In the world of cybersecurity, it's all too common to see companies and individuals making basic mistakes that can lead to major security breaches. The recent story of Siim Kostabi, co-founder of Pageloot, highlights one such gaffe that could have had serious consequences. Kostabi's company brought in a contractor to help with API integrations, and the developer was given access to the staging environment credentials. Instead of using a password manager or other secure methods, the developer chose to store the credentials in a Google Doc, which they set to be publicly accessible via a link.
The real horror story began when an employee at the company found the Google Doc with the staging credentials because Google Search had indexed it and offered it as a search suggestion. Kostabi recalls, "A developer on our team was debugging something unrelated and typed our domain into Google Search. The autocomplete surfaced one of our staging hostnames followed by what looked like a credential string. We checked, and there was a publicly accessible Docs URL." This means that not only were the company's credentials available to anyone online, but they were also easily searchable on Google, making them even more vulnerable.
This incident serves as a stark reminder of the importance of proper access control and offboarding procedures. Kostabi emphasizes, "Both situations were completely avoidable with basic hygiene. Proper offboarding, access reviews, and not treating shared docs like private vaults."
The consequences of such negligence can be severe. In a separate incident, Kostabi's company encountered a mid-size retailer whose QR codes were redirecting users to a competitor's site due to a disgruntled ex-employee's credentials not being revoked. This resulted in lost customers for the retailer.
The key takeaway here is that companies need to be vigilant in managing access to sensitive information. Former employees should have their access immediately revoked, and contractors should be trusted individuals with a strong understanding of security practices. By implementing these basic security measures, companies can significantly reduce the risk of data breaches and protect their valuable assets.
