've got a hard drive, but I I need your computer for forensics.

是他们的手机。

It's it's their phone.

是他们的社交媒体资料。

It's their social media profiles.

是他们存储在云端的所有数据，因为现在人们无论是否意识到，都会把一切存在云端。

It's all the data they store on the cloud because people store everything on the cloud now, whether they realize it or not.

如果你在使用Teams做事，所有内容都会被存储在M365和SharePoint上，除非你是那少数仍使用本地部署的十家组织之一。

If you're using Teams to do things, everything's getting stored out in, you know, m three sixty five and SharePoint unless you're one of the, like, 10 organizations that still have on prem.

我的意思是，确实还有一些。

I mean, there are some.

我开玩笑说十家，但你知道，仍然有一些组织在使用本地部署，关键是你现在需要查看的地方太多了。

I I I joke about 10, but, you know, there's still organizations that have on prem, but it's that proliferation of places that you have to look.

而且你还得想想，我刚开始做取证的时候，那是个80兆的硬盘。

And then you also have to talk about, you know, when I did my first forensics, it was an 80 meg hard drive.

把这和今天的情况对比一下，你知道，现在你甚至能买到配备八太字节或十六太字节硬盘的苹果MacBook Pro。

Put that into perspective today and, you know, you've got you can buy an Apple MacBook Pro with, I think, eight terabytes or 16 terabyte hard drives in them now.

你还可以买到网络存储阵列和RAID阵列，它们单个就能存储接近拍字节的数据。

You can buy network arrays and and RAID arrays that, you know, store almost into the petabytes all by themselves.

这些数据已经呈爆炸式增长。

That data has just proliferated.

你不再只是在看一个硬盘了。

A, you know, you're not looking at just a hard drive anymore.

还有这么多其他的东西。

It's all these other things.

而且这些不同的设备存储数据的时间长短不一，比如移动设备，很多信息都是非常短暂的。

And all these other things store data for different periods of time, like mobile devices, you know, so a lot of the information is very transient.

你聊得越多，这些东西就越快消失。

It the more you chat, the more that goes away.

你做的操作越多，就越容易被覆盖，之前的记录也就越容易丢失。

The more you do whatever actions, the more that's getting overwritten and the prior histories are getting lost.

所有这些设备都包含大量临时数据，再加上数据量的爆炸式增长。

All of these things have a lot of transient data and then the absolute sheer proliferation.

这两点是我眼中法证领域最大的变化。

Those are the two big changes in the forensics world for me.

而我现在看到的是，我必须在这么多地方查找，还要处理比以往多得多的数据。

And and what I see is just, you know, I have to look so many places now, and I have to look at so much more data now.

这给调查人员带来了巨大的工作量，但我认为这也给那些存储你数据的公司带来了巨大压力。

That puts that puts a lot of work on the investigator, but I also think it puts a lot of pressure on these companies that are housing your data.

因为这不仅仅是像你说的那样，我们不再本地存储了。

Because it's not just, you know, to your thing, like, we're not on prem.

我们不是仅仅在这里或那里保存一个文件。

We're not just storing a file here or there.

而是我们的整个生活都被上传给了第三方服务商，比如你的手机运营商，诸如此类的服务。

It's our entire lives being uploaded to a third party providers, service providers, like your cell phone provider, all that sort of stuff.

他们现在存储的数据量非常庞大。

They're housing pretty intense amounts of data now.

‘庞大’这个词几乎都不足以形容了。

The the intense is almost not even enough of a word for it.

这简直太疯狂了。

It's it's insane.

今年我们确实遇到一个案例，我与一位客户会面，他们正面临一场严重的诉讼，涉及一些不法分子，每天生成一拍字节的数据。

We actually had a case this year where I met with a client, and, you know, they have a very serious litigation situation going on that involved some bad actors, and they generate a petabyte of data a day.

什么？

What?

我的意思是，什么？

I mean, what?

你该怎么去应对呢？

How do you, like, even get your arms around?

你怎么可能，你知道的，从这种情况下进行灾难恢复呢？

Like, how are you even you know, how would you disaster recover from that?

他们说，我们做不到。

And they're like, we can't.

它已经增长到我们只能接受的地步了。

It's just grown to where we just can.

