July 2022 – Direction Forward

News of largest ever alleged global hacking incident in China

China has allegedly had the details of one billion residents leaked, in what could be the biggest personal data hack ever.

Unknown hackers claim to have obtained nearly 24 terabytes of data from a Shanghai police database, claiming it contains information on one billion people and “several billion case records”. The data leaked is said to be of all ages, including children’s personal information. The data include names, addresses, birthplace, national ID numbers, phone numbers, and crime and case details. The hackers offered to sell the data for around $200,000 (~£160,000) worth of Bitcoin on an online hacking forum.

The scale of the alleged leak has shocked the Chinese security community, triggering speculation about the credibility of the claim and how it could have taken place. Zhao Changpeng, founder and Chief Executive Officer of cryptocurrency exchange Binance, tweeted on Monday the company had detected the breach of a billion resident records “from one Asian country,” and had since increased verification procedures for potentially affected users.

Shanghai authorities have not publicly responded to the alleged hack. Domestic breaches are rarely disclosed because of a lack of transparent reporting mechanisms. In 2016, personal information on dozens of Communist Party officials and industry figures from Jack Ma to Wang Jianlin was said to have been exposed on Twitter – one of the country’s biggest online leaks of sensitive information at the time. This latest incident again highlights the challenges facing Beijing as it collects data on hundreds of millions of people while tightening national policing of online content.

Last year we were tasked with building a secure file transfer system for a client, to add to their infrastructure. Their principal need for this system was for transferring files externally, i.e. between their staff and their clients, in a secure manner and environment. This would solve requirements for both general security when sharing data externally as well as specific compliance, e.g. the GDPR and enterprise service agreements.

The industry-standard solution is to use SFTP – this is where files are transferred securely using the Secure File Transfer Protocol (SFTP), which uses the Secure Shell (SSH) protocol. This means that the file transfer connection and the file contents are both encrypted.

Typically organisation-level SFTP solutions are enterprise grade, meaning they are costly to implement and use – for example IBM’s ‘Sterling Secure File Transfer’, which has obfuscated tailored pricing but starts from around £4,000 per month.

Furthermore, SFTP can be used via CLI (command line) or via FTP (file transfer protocol) software. These approaches usually require technical knowledge and would not be considered standard software for everyday users. So a more user-friendly interface would be preferred – even better if it is web-based, so external users do not have to download or install any software outside of their own organisation’s environment.

Therefore there were three challenges for the required solution:

Ensure a secure (i.e. encrypted) environment for both transfers and data stored.
Avoid enterprise level entry costs and maintenance.
Provide an easy-to-use interface for both internal and external users.

We developed a custom web app to meet all these requirements, which uses SSH over SFTP, and is hosted on the client’s private cloud in London UK. The Fileshare is discreetly branded and located at a subdomain of the client’s main domain, e.g. ‘share.companyname.com’. It works using a secure isolated application which communicates via a secure proxy to the web interface. All interactions with and transfers to/from the Fileshare are encrypted at all times. Internal and external are assigned login credentials with appropriate permissions – all clients and users are isolated from one another for data security.

Access is granted internally and externally only upon request. All access requests are reviewed internally, and access is removed once no longer required or after a defined expiry period. We also helped develop the internal processes for the client to help facilitate such access requests and removals, using Microsoft Power Automate.

The images shown are from the demo environment, not the client platform, for security reasons.

Direction Forward newly verified as a Stripe Partner

We are pleased to announce that Direction Forward has been newly verified as a Stripe Partner.

Stripe is one of the biggest payment platforms globally, processing $350 billion worth of payments in 2020.

Stripe Partners are industry experts and advisors, and help organisations of all sizes to use Stripe throughout their business.

Including: adding payment systems, adding financial services, transforming financial infrastructure, setting up recurring invoices and subscriptions, simplifying tax collection and calculations, automating reporting and workflows.

View Direction Forward on Stripe’s Partner Directory here.

UK to change data protection regulations

The UK government recently announced a Data Reform Bill which considers reducing data protection and privacy rules.

Changes would be made to the UK General Data Protection Regulation (UK GDPR), which came into force following Brexit as a continuation of the General Data Protection Regulation (GDPR) – which was implemented across Europe in May 2018.

The new UK bill proposes to reduce compliance for companies and make it easier to use personal data, as well as reform the Information Commissioner’s Office (ICO). The UK’s Department for Digital, Culture, Media and Sport (DCMS) leads this legislative agenda. Current compliance models may not need to be overhauled but the new legislation could mean that UK organisations have a more flexible approach to data protection compliance.

Since 2021, under the UK GDPR, the UK has allowed the free flow of personal data between the UK and EU. There is debate as to whether these changes will affect the current agreement with the EU. Specifically, the reduction in protection of personal data and the prioritisation of countries which the EU deems inadequate, could compromise the decision and encourage firms not to host personal data in the UK.

The new bill has not yet been decided. Current suggestions seem to indicate there will be less choice for users and less accountability for businesses. More attention to and concern for data protection is paramount to protect the individual, so it appears illogical that the UK should be the only country in Europe with plans to move in the opposite direction. Particularly when the UK is trying to regain its standing and grow international trading following Brexit – as any negative changes could weaken the ease of and opportunities for doing business.