7 lessons from the Cathay Pacific security breach

Earlier this year (4 March 2020), Cathay Pacific was fined £500,000 by the Information Commissioner’s Office (ICO) for a data security breach.

The breach affected a number of the airline’s systems from October 2014 until May 2018 – the fine was issued, therefore, under the Data Protection Act 1998 and reflected the maximum penalty that the ICO could issue at the time. A fine under the GDPR (which came into effect just two weeks after the breach) could have been exponentially higher.

The breach affected the personal data of 9.4 million individuals.

The ICO’s investigation found a number of basic security inadequacies, which were significant aggravating factors in the level of fine issued. Cathay Pacific’s failures present a number of very clear and simple lessons, including:

Lesson 1: Update your IT software. Cathay Pacific missed 16 security ‘patch’ updates over an 8 month period. These patches are designed to resolve publicly known vulnerabilities which can be exploited to cause a data breach.

Lesson 2: Test your defences.For three of the exposed systems, Cathay Pacific could not provide information of when the latest test had taken place. The ICO expects systems, particularly those containing sensitive data, to be ‘penetration tested’. Also, if you carry out a pen test, keep an accurate record of the test!

Lesson 3: Use antivirus software.The ICO found that Cathay Pacific’s anti-virus protection was inadequate.

Lesson 4: Use supported operating systems. Cathay Pacific’s IT system was hosted on an operating system which was no longer supported.

Lesson 5: Conduct risk assessments where appropriate. Cathay Pacific was criticised for a number of obvious vulnerabilities which would have been identified and resolved via a risk assessment, if one had been conducted as required by Cathay Pacific’s own polices.

Lesson 6: Preserve evidence. Cathay Pacific had conducted forensic analysis of certain servers during its own investigation, but decommissioned those servers before the ICO investigation. This was an aggravating factor in the ICO issuing such a large fine.

Lesson 7: Do not keep personal data longer than you need to. Cathay Pacific kept some personal data indefinitely. If it had implemented more appropriate retention periods, less personal data would have been compromised and the data security breach would have had less of an impact.