我们明明知道我们做不到。

We we we know we can't.

我们知道，一旦出事，就会丢失大约三十天的数据，而这已经被纳入我们的风险评估中。

We know that we're just gonna lose, you know, thirty days of data if anything happens, and that's built into our risk profile.

我的意思是，每天一拍字节的数据，简直难以想象。

I I mean, you know, a petabyte a day is just unfathomable.

但事实上，这个组织每天都在生成一拍字节的数据，而他们却说，好吧，现在你们提出了数据保留要求。

But, literally, the organization is generating a petabyte data a day, and they're like, well, I you know, so now you've got this preservation request.

我无法永远为你保留每天一拍字节的数据。

I can't preserve a petabyte a day for you in perpetuity.

不仅如此，你拿到这些数据后打算怎么处理？

And not only that, what are you gonna do with it?

你到底怎么去看每天一拍字节的数据？

How are you even gonna look at a petabyte a day?

我们来谈谈这个。

Let's talk about that.

这个数字真的太吓人了。

Like, that's such a frightening number.

真是可怕的事情。

Such a frightening thing.

然后你就会想，嗯，那一拍字节里到底有什么？

And then you talk about, you know, well, what's in that petabyte?

然后你会说，天啊。

And it's like, wow.

我们那里有PCI信息。

We've got, you know, PCI information there.

我们有交易在发生。

We have transactions occurring.

我们这里有客户的财务信息，还有各种受保护的信息，你可能会担心HIPAA合规问题。

We have, you know, financial information in there from our customers and, you know, all of this protected information that, you know, has you you may have HIPAA concerns.

你可能会遇到PII和PHI的问题。

You may have PII and PHI.

我用了好多缩写，我不知道听众是否都了解这些术语，但这些都是受保护的信息。

And I'm using a lot of acronyms, and I I don't know if anybody listening is gonna know all of these things, but, it's all protected information.

这些术语里的P几乎都代表受保护的意思。

That's the p in all of those pretty much is almost all protected.

是的。

Yeah.

所以这真的让人害怕。

So it's just frightening.

我不知道我们会走向何方，因为数据一直在加速增长。

And I don't know where we're gonna land because the data has just continued to accelerate.

现在你还要考虑加入AI生成或处理信息的情况。

Now you talk about adding in, like, AI generation of information or processing of information.

有多少信息进入了AI引擎？

How much information is getting into the AI engine?

有多少数据从AI引擎中输出？

How much data is getting out of the AI engine?

你如何理解其中的风险？

And how do you understand what your risks are there?

这些挑战简直太巨大了。

The challenges are just magnificent.

数据量多得令人难以置信。

It's insane how much data.

我们还会进一步讨论，我想在接下来的时间里会继续探讨这个想法。

And we we'll talk more we'll bounce around on that idea, I think, throughout the rest of this.

但如此庞大的数据量也促进了威胁行为者的演变。

But that amount of data has kind of facilitated this evolution of threat actors as well.

你提到在我们之前的另一次通话中，过去那些威胁者只是脚本小子，或者只是在自己家地下室、妈妈家地下室里捣鼓的人。

You talked about on our on a different call we were on, it used to be script kitties or just people working in in their basement, their mom's basement.

谁知道呢？

Who knows?

对吧？

Right?

情况已经不是这样了。

It's not that way anymore.

你提到，现在几乎是这些获得风险投资的组织在充当复杂的威胁行为者。

You mentioned it's almost these venture backed organizations that are sophisticated threat actors.

你能再多分享一些关于这种演变的信息吗？

You know, can you share some more information on kind of the evolution of that?

因为这与我们存储的数据量的演变相吻合。

Because it matches kind of the evolution of how much data we're storing.

是的。

Yeah.

不。

No.

确实如此。

It absolutely does.

而且，你知道，回溯到四五年前，勒索软件正处在巅峰时期，为这些威胁行为者带来了大量收入。

And, you know, like, start talking about, you know, four or five years ago, ransomware was really having its moment and generating a lot of revenue for these threat actors.

当时很多只是些小团体，或者是一些脚本小子，或者只是有人在购买这些工具。

And a lot of them were just little small groups or, you know, this the groups of script kiddies or whatever people out just buying.

