Data Leakage

What Is Data Leakage?

Most data leaks start with an ordinary habit, not an attack. In this exercise a password written on the whiteboard behind your desk stays on camera for an entire video call with a prospective client, and one participant is not who he claims to be. The next day the contract goes to a competitor and the client database turns up for sale. You erase the whiteboard, report your part honestly, and review the rules that would have prevented it.

What You'll Learn in Data Leakage

• Recognize how credentials written on whiteboards, notes, or screens can leak through video calls and visitors
• Check your camera background, or blur it, before joining a video call
• Verify meeting participants and treat unusually specific questions about internal systems as a warning sign
• Report a data exposure immediately and honestly, even when you caused it
• Use a password manager instead of writing passwords down

Data Leakage — Training Steps

1. Introduction

   Today, you will learn about data leakage risks and how sensitive information can be accidentally exposed through everyday business activities.

2. Preparing for Client Meeting

   Alice is preparing for an important client call about Tolvanne Freight's new software product. She needs to access the client database using her account credentials. As she prepares, Alice writes down her account password on the whiteboard because it's been updated recently and she's not used to her new password yet. The password is now clearly visible on the whiteboard behind her desk, but Alice is not aware of that.

3. Accessing Client Database

   Alice needs to access the company's client database to prepare for the presentation. She uses the web browser to open Tolvanne Freight's internal client database portal and signs into her account using the password she wrote on the whiteboard. This database contains sensitive client information that will be referenced during the upcoming meeting.

4. Receiving Meeting Invitation

   Alice receives a meeting notification for the client presentation with Brisvane Solutions, a prospective client. She's been preparing all morning and is eager to make a good impression.

5. Joining the Video Call

   Alice joins the video meeting with Brisvane Solutions. She positions herself at her desk, not realizing that the whiteboard with her password is clearly visible behind her. The meeting begins and everything seems to go smoothly.

6. Successful Meeting Conclusion

   The meeting concludes with what appears to be positive results. One of the participants, Bob Stevens, asks unusually specific questions about Tolvanne Freight's architecture and security stack. Alice finds the questions slightly unusual but answers them. Overall, she believes the meeting went well.

7. Bob's Corporate Espionage

   What Alice doesn't know is that Bob Stevens was never from Brisvane Solutions: he's a corporate spy working for CompetitorCorp. During the video call, Bob noticed Alice's password on the whiteboard behind her. He now uses it to access Tolvanne Freight's client database and downloads everything.

8. Devastating Contract Loss

   The next day, Alice receives a shocking email from Brisvane Solutions informing her that they have awarded their contract to CompetitorCorp instead. The competitor somehow offered terms and pricing that exactly matched Brisvane's specific requirements.

9. Security Breach Discovery

   Later that day, Alice receives an urgent email from Tolvanne Freight's CEO: the IT security team has found the company's client data circulating on dark web marketplaces.

10. Devastating Realization

    Alice suddenly turns around and looks at her whiteboard, realizing with horror that she caused the security breach. Her password was visible behind her during the entire video call, allowing Bob to access the client database using her credentials.