嘿。

Hey.

你可以买一个威胁包，然后 wherever 你能够渗透进去，就去部署它。

Here's a threat package you can buy and then go deploy it wherever you can get it into.

这一切就这样发生了。

And so that all kinda happened.

突然间，这开始变成一笔可观的收入。

And all of a sudden, you know, that started getting to be meaningful money.

于是现在，突然出现了这些威胁行为者，他们说：嘿。

And so now all a sudden, have these threat actors that are like, hey.

我不再需要亲自去实施攻击了。

I don't really need to go out and do the threats anymore.

我只需要出去说：买我的工具包，然后你自己去任何你能渗透的地方部署它。

All I'm gonna do is just go out and say, buy my toolkit, and you go out and push it out wherever you can get it.

然后，我们会按你获取的数据或每次成功入侵的收益，给你每美元40美分的分成，或者他们决定怎么算就怎么算。

And then, you know, we'll pay you 40¢ on a dollar for all the data that you get or for each access that you get or, you know, however they decide they wanna calculate it.

他们用的计算方式有很多不同的公式。

There's lots of different formulas that they use.

但现在，这真的变成了风险投资驱动的模式。

But so now they've you know, it it it's truly, like, venture funded.

有一群攻击者赚了大钱，于是他们出去购买更多的访问权限。

You've got the these group of threat actors that made a bunch of money, and so they're out there just buying more access.

明白吗？

Know?

嘿。

Hey.

任何能帮我进入的人，我们都会支付悬赏，然后我们去做我们的事。

Anybody that can get me in, we'll pay you a bounty, and then we'll go do our thing.

这已经真正蓬勃发展并爆炸式增长，然后你得掺和进去。

And it has just really, really blossomed and exploded to and then then you gotta mix in.

你知道，现在有国家行为者也开始参与进来了。

You know, now you have nation state actors that are getting involved.

你知道，他们早就参与了，但现在他们开始加入这些大规模的数据交易，因为他们意识到，嘿。

You know, they've been involved, but they're starting to get involved in these larger data swaps because they realize, hey.

如果我们能从几个组织那里获取大规模的数据泄露，然后把这些数据关联起来，我们就能以更少的努力达到目标。

If we can go get a huge data swap from a couple of organizations, start correlating that data, we really get where we wanted to be without having to exert as much effort.

然后你还有这些成功的威胁团伙，他们赚了钱，并且提供风险投资。

And then you've got these, you know, threat groups that have been successful, and they're making money, and they're providing venture funding.

接着他们内部又形成了像超级网络犯罪团伙那样的核心团队。

And then they have these, like, master groups within them that are, you know, almost like super super cyber gangs.

他们规模巨大。

They're huge.

他们花在研究针对你网络的漏洞上的投入，超过了你整个公司的收入。

They they spend more working on figuring out exploits against your network than your entire company's revenue.

那你究竟该怎么阻止他们呢？

So how on earth are you gonna stop them?

机器已经达到了那个水平和规模。

The machine has just gotten to that level and that scale.

而人们逐渐意识到，真正有价值的不是单个数据片段，而是这些数据的集合。

And the realization of the value of not the one bit of data, but the the conglomeration of, hey.

我可以把从公司A获取的这一条数据、从公司B获取的那一条、以及从公司C获取的另一条数据关联起来，从而形成真正的情报，进而转化为一个极具价值的攻击工具，或者渗透进公司D——而我原本根本无法直接入侵这家公司，但通过控制三家其他公司，我就能进入他们的供应商生态系统，最终渗透进去。

I can correlate this one bit that I got from company a and this bit that I got from company b and this bit from company c to actually provide real intelligence that I can then really turn into a valuable package for an attack or, you know, to gain access to company d that I could never get into because I've compromised three other people and got into the vendor ecosystems and get into that organization.

到2025年，这种攻击机制的复杂程度，远超大多数人所能想象。

And it's it's, you know, a much more sophisticated machine in 2025 than I think most people have any any guess or idea of.

是的。

Yeah.

这种数据的协同效应，让数量本身转化为了独特的质量。

That synergy of data kind of makes the the same quantity as a quality of its own.

你们会谈到国家行为体吗？

Do you talk about nation states?

他们不需要，我的意思是，如果他们攻击政府目标当然有帮助，但其实并不必要。

They don't I mean, it helps if they hack government targets, but they don't need to.

如果他们想了解人们在做什么、买什么、在哪里、行动轨迹，你完全可以针对普通人，而不是那些 hardened 的目标。

If they wanna know what the people are doing, buying, where they're at, their movements, You don't you can go after the the people, not the the hardened targets.

没错。

Well, yeah.

完全正确。

Exactly right.

而且，你知道，在治理层面也是如此。

And it's you know, even even in the governance.

所以，国家行为体已经明白了，直接在公司 A、B、C 或政府组织 A、B、C 上找到漏洞可能并不容易。

And so the nation states, they they've figured out, you know, it may not be easy to go find an exploit directly at company a, b, or c or government organization a, b, or c.

但如果我针对支持这些机构的员工，我就能开始观察他们的行为模式。

But if I target the employees that are supporting that, I can start watching their patterns.

我可以开始获取这些情报。

I can start getting that intelligence.

他们正在逐步构建一个非常精准的用户画像，比如，每当他们登录系统X时，都需要进行多因素认证。

And they're starting to build a very smart profile of, hey, you know, whenever they log into System X, they have to do MFA.

我们知道这个多因素认证是微软的。

We know that the MFA is Microsoft.

然后他们继续前进，必须通过这个网关。

And then they move on and they have to go through this gateway.

所以现在他们开始掌握更多信息，能够更好地规划了。

So now they know they're they're starting to learn a lot more and that they can, you know, alright.

现在我要针对目标了。

Now I'm gonna target.

我要寻找多因素认证中的漏洞。

I'm gonna look for weaknesses in MFA.

我要研究网关的弱点，看看能否整合出一套完整的攻击方案，直接穿透整个攻击路径——而他们现在已经对其中的每一个细节都了如指掌。

I'm gonna look in weaknesses in the gateway and see if I can put together a a, you know, ride along package to go straight through the entire attack vector that they now have very much learned all the specifics of.

而过去，他们不得不慢慢摸索。

Whereas in the past, you know, they they kinda had to hey.

我要发起攻击。

I'm gonna attack.

好的。

Okay.

我找到了一个防火墙。

I've I've found a firewall.

现在我得弄清楚这个防火墙。

Now I've gotta figure out the firewall.

现在我可以进入下一步了，也能进入下一步了。

Now I can get to the next step, and I can get to the next step.

他们必须不断深入，一层层剥开这个组织的洋葱皮。

And they have to keep digging, you know, the layers peeling the onion of the organization itself.

而现在，他们获得了大量情报，比如我知道第三、第五、第七、第九、第十、第十一、第十二层都是这样的。

Instead, now they're they're getting a lot of intelligence about, hey, I know that the, you know, third, fifth, seventh, ninth, tenth, eleventh, twelfth layers are this.

我只需要破解第一、第四和第七层，或者第一、第四和第六层，就能成功发动攻击。

All I've gotta do is solve for, you know, layers one, four, and seven or one, four, and six to have a successful attack.

是的。

Yeah.

这其实让我们想到了最近新闻中曝光的那起数据泄露事件。

Which which really leads to we we had this breach recently in the news.

18公司遭到攻击，丢失了大量记录。

18 got hit, lost a bunch of records.

但按照你描述的方式，数据泄露的经济成本几乎完全有利于攻击者。

But the way you're describing it, the economics of a breach almost seem catastrophically in favor of the threat actor.

组织该如何应对或至少减轻这类风险呢？

How do organizations compensate for that or at least mitigate those types of risks?

对。

Yeah.

我的意思是，你确实必须非常清楚，该如何在组织内实施数据保留策略？

I mean, so that's you know, you you do have to be very conscious of, you know, how do you implement your data retentions within your organization?

数据腐烂是真实存在的。

Data rot is real.

人们不喜欢谈论它，但如果数据只是躺在你的网络上，那就是一个非常大的风险。

People don't like to talk about it, but if data's just sitting on your network, that's a very, very big risk.

如果没有任何合理的业务理由保留这些数据，或者没有法规要求保留这些数据，你就根本不应该保留它们。

And if there's not a viable business reason to have the data or there's not a regulatory requirement to have the data, you shouldn't have it.

人们经常谈论，比如社会安全号码。

You know, people talk a lot about, like, Social Security numbers.

社会安全号码就是一个很好的例子，你可以看看信用卡和PCI标准，以及如何保护信用卡信息。

So Social Security numbers is a great one because you look at, like, credit cards and the the PCI standards and, you know, how you protect credit card information.

因此，有很多序列化处理，你不会存储完整的信用卡号码。

So there's a lot of serialization, and you don't store the whole credit card number.

你会对它进行加盐或哈希处理，只存储部分信息，这些部分能与其他部分关联，从而在不存储完整原始信用卡号的情况下完成交易处理，这非常好。

You you make a salt or a hash of it, and so you store certain bits and pieces and it correlates to other bits and pieces in order to be able to process those transactions without actually storing a naked raw credit card number, which is great.

但没有人对社会安全号码、健康记录标识符或组织内的员工标识符做过类似的处理。

But nobody's done that for, you know, social security number, for health record identifiers, for employee identifiers in an organization.

所有这些都可能造成同样的损害，尤其是当你开始讨论数据池规模变得多么庞大时。

And all of those things can have the same damage, especially when you start talking about how large the data pool has gotten.

随着数据量增大，攻击者如果能在平台A上获取你的社会安全号码，再从平台B上获取你的出生日期和出生城市——因为你一直在社交媒体上发布这些信息。

As this data gets larger and they can start correlating, if they can figure out your social on platform, your Social Security number on platform a, and go get your date of birth and birth city from platform b because you're posting it on social media all the time.

我不建议这么做，但没错。

I don't recommend, but Right.

我们就不深入讨论这个了。

We won't delve there.

你知道，他们能够开始说：好吧。

You know, they're able to start saying, okay.

现在我有了你的社会安全号码。

Now I've got the social.

我有了你的出生日期。

I got the date of birth.

我有了你的出生城市，还有你母亲的婚前姓氏。

I've got the birth city, and I've got the maiden name of the mother.

下一刻，他们就掌握了你的身份信息，并开始进行交易，或者更糟的是，利用你的信息在多个方面建立了一个第二身份。

And next thing you know, they've got your identity and they're performing transactions Or worse, they've, you know, set up a a secondary identity using your information in so many different aspects.

社会安全号码是一个非常关键的信息。

It's Social Security number is a really big one.

你看看你提到的AT&T数据泄露事件，那一次泄露了约一亿一千万个社会安全号码，我想是这样，或者是一亿零九百万个社会安全号码。

You look at the AT and T breach you started talking about, and that was a 110,000,000 Social Security numbers, I think it was, or a 109,000,000 Social Security numbers.

但泄露的不仅仅是社会安全号码。

But it wasn't just Social Security numbers.

还包括社会安全号码、出生日期、住址、过往住址、电话号码，以及所有这些信息的综合数据。

It was Social Security numbers, date of births, and addresses, and prior addresses, and phone numbers, and all all of this compilation of information.

因此，这是一份非常丰富的资源。

And so that's a very rich resource.

再次强调，AT&T的Snowflake泄露事件实际上始于2022年，并延续到今年年初，更多来自最初泄露的数据被公开了。

Again, that's a really, the the AT and T Snowflake Breach really started in 2022, rolled into earlier this year, more data was released from that original breach.

这都来自同一个数据源。

It was that's a single source.

但现在随着人工智能的运用和数据驱动的分析，这些组织变得更加有组织、规模更大、也更复杂，他们有了专门负责数据管理、数据挖掘的人员，现在他们会看，嘿，我们从这些公司那里获得了四次数据泄露。

But now with the the leveraging of AI and just data driven exercises As these organizations have gotten much more organized and larger and sophisticated, they have people that are doing data management, data mining, and now they're going to look at, hey, we got four breaches from these companies.

这些数据在哪里有交集？

Where do we have intersections?

在哪里还能找到更多数据，以便我们更好地了解该数据集中目标受害者的情况？

Where do we have additional data so we can start understanding a bigger picture about the target, the the the the victims that are in that dataset.

你提到了数据腐化的问题。

You mentioned that that data rot.

你非常生动地描述了其中的风险和问题。

So you very graphically, like, described the the risk and the problem.

假设我是一家组织。

How like, I'm an organization.

我已经走到了这一步，看着我的数据，听着约翰的讲解，心里想：天哪。

I've gone to this this point, and I look at my data, and I'm listening to John, and I'm like, oh, crap.

我手头有大量数据。

I've got a lot of stuff.

第一步该做什么呢？

What's kind of the first step?

比如，如果你要进入一家公司开展工作，你大概经常会这么做吧。

Like, if you were going in to do to work with a company because, you know, you'd probably do that.

你的建议是什么？

What would be your recommendation?

一个人该如何开始修复或减少这种数据腐化问题？

How does somebody get started in fixing or minimizing that data rot?

是的。

Yeah.

我的意思是，你必须先了解你的数据。

So, I mean, you you've gotta get you know, understand your data.

这可能是最重要的一步。

That's probably the biggest thing.

很多组织都以为自己了解自己的数据，但每次我参与咨询项目时，他们几乎都不真正了解。

And so many organizations think they understand their data, and every time I get involved in a consulting engagement, they rarely actually do.

是的。

Yeah.

嗯，我们会收集这些、这些和这里的这些数据。

Well, you know, we collect this, this, and this here.

然后我就说，咱们来做一下数据映射吧。

And I'm like, well, let's do some data mapping.

我们去查看一下你们的数据都存放在哪里，这些存储桶里都有什么类型的数据。

Let's go out and look at where all your data is stored and what kind of data is in those buckets.

还有啊。

And, hey.

顺便问一下，你有没有意识到你们在这里存储的是最后四位社会安全号，而在那里存储的却是完整的社会安全号？

By the way, did you realize that you're storing last four social over here and full socials over there?

所以，如果有人获得了你们的数据访问权限，他们就能通过这最后四位数，把你们存储的其他所有信息都关联起来，因为他们能在那边找到完整的社会安全号。

And so now somebody if they get an access to your data, can start correlating all the rest of the information that you're storing with just the last four because they're able to find the actual socials over here.

你知道吧？

You know?

所以你真的必须了解你的数据，知道你的个人身份信息、受保护信息、个人健康信息，以及各种受保护信息的分类具体在哪里。

So you really do have to understand your data where your understand where your PII is, your personally, you know, your protected information, personally identifiable information, your personal health information, your, you know, various categorizations of protected information.

你必须弄清楚它们全部存储在哪里。

You gotta understand where it's all stored.

然后你还需要了解你自己的业务本身。

Then you have to understand your business itself.

你知道，你对这些信息有什么要求吗？

You know, what what are your requirements to have that information?

你知道，如果你是一家医院，你可能需要保留这些信息七年。

You know, if you're a hospital, your requirements are, you know, probably seven years to maintain that information.

如果你只是一家公司，而人力资源部门因为提供健康保险而存储了个人健康信息，那么你保存员工提交的健康信息的要求可能就没那么长。

If, you know, you're just a company and it's your HR that's storing PHI because you offer health insurance, your requirements to store their health information, the things that they've submitted through the organization, may not be as long.

所以，真正理解你的要求和义务，才能进行数据映射，发现：嘿，我这里有一些已经存放了十年的数据。

So really understanding what your requirements are and what your obligations are so that you can then do that data mapping exercise and say, hey, I have data here that's been there for ten years.

我们刚为一个客户做咨询时，就发现他们的数据里存着2002年的财务记录。

I mean, we just did a consulting with a client and found financial records from 2002 in their data.

而且这位员工已经离职十二年了。

And it's like, the employees the employee's been gone for twelve years.

你为什么还留着这个？

Why do you still have this here?

我不知道。

I don't know.

这真是个问题。

That's a problem.

这可是严重的风险，也是个大问题。

That's, you know, that's serious risk, and that's a serious problem.

根本没有理由保留它。

There's no reason to have it.

制定相关政策。

Get the policies in place.

确保你满足监管要求、保护要求和业务要求，然后制定政策，再开始执行。

Make sure that you're meeting your regulatory requirements and your protective requirements and your business requirements, and then put in the policies and then start the operation.

你知道的。

You know?

你可以从最敏感的数据开始。

You can start with the super sensitive.

好的。

Okay.

我们能不能去掉社会安全号码？

Can we get rid of Social Security numbers?

我们能不能对社会安全号码进行匿名化或伪匿名化处理，用一种序列化模式替代，这样我们就能知道是谁，又能关联到相关信息。

Can we anonymize or pseudonymize the Social Security numbers, put in, you know, a serialization pattern so that we understand, you know, who the people are and it ties back to the information.

但这些信息要存储在单独管控且加密的环境中。

But then that information is stored in a separately controlled and encrypted space.

这样我就能清理大量这类信息，消除很多风险。

Then I can start cleaning up a lot of that information, start eliminating a lot of that risk.

罗德，当你谈到数据时，关键其实是了解你的数据，并删除不需要的数据。

And that's really what's key when when you're talking about data, Rod, is understanding your data and getting rid of the data that you don't need.

然后，我说真的，我们接触过的组织数不胜数，我相信你们也一样。

Then, I mean, I can't tell you how many organizations we go into, and I'm sure it's the same for you.

他们的邮件永远保存，永远保存，永远保存。

They have email forever and ever and ever and ever and ever.

人们只是在做邮件归档，如果他们的邮件系统真的在帮他们归档的话。

People are just making archives if their email system's actually making them archive it.

如今，很多系统的存储成本已经变得非常低廉。

A lot of systems nowadays, storage has become so cheap.

人们根本不在乎这一点。

People just don't pay attention to it.

是的，没错。

It's, you know, yeah.

好的。

Okay.

所以他的邮箱从10GB增长到了20GB。

So his mailbox went from 10 gigs to 20 gigs.

谁真的在乎呢？

Who really cares?

你知道，这又让我们多花了一分钱。

You know, that cost us another penny.

好吧。

Okay.

继续吧。

Move on.

嗯哼。

Mhmm.

实际的成本其实在于风险。

The actual cost is really in the risk.

在于保留这些数据。

It's in having that data.

所以关键是要理解数据、梳理数据，并清理掉那些无用的数据。

And so it's really getting into that understanding the data, mapping the data, and getting rid of the rock.

是的。

Yeah.

因为可供他们拿走的数据越少，潜在的损失就越小，当数据外泄时你所承担的风险也就越低。

Because the less there is for them to take, the less there is to lose, and the less risk you're incurring when that data does walk out.

是的。

Yeah.

当然。

Absolutely.

我经常强调，拥有数据的成本其实已经不再是什么大问题了。

And and I I constantly preach the cost of having the data isn't really that big of a deal anymore.

真的不是。

It really isn't.

问题是风险。

It's the risk.

是与这种风险相关的成本，因为它要求你做更多其他的事情。

It's the cost associated to that risk because it's requiring you to do so much more else.

而且Infogov一直认为，嘿。

And Infogov has always been, hey.

你知道的？

You know?

是的。

Yeah.

如果我们能做一点Infogov，我们就会做，但你知道，这没有投资回报。

If we can do a little bit of Infogov, we'll do it, but, you know, there's no ROI.

我们得不到任何投资回报。

We don't get any return on investment.

我不同意。

I beg to differ.

我总是向客户解释，我会一步步引导他们。

I always explain to clients, and I'll walk them through it.

你知道，Infogov有着巨大的投资回报，但你必须意识到风险的价值，因为正是风险价值才是Infogov真正带来巨大回报的地方，让你能够有效降低风险暴露。

You know, you there's a huge ROI to Infogov, but you have to realize what the risk value is because it's the risk value that really is the big return on investment in InfoGov that allows you to really limit that exposure.

IBM发布了2024年数据泄露状况报告。

IBM released their state of a state of the breach or their study for 2024.

我还没看到2025年的报告，如果他们已经发布了的话。

I haven't seen the twenty twenty five one yet if they've released it.

但在2024年，正如你所说，全球单次数据泄露的平均成本，包括罚款、对受害者的赔偿以及恢复运营的费用，达到了480万美元。

But in 2024, a to your point, the average cost of a breach worldwide, including, fines paid, port and remediation to victims, and then what it took to get them back up and running was 4,800,000 was the average cost of a breach.

但在美国，这一数字约为960万美元。

But in The United States, it was about $9,600,000.

所以，正如你所说，这些数据本身——这些吉字节的数据——价值可能远低于一千万美元。

So to your point, it it you know, that data, that housing of the data, the gigabytes are probably a lot less than $10,000,000.

但一旦这些数据泄露，它的价值就会瞬间飙升。

But if that data leaves, suddenly its value just went sky high.

完全正确。

Absolutely.

确实如此。

Absolutely.

当你谈到美国的数据泄露时，你知道，当一个组织发生泄露时，再次回到2024年的估算数据，2025年的数据尚未最终确定。

And, you know, when you talk about US breaches, you know, when a breach occurs for an organization, the '20 again, going back to 2024 estimates is twenty twenty fives aren't necessarily solidified yet.

你知道吗？

You know?

单个身份——我们通常称之为个人或实体——的价值大约是190美元，这是组织面临的成本。

An individual the value of an individual identity, you know, person or an entity is what we typically call it, you know, is around $190 each is that cost of the organization.

如果发生泄露，每个个体的成本约为190美元；如果包含医疗信息，成本会上升到约500美元。

If it's breached, each individual costs around $190 If it contains any medical information, that goes up to about $500.

这本身就是一个很好的例子，但人们甚至没有意识到，这还只是事件本身以及由此带来的风险暴露。

So there's a great example in and of itself, but people aren't even realizing that's just the actual incident itself and the risk exposure that has occurred because of it.

你还得考虑，现在我必须应对这次泄露事件。

You also have to look at now I've gotta deal with that breach event.

我得进行泄露响应，通知所有受影响的人，并且还要面对企业信誉和信任的丧失。

I gotta do breach response and notify all those people and the goodwill, the faith lost in the business.

企业。

Business.

而且，你知道，有很多例子显示，当一家公司发生重大数据泄露事件时，其股价会下跌。

And, you you know, there's plenty of examples of, you know, stocks dropping because, you know, the organization has a big breach event.

他们会遭到FTC、FCC、SEC等全球各大监管机构的巨额罚款。

They get a big fine from the FTC or the FCC or the SEC and all the three letter agencies that are around the world.

而且，你还要开始应对隐私问题。

And, you also start dealing with privacy.

因此，泄露本身的成本虽然是190美元左右，但现在你还得处理隐私通知和隐私泄露，这带来了一整套历史上从未计入这些计算的额外要求。

And so now the cost of the breach itself is that $1.90 as a for instance, but now you have to deal with privacy notifications and privacy breach, and it's a whole set of additional requirements that are not in those calculations historically.

我希望我们能看到更多这样的情况，人们不仅考虑泄露事件本身的成本和应对措施，还要考虑由此带来的隐私风险和隐私暴露。

I I I'm hoping that we start seeing more of that where people are taking into account not just the cost of a breach itself and dealing with the breach itself, but dealing with the privacy risks and the privacy exposure that comes from those as well.

但目前还没有关于这部分的明确数据。

And there is no number around that yet.

所以我们之前一直在讨论这些大企业。

When so we've been kind of talking about these big businesses.

随着威胁行为者团伙的不断扩张，它们本身就像公司一样运作，它们主要针对大企业，还是只要能从任何对象身上获利就都下手？

Do you find that with the kind of growth of the threat actor empire, they work as corporations of themselves, are they primarily targeting big businesses, or are they targeting anything they feel that they can monetize data from?

每个人都应该担心吗？有多担心？

Should everybody be worried and how much?

是的。

Yeah.

我的意思是，你知道，总有人会说，嘿。

I mean, you know, there's always the, hey.

我在寻找大的机会，大的收益。

I'm looking for the big opportunity, the big score.

但有很多这样的团体，就像我说的，它们几乎是风险投资支持的。

But there are tons of these groups that, like I said, it it's almost venture funded.

所以它们会针对所有这些小团体，你知道，上个月成功那五个家伙已经证明了他们的成功。

So it's going out to all of these small groups and, you know, the the the five guys that had success last month, they were able to prove success.

现在，风险投资团队就说，嘿。

And now the venture fund group says, hey.

这里有200万美元。

Here's $2,000,